https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 13 Oct 2026 07:33:45 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-46023 EUVD-2026-46023 https://cve.radiocsirt.org/vuln/euvd-2026-46023 https://cve.radiocsirt.org/vuln/fkie_cve-2020-26277 <p>DBdeployer is a tool that deploys MySQL database servers easily. In DBdeployer before version 1.58.2, users unpacking a tarball may use a maliciously packaged tarball that contains symlinks to files external to the target. In such scenario, an attacker could induce dbdeployer to write into a system file, thus altering the computer defenses. For the attack to succeed, the following factors need to contribute: 1) The user is logged in as root. While dbdeployer is usable as root, it was designed to run as unprivileged user. 2) The user has taken a tarball from a non secure source, without testing the checksum. When the tarball is retrieved through dbdeployer, the checksum is compared before attempting to unpack. This has been fixed in version 1.58.2.</p> <p>DBdeployer is a tool that deploys MySQL database servers easily. In DBdeployer before version 1.58.2, users unpacking a tarball may use a maliciously packaged tarball that contains symlinks to files external to the target. In such scenario, an attacker could induce dbdeployer to write into a system file, thus altering the computer defenses. For the attack to succeed, the following factors need to contribute: 1) The user is logged in as root. While dbdeployer is usable as root, it was designed to run as unprivileged user. 2) The user has taken a tarball from a non secure source, without testing the checksum. When the tarball is retrieved through dbdeployer, the checksum is compared before attempting to unpack. This has been fixed in version 1.58.2.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2020-26277 https://cve.radiocsirt.org/vuln/ghsa-47wr-426j-fr82 <p><strong>Affected:</strong> Go: github.com/datacharmer/dbdeployer</p> <p>### Impact _Users unpacking a tarball through dbdeployer may use a maliciously packaged tarball that contains symlinks to files external to the target. In such scenario, an attacker could induce dbdeployer to write into a system file, thus altering the computer defences._</p> <p>### Mitigating factors For the attach to succeed, the following factors need to contribute:</p> <p>* The user is logged in as root. While dbdeployer is usable as root, it was designed to run as unprivileged user. * The user has taken a tarball from a non secure source, without testing the checksum. When the tarball is retrieved through dbdeployer, the checksum is compared before attempting to unpack.</p> <p>### Analysis</p> <p>An attacker could inject a symbolic link into the tarball, so that a file could result into `fake_file -&gt; /etc/passwd` or some equally important file. As it is now, dbdeployer would create the symlink as defined, with a local file `fake_file` linked to `/etc/passwd`. The danger here is that any process with the privileges to write to both `fake_file` and `/etc/passwd` could overwrite the system file. Even without malicious intent, this could result in the system to become unusable. As noted above, the user must have write privileges to the target file to do the damage.</p> <p>### Remedies</p> <p>It has been suggested that the extract procedure use `filepath.EvalSymlinks` to determine whether the target is within the extraction directory. Unfortunately, this approach is unavailable in this context, because it wo…</p> <p><strong>Affected:</strong> Go: github.com/datacharmer/dbdeployer</p> <p>### Impact _Users unpacking a tarball through dbdeployer may use a maliciously packaged tarball that contains symlinks to files external to the target. In such scenario, an attacker could induce dbdeployer to write into a system file, thus altering the computer defences._</p> <p>### Mitigating factors For the attach to succeed, the following factors need to contribute:</p> <p>* The user is logged in as root. While dbdeployer is usable as root, it was designed to run as unprivileged user. * The user has taken a tarball from a non secure source, without testing the checksum. When the tarball is retrieved through dbdeployer, the checksum is compared before attempting to unpack.</p> <p>### Analysis</p> <p>An attacker could inject a symbolic link into the tarball, so that a file could result into `fake_file -&gt; /etc/passwd` or some equally important file. As it is now, dbdeployer would create the symlink as defined, with a local file `fake_file` linked to `/etc/passwd`. The danger here is that any process with the privileges to write to both `fake_file` and `/etc/passwd` could overwrite the system file. Even without malicious intent, this could result in the system to become unusable. As noted above, the user must have write privileges to the target file to do the damage.</p> <p>### Remedies</p> <p>It has been suggested that the extract procedure use `filepath.EvalSymlinks` to determine whether the target is within the extraction directory. Unfortunately, this approach is unavailable in this context, because it wo…</p> https://cve.radiocsirt.org/vuln/ghsa-47wr-426j-fr82 https://cve.radiocsirt.org/vuln/gsd-2020-26277 gsd-2020-26277 https://cve.radiocsirt.org/vuln/gsd-2020-26277