Non notée
CVE-2022-41722 A path traversal vulnerability exists in filepath.Clean on Windows
Description
A path traversal vulnerability exists in filepath.Clean on Windows. On Windows, the filepath.Clean function could transform an invalid path such as "a/../c:/b" into the valid path "c:\b". This transformation of a relative (if invalid) path into an absolute path could enable a directory traversal attack. After fix, the filepath.Clean function transforms this path into the relative (but still invalid) path ".\c:\b".
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| path/filepath 1.20 | 1.20.0-0 → < 1.20.1 | 1.20.1 |
| path/filepath 1.19 | premières → < 1.19.6 | 1.19.6 |
Références
- go.dev go.dev
- go.dev go.dev
- groups.google.com groups.google.com
- pkg.go.dev pkg.go.dev
Chronologie
- Publiée
- Dernière modification
Autres CVE de path/filepath
Les 6 CVE de path/filepath →
CVE-2024-8244
The filepath.Walk and filepath.WalkDir functions are documented as not following symbolic links, but both functions…
3.7
Faible
CVE-2023-45284
On Windows, The IsLocal function does not correctly detect reserved device names in some cases
5.3
Moyenne
CVE-2023-45283
The filepath package does not recognize paths with a \??\ prefix as special
Non notée
CVE-2022-30632
Uncontrolled recursion in Glob in path/filepath before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic…
Non notée