CVE-2022-23531CWE-23

Arbitrary file write when scanning a specially-crafted local PyPI package

Medium · published December 16, 2022

CVSS v3.1
5.8
EPSS
1%
Percentile
53.9
In the wild
Unconfirmed
What it is

GuardDog is a CLI tool to identify malicious PyPI packages. Versions prior to 0.1.5 are vulnerable to Relative Path Traversal when scanning a specially-crafted local PyPI package. Running GuardDog against a specially-crafted package can allow an attacker to write an arbitrary file on the machine where GuardDog is executed due to a path traversal vulnerability when extracting the .tar.gz file of the package being scanned, which exists by design in the tarfile.TarFile.extractall function. This issue is patched in version 0.1.5.

The record
Technical detail
CVSS v3.1
5.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00734 · 53.9th percentile
Weakness
CWE-23 · Relative Path Traversal
Published
2022-12-16T23:41Z
EPSS history
Timeline
  • 16 DEC 23:41Z
    Arbitrary file write when scanning a specially-crafted local PyPI package
    cvelistv5