data/reports: add GO-2024-2490.yaml

Aliases: CVE-2024-24579, GHSA-hpxr-w9w7-g4gv

Fixes #2490

Change-Id: I2849bf7c356f2b2dd41f0757066c99a36b5b1165
Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/563077
Run-TryBot: Tim King <taking@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
Reviewed-by: Damien Neil <dneil@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>

data/osv/GO-2024-2490.json

@@ -0,0 +1,67 @@
+{
+  "schema_version": "1.3.1",
+  "id": "GO-2024-2490",
+  "modified": "0001-01-01T00:00:00Z",
+  "published": "0001-01-01T00:00:00Z",
+  "aliases": [
+    "CVE-2024-24579",
+    "GHSA-hpxr-w9w7-g4gv"
+  ],
+  "summary": "Path traversal in github.com/anchore/stereoscope",
+  "details": "It is possible to craft an OCI tar archive that, when stereoscope attempts to unarchive the contents, will result in writing to paths outside of the unarchive temporary directory.",
+  "affected": [
+    {
+      "package": {
+        "name": "github.com/anchore/stereoscope",
+        "ecosystem": "Go"
+      },
+      "ranges": [
+        {
+          "type": "SEMVER",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "0.0.1"
+            }
+          ]
+        }
+      ],
+      "ecosystem_specific": {
+        "imports": [
+          {
+            "path": "github.com/anchore/stereoscope/pkg/file",
+            "symbols": [
+              "UntarToDirectory"
+            ]
+          }
+        ]
+      }
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://github.com/anchore/stereoscope/security/advisories/GHSA-hpxr-w9w7-g4gv"
+    },
+    {
+      "type": "FIX",
+      "url": "https://github.com/anchore/stereoscope/commit/09dacab4d9ee65ee8bc7af8ebf4aa7b5aaa36204"
+    }
+  ],
+  "credits": [
+    {
+      "name": "@wagoodman"
+    },
+    {
+      "name": "@joshbressers"
+    },
+    {
+      "name": "@nurmi"
+    }
+  ],
+  "database_specific": {
+    "url": "https://pkg.go.dev/vuln/GO-2024-2490"
+  }
+}

data/reports/GO-2024-2490.yaml

@@ -0,0 +1,28 @@
+id: GO-2024-2490
+modules:
+    - module: github.com/anchore/stereoscope
+      versions:
+        - fixed: 0.0.1
+      vulnerable_at: 0.0.0-20240118133533-eb656fc71793
+      packages:
+        - package: github.com/anchore/stereoscope/pkg/file
+          symbols:
+            - UntarToDirectory
+      fix_links:
+        - https://github.com/anchore/stereoscope/commit/09dacab4d9ee65ee8bc7af8ebf4aa7b5aaa36204
+summary: Path traversal in github.com/anchore/stereoscope
+description: |-
+    It is possible to craft an OCI tar archive that, when stereoscope
+    attempts to unarchive the contents, will result in writing to paths outside of
+    the unarchive temporary directory.
+cves:
+    - CVE-2024-24579
+ghsas:
+    - GHSA-hpxr-w9w7-g4gv
+credits:
+    - '@wagoodman'
+    - '@joshbressers'
+    - '@nurmi'
+references:
+    - advisory: https://github.com/anchore/stereoscope/security/advisories/GHSA-hpxr-w9w7-g4gv
+    - fix: https://github.com/anchore/stereoscope/commit/09dacab4d9ee65ee8bc7af8ebf4aa7b5aaa36204