Description
The ArchiveReader.extractContents() function used by cctl image load and container image load performs no pathname validation before extracting an archive member. This means that a carelessly or maliciously constructed archive can extract a file into any user-writable location on the system using relative pathnames. This issue is addressed in container 0.8.0 and containerization 0.21.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apple | Container | unspecified – < 0.7.1 | 0.7.1 |
| Apple | Containerization | unspecified – < 0.20.1 | 0.20.1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| SwiftURL | github.com/apple/container | < 0.8.0 | 0.8.0 | GHSA-cq3j-qj2h-6rv3 |
| SwiftURL | github.com/apple/containerization | < 0.21.0 | 0.21.0 | GHSA-cq3j-qj2h-6rv3 |