CVE-2020-26279 (published 2021-03-24T21:15Z)

go-ipfs is an open-source golang implementation of IPFS which is a global, versioned, peer-to-peer filesystem. In go-ipfs before version 0.8.0-rc1, it is possible for path traversal to occur with DAGs containing relative paths during retrieval. This can cause files to be overwritten, or written to incorrect output directories. The issue can only occur when a get is done on an affected DAG. This is fixed in version 0.8.0-rc1.

Severity: MEDIUM
CVSS v2 base score: 5.5 (AV:N/AC:L/Au:S/C:N/I:P/A:P)
CVSS v3 base score: 8.1, HIGH (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)

Weakness information:
cwe_id: CWE-22
cwe_name: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
extended_description: 
            Many file operations are intended to take place within a restricted directory. By using special elements such as ".." and "/" separators, attackers can escape outside of the restricted location to access files or directories that are elsewhere on the system. One of the most common special elements is the "../" sequence, which in most modern operating systems is interpreted as the parent directory of the current location. This is referred to as relative path traversal. Path traversal also covers the use of absolute pathnames such as "/usr/local/bin" to access unexpected files. This is referred to as absolute path traversal.
         
         

Fix information:
repo_url: https://github.com/ipfs/go-ipfs
commit_details: repo_url: https://github.com/ipfs/go-ipfs
author: Adin Schmahmann
author_date: 2020-12-08 17:12:31-05:00
msg: Merge pull request #7812 from ipfs/chore/update-deps

chore: update deps
repository: repo_url: https://github.com/ipfs/go-ipfs
repo_name: ipfs/kubo
description: An IPFS implementation in Go
repo_language: Go
owner: ipfs
repo_url: https://github.com/whyrusleeping/tar-utils
commit_details: repo_url: https://github.com/whyrusleeping/tar-utils
author: Adin Schmahmann
author_date: 2020-12-01 13:18:14-05:00
msg: more closely match default tar errors (GNU + BSD binaries)
repository: repo_url: https://github.com/whyrusleeping/tar-utils
repo_name: whyrusleeping/tar-utils
description: tar utilities extracted from go-ipfs codebase
repo_language: Go
owner: whyrusleeping
file_changes: filename: extractor.go
change_type: ModificationType.MODIFY
diff: @@ -104,7 +104,12 @@ func (te *Extractor) Sanitize(toggle bool) {
 
 // outputPath returns the path at which to place tarPath
 func (te *Extractor) outputPath(tarPath string) (outPath string, err error) {
-	elems := strings.Split(tarPath, "/")    // break into elems
+	elems := strings.Split(tarPath, "/") // break into elems
+	for _, e := range elems {
+		if e == ".." {
+			return "", fmt.Errorf("%s : path contains '..'", tarPath)
+		}
+	}
 	elems = elems[1:]                       // remove original root
 	outPath = strings.Join(elems, "/")      // join elems
 	outPath = gopath.Join(te.Path, outPath) // rebase on to extraction target root

programming_language: Go