{"schema_version":"1.3.1","id":"GO-2021-0099","modified":"2024-05-20T16:03:47Z","published":"2021-04-14T20:04:52Z","aliases":["CVE-2021-21272","GHSA-g5v4-5x39-vwhx"],"summary":"Zip slip directory exploit in github.com/deislabs/oras","details":"Due to improper path validation, using the github.com/deislabs/oras/pkg/content.FileStore content store may result in directory traversal during archive extraction, allowing a malicious archive to write paths to arbitrary paths that the process can write to.","affected":[{"package":{"name":"github.com/deislabs/oras","ecosystem":"Go"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.9.0"}]}],"ecosystem_specific":{"imports":[{"path":"github.com/deislabs/oras/pkg/content","symbols":["extractTarDirectory","fileWriter.Commit"]}]}}],"references":[{"type":"FIX","url":"https://github.com/deislabs/oras/commit/96cd90423303f1bb42bd043cb4c36085e6e91e8e"}],"credits":[{"name":"Chris Smowton"}],"database_specific":{"url":"https://pkg.go.dev/vuln/GO-2021-0099","review_status":"REVIEWED"}}