CVE-2024-24579
CVSS 3.1 Score 9.8 of 10 (high)
Details
Summary
CVE-2024-24579 is a vulnerability affecting the stereoscope Go library, used for processing container images and simulating squash filesystems. Prior to version 0.0.1, this library fails to properly validate the unarchiving process of OCI tar archives. An attacker can exploit this flaw to write data outside of the intended unarchive temporary directory. Specific functions involved include `github.com/anchore/stereoscope/pkg/file.UntarToDirectory()`, `github.com/anchore/stereoscope/pkg/image/oci.TarballImageProvider`, and `github.com/anchore/stereoscope/pkg/image.Image.Read()`. To mitigate this risk, users are advised to switch from using an OCI tar archive as input to employing an OCI layout instead, by unarchiving the tar archive and providing the unarchived directory to stereoscope.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Advisories, Assessments, and Mitigations
Prioritize, Pinpoint, and Act to Prevent Vulnerability Exploits with Recorded Future
- Gain complete coverage of your cyber, third party, and physical attack surface
- Proactively mitigate threats before they turn into costly attacks
- Make fast, effective, data-driven decisions