x/vulndb: potential Go vuln in github.com/mholt/archiver: GHSA-5wmg-j84w-4jj4

[GoVulnBot]

In GitHub Security Advisory GHSA-5wmg-j84w-4jj4, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
github.com/mholt/archiver	2.1.0	< 2.1.0

Cross references:

• CVE-2018-1002207 appears in issue x/vulndb: potential Go vuln in github.com/mholt/archiver: GHSA-5wmg-j84w-4jj4 #799 NOT_IMPORTABLE
• GHSA-5wmg-j84w-4jj4 appears in issue x/vulndb: potential Go vuln in github.com/mholt/archiver: GHSA-5wmg-j84w-4jj4 #799 NOT_IMPORTABLE
• Module github.com/mholt/archiver appears in issue x/vulndb: potential Go vuln in github.com/mholt/archiver: GHSA-5wmg-j84w-4jj4 #799 NOT_IMPORTABLE
• Module github.com/mholt/archiver appears in issue x/vulndb: potential Go vuln in github.com/mholt/archiver/cmd/arc: GHSA-h74j-692g-48mq #842 NOT_IMPORTABLE

See doc/triage.md for instructions on how to triage this report.

modules:
  - module: github.com/mholt/archiver
    versions:
      - fixed: 2.1.0
    packages:
      - package: github.com/mholt/archiver
description: mholt/archiver golang package before e4ef56d48eb029648b0e895bb0b6a393ef0829c3
    is vulnerable to directory traversal, allowing attackers to write to arbitrary
    files via a ../ (dot dot slash) in an archive entry that is mishandled during
    extraction. This vulnerability is also known as 'Zip-Slip'.
cves:
  - CVE-2018-1002207
ghsas:
  - GHSA-5wmg-j84w-4jj4

[tatianab]

Duplicate of #799