Closed Bug 1792064 Opened 3 years ago Closed 3 years ago

Ensure `mozfile.extract_tarball` can't write outside of intended destination

Categories

(Testing :: Mozbase, defect)

Product:
Testing
Component:
Mozbase
Version:
Default
Type:
defect

Tracking

(firefox107 fixed)

Status:
RESOLVED FIXED
Milestone:
107 Branch
Tracking Flags:
Tracking Status
firefox107 --- fixed

People

(Reporter: ahal, Assigned: ahal)

References

Details

Attachments

(1 file)

Bug 1792064 - Ensure 'mozfile.extract_tarball' can't write outside of destination, r?#mozbase-reviewers
48 bytes, text/x-phabricator-request
Details | Review

This will mitigate CVE-2007-4559 which was originally disclosed in 2007, but "rediscovered" in a recent post here:
https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/tarfile-exploiting-the-world.html

Attachment #9295829 - Attachment description: WIP: Bug 1792064 - Ensure 'mozfile.extract_tarball' can't write outside of destination → Bug 1792064 - Ensure 'mozfile.extract_tarball' can't write outside of destination, r?#mozbase-reviewers
Pushed by ahalberstadt@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/37c750edbda7 Ensure 'mozfile.extract_tarball' can't write outside of destination, r=mozbase-reviewers,jmaher

https://hg.mozilla.org/mozilla-central/rev/37c750edbda7

Status: ASSIGNED → RESOLVED
Closed: 3 years ago
status-firefox107: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → 107 Branch
See Also: → 1806899
You need to log in before you can comment on or make changes to this bug.

Attachment

General

Creator:
Created:
Updated:
Size: