Filename spoofing in archive

Code

The project this record applies to. Exploit listings stay in References.

• Repository · github.com

Timeline

Detection, updates, and resolution for this record.

1. Aug 31, 2023 · GitHub Advisory Database

   Detected

   An issue in Archive v3.3.7 allows attackers to spoof zip filenames which can lead to inconsistent filename parsing.

2. Oct 2, 2024 · GitHub Advisory Database

   Fix available

   archive fixed in 3.3.8

3. Oct 2, 2024 · GitHub Advisory Database

   Fix available

   archive fixed in 3.3.8

4. Oct 2, 2024 · GitHub Advisory Database

   Updated

   An issue in Archive v3.3.7 allows attackers to spoof zip filenames which can lead to inconsistent filename parsing.

Affected

• Pub archive0 → 3.3.8

Sources

• CVE.orgVulnerability recordCVE-2023-39137

  Official CVE identifier

  cve.org
• GitHub Advisory DatabasePackage advisoryGHSA-r285-q736-9v95

  GitHub Advisory Database record mirrored by OSV.

  github.com
• OSV.devPackage advisoryGHSA-r285-q736-9v95

  Filename spoofing in archive

  osv.dev

References

• WEB · blog.ostorlab.co
• PACKAGE · github.com
• WEB · github.com
• WEB · github.com
• ADVISORY · nvd.nist.gov
• WEB · ostorlab.co
• WEB · rapid7.com