Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
4 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
A path traversal vulnerability exists in GuardDog's safeextract() function that allows malicious PyPI packages to write arbitrary files outside the intended extraction directory, leading to Arbitrary File Overwrite and Remote Code Execution on systems running GuardDog. CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) Details Vulnerable Code File: guarddog/utils/archives.py Root Cause The comment about zip.extract() fooled me at first :) then I noticed the os.path.join() call. The vulnerability stems from incorrect usage of Python's zipfile.ZipFile.extract() API: - The path parameter should be the target directory, not a full file path - extract() automatically appends the member name to the path - By passing os.path.join(targetdirectory, file), GuardDog causes the filename to be appended twice - This breaks zipfile's built-in path traversal sanitization Attack Vector 1. Attacker creates malicious wheel with path traversal filenames 2. Uploads to PyPI…
Recommended action: Upgrade to 2.7.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
GuardDog's safeextract() function does not validate decompressed file sizes when extracting ZIP archives (wheels, eggs), allowing attackers to cause denial of service through zip bombs. A malicious package can consume gigabytes of disk space from a few megabytes of compressed data. Vulnerability Details Affected Component: guarddog/utils/archives.py - safeextract() function Vulnerability Type: CWE-409 - Improper Handling of Highly Compressed Data (Zip Bomb) Severity: HIGH (CVSS ~8) Attack Vector: Network (malicious package uploaded to PyPI/npm) or local Root Cause The safeextract() function handles TAR files securely using the tarsafe library, but ZIP file extraction has no size validation: Missing protections: - ❌ No decompressed size limit - ❌ No compression ratio validation - ❌ No file count limits - ❌ No total extracted size validation Impact Denial of Service Scenarios 1. CI/CD Pipeline Disruption - Attacker publishes malicious package to PyPI - Developer adds package to…
Recommended action: Upgrade to 2.7.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Unsafe extracting using shutil.unpackarchive() from a remotely retrieved tarball may lead to writing the extracted file to an unintended destination. Details Extracting files using shutil.unpackarchive() from a potentially malicious tarball without validating that the destination file path is within the intended destination directory can cause files outside the destination directory to be overwritten. The vulnerable code snippet is between L153..158. It seems that a remotely retrieved tarball which could be with the extension .tar.gz happens to be unpacked using shutil.unpackarchive() with no destination verification/limitation of the extracted files. PoC The PoC provided showcases the risk of extracting the non-harmless text file sim4n6.txt to a parent location rather than the current folder. A Potential Attack Scenario - An attacker may craft a malicious tarball with a filename path, such as ../../../../../../../../etc/passwd, and then serve the archive remotely, thus,…
Recommended action: Upgrade to 0.1.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Running GuardDog against a specially-crafted package can allow an attacker to write an arbitrary file on the machine where GuardDog is executed. This is due to a path traversal vulnerability when extracting the .tar.gz file of the package being scanned, which exists by design in the tarfile.TarFile.extractall function. See also https://docs.python.org/3/library/tarfile.html#tarfile.TarFile.extractall Remediation Upgrade to GuardDog v0.1.5 or more recent. References https://semgrep.dev/r?q=trailofbits.python.tarfile-extractall-traversal.tarfile-extractall-traversal https://www.trellix.com/en-us/about/newsroom/stories/research/tarfile-exploiting-the-world.html https://docs.python.org/3/library/tarfile.html#tarfile.TarFile.extractall
Recommended action: Upgrade to 0.1.5 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.