CWE data temporarily unavailableCWE data is currently experiencing intermittent outages, which may cause incomplete section loading on CVE pages. We are actively working on a fix.

CVE-2024-0406

Description

A flaw was discovered in the mholt/archiver package. This flaw allows an attacker to create a specially crafted tar file, which, when unpacked, may allow access to restricted files or directories. This issue can allow the creation or overwriting of files with the user's or application's privileges using the library.

Statement

This is a path traversal vulnerability in v3 of mhol/archiver and has been marked as moderate for a variety of reasons. First and foremost the attacker in order to exploit this vulnerability would require local files system/code execution level access, this cannot be exploited on a network level, secondly, the successful exploitation of this vulnerability only result in overwriting of files, not denial of service due to resource exhaustion and no code execution, keeping all these things in mind redhat has assigned this as moderate impact.

Common Vulnerability Scoring System (CVSS) Score Details

Info alert:Important note

CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).

CVSS v3 Score Breakdown

Red HatNVDcve.org
Base Score6.17.8N/A
Attack VectorLocalLocalN/A
Attack ComplexityLowLowN/A
Privileges RequiredNoneNoneN/A
User InteractionRequiredRequiredN/A
ScopeUnchangedUnchangedN/A
ConfidentialityLowHighN/A
Integrity ImpactHighHighN/A
Availability ImpactNoneHighN/A

Vector

Red Hat: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N

NVD: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Acknowledgements

This issue was discovered by Stefan Cornelius (Red Hat).

Frequently Asked Questions

Not sure what something means? Check out our Security Glossary.

Want to get errata notifications? Sign up here.