CVE-2020-26277: 
Homebrew vulnerability analysis and mitigation

DBdeployer, a tool for deploying MySQL database servers, was found to contain a symbolic link vulnerability in versions before 1.58.2. The vulnerability was discovered and disclosed in December 2020, identified as CVE-2020-26277. The issue affects all versions up to 1.58.1 of the DBdeployer software (GitHub Advisory).

The vulnerability exists in the unpacking routine where the software does not properly validate symbolic links when extracting tarballs. When unpacking a tarball, the software fails to sufficiently account for when a file is a symbolic link that resolves to a target outside of the intended control sphere. This could allow an attacker to create maliciously packaged tarballs containing symlinks to files external to the target directory (NVD). The vulnerability has been assigned a CVSS v3.1 Base Score of 6.1 MEDIUM (Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:H/A:N) (GitHub Advisory).

If successfully exploited, an attacker could induce dbdeployer to write into system files, potentially altering the computer's defenses. The vulnerability could allow an attacker to read and/or write to arbitrary locations outside the designated target folder (GitHub Advisory).

For the vulnerability to be exploited, two key conditions must be met: 1) The user must be logged in as root (although dbdeployer was designed to run as an unprivileged user), and 2) The user must have obtained a tarball from an unsecure source without verifying its checksum. The risk is mitigated when the tarball is retrieved through dbdeployer, as it performs checksum verification before unpacking (GitHub Advisory).

The vulnerability was patched in version 1.58.2. The fix includes additional checks to prevent arbitrary symlinks from being extracted with tarballs. The patch implements validation that compares the depth of the file name with the depth of the link name, blocking operations where the link name has a higher depth than the local file. It also includes checks for links pointing to existing files by calculating and comparing absolute paths (GitHub Advisory).