CVE-2018-1002208 (Medium) detected in ICSharpCode.SharpZipLib-0.86.0.518.dll, ICSharpCode.SharpZipLib.dll #93
Labels
Mend: dependency security vulnerability
Security vulnerability detected by WhiteSource
CVE-2018-1002208 - Medium Severity Vulnerability
ICSharpCode.SharpZipLib-0.86.0.518.dll
SharpZipLib for .NET Framework 2.0
Library home page: https://api.nuget.org/packages/icsharpcode.sharpziplib.0.86.0.518.nupkg
Path to vulnerable library: /generators/solution/templates/References/DNN/09.08.00/ICSharpCode.SharpZipLib.dll
Dependency Hierarchy:
ICSharpCode.SharpZipLib.dll
ICSharpCode.SharpZipLibrary
Library home page: https://api.nuget.org/packages/netsword.common.icsharpcode.sharpziplib.0.84.0.nupkg
Path to vulnerable library: /generators/solution/templates/Build/ICSharpCode.SharpZipLib.dll
Dependency Hierarchy:
Found in HEAD commit: 1c68c9a9ea9734a0a208d80999c86ff1564255dc
Found in base branch: master
SharpZipLib before 1.0 RC1 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.
Publish Date: 2018-07-25
URL: CVE-2018-1002208
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1002208
Release Date: 2018-07-25
Fix Resolution: SharpZipLib - 1.0.0
Step up your Open Source Security Game with Mend here
The text was updated successfully, but these errors were encountered: