CVE-2020-36241: 
NixOS vulnerability analysis and mitigation

GNOME gnome-autoar through version 0.2.4, as used by GNOME Shell, Nautilus, and other software, contains a Directory Traversal vulnerability during extraction. The vulnerability exists in the autoar-extractor.c file, which lacks a proper check to verify whether a file's parent is a symlink to a directory outside of the intended extraction location (NVD, CVE).

The vulnerability has been assigned a CVSS v3.1 Base Score of 5.5 (Medium) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. The vulnerability is classified under CWE-59 (Improper Link Resolution Before File Access) and CWE-22 (Improper Limitation of a Pathname to a Restricted Directory). The issue requires local access, low attack complexity, and low privileges, with no user interaction needed (NVD).

The vulnerability could allow an attacker to access files outside of the intended extraction directory, potentially leading to unauthorized access to sensitive information. The CVSS scoring indicates high impact on confidentiality but no impact on integrity or availability (NVD).

The vulnerability requires local access with low attack complexity and low privileges to exploit. No known active exploits have been reported in the wild, though proof-of-concept code is available through the issue tracking system (Gentoo Advisory).

The vulnerability has been fixed in subsequent versions of gnome-autoar. Users are advised to upgrade to version 0.3.1 or later. Multiple distributions have released security updates, including Fedora and Gentoo. A patch is available in the upstream repository (Gentoo Advisory).