Homepage

unearth@0.17.4

A utility to fetch and download python packages

  • latest version

    0.18.3

  • first published

    4 years ago

  • latest version published

    1 days ago

  • licenses detected

  • View unearth package health on Snyk  (opens in a new tab)
    • Go back to all versions of this package
    Report a new vulnerability Found a mistake?

    Direct Vulnerabilities

    Known vulnerabilities in the unearth package. This does not include vulnerabilities belonging to this package’s dependencies.

    Fix vulnerabilities automatically

    Snyk's AI Trust Platform automatically finds the best upgrade path and integrates with your development workflows. Secure your code at zero cost.

    Fix for free
    VulnerabilityVulnerable Version
    • H
    Directory Traversal

    unearth is an A utility to fetch and download python packages

    Affected versions of this package are vulnerable to Directory Traversal through the is_within_directory check in _untar_archive and is_within_directory in unearth’s tar extraction code. An attacker can write files outside the intended extraction directory by supplying a malicious tar archive with ../ path components or symlink members that bypass the containment check. When is_within_directory compares unnormalized paths, crafted archive entries can satisfy the directory check without actually resolving inside the destination tree. This lets a remote attacker who can get a tar archive processed by unearth overwrite arbitrary filesystem locations accessible to the process, breaking file integrity and potentially corrupting or replacing application data.

    How to fix Directory Traversal?

    A fix was pushed into the master branch but not yet published.

    [0.2.0,)
    Go back to all versions of this package