CVE-2020-29529

HashiCorp go-slug up to 0.4.3 did not fully protect against directory traversal while unpacking tar archives, and protections could be bypassed with specific…

published December 3, 2020

CVSS
—
EPSS
3%
Percentile
86.5
In the wild
Unconfirmed
What it is

HashiCorp go-slug up to 0.4.3 did not fully protect against directory traversal while unpacking tar archives, and protections could be bypassed with specific constructions of multiple symlinks. Fixed in 0.5.0.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02817 · 86.5th percentile
Published
2020-12-03T19:04Z
EPSS history
Timeline
  • 03 DEC 19:04Z
    HashiCorp go-slug up to 0.4.3 did not fully protect against directory traversal while unpacking tar archives, and protections could be bypassed with specific…
    cvelistv5