ArchLinux: 202106-39: thefuck: arbitrary file overwrite | LinuxSecu...

Advisories

Arch Linux Security Advisory ASA-202106-39
==========================================

Severity: Medium
Date    : 2021-06-15
CVE-ID  : CVE-2021-34363
Package : thefuck
Type    : arbitrary file overwrite
Remote  : No
Link    : https://security.archlinux.org/AVG-2062

Summary
=======

The package thefuck before version 3.31-1 is vulnerable to arbitrary
file overwrite.

Resolution
==========

Upgrade to 3.31-1.

# pacman -Syu "thefuck>=3.31-1"

The problem has been fixed upstream in version 3.31.

Workaround
==========

None.

Description
===========

The thefuck package before 3.31 allows path traversal that leads to
arbitrary file deletion via the "undo archive operation" feature.

Impact
======

An attacker could delete arbitrary files by tricking a user to use the
"undo archive operation" feature on a crafted archive file.

References
==========

https://vuln.ryotak.me/advisories/48
https://github.com/nvbn/thefuck/commit/e343c577cd7da4d304b837d4a07ab4df1e023092
https://security.archlinux.org/CVE-2021-34363

ArchLinux: 202106-39: thefuck: arbitrary file overwrite

June 17, 2021
The package thefuck before version 3.31-1 is vulnerable to arbitrary file overwrite

Summary

The thefuck package before 3.31 allows path traversal that leads to arbitrary file deletion via the "undo archive operation" feature.

Resolution

Upgrade to 3.31-1.
# pacman -Syu "thefuck>=3.31-1"
The problem has been fixed upstream in version 3.31.

References

https://vuln.ryotak.me/advisories/48 https://github.com/nvbn/thefuck/commit/e343c577cd7da4d304b837d4a07ab4df1e023092 https://security.archlinux.org/CVE-2021-34363

Severity
CVE-ID : CVE-2021-34363
Package : thefuck
Type : arbitrary file overwrite
Remote : No
Link : https://security.archlinux.org/AVG-2062

Impact

An attacker could delete arbitrary files by tricking a user to use the "undo archive operation" feature on a crafted archive file.

Workaround

None.

Related News

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.