Non notée
CVE-2022-29804 Incorrect conversion of certain invalid paths to valid, absolute paths in Clean in path/filepath before Go 1.17.11 and…
Description
Incorrect conversion of certain invalid paths to valid, absolute paths in Clean in path/filepath before Go 1.17.11 and Go 1.18.3 on Windows allows potential directory traversal attack.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| path/filepath 1.18 | 1.18.0-0 → < 1.18.3 | 1.18.3 |
| path/filepath 1.17 | premières → < 1.17.11 | 1.17.11 |
Références
- go.dev go.dev
- go.googlesource.com go.googlesource.com
- go.dev go.dev
- groups.google.com groups.google.com
- pkg.go.dev pkg.go.dev
Chronologie
- Publiée
- Dernière modification
Autres CVE de path/filepath
Les 6 CVE de path/filepath →
CVE-2024-8244
The filepath.Walk and filepath.WalkDir functions are documented as not following symbolic links, but both functions…
3.7
Faible
CVE-2023-45284
On Windows, The IsLocal function does not correctly detect reserved device names in some cases
5.3
Moyenne
CVE-2023-45283
The filepath package does not recognize paths with a \??\ prefix as special
Non notée
CVE-2022-41722
A path traversal vulnerability exists in filepath.Clean on Windows
Non notée