Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2024-24579
CVE-2024-24579:
Wolfi vulnerability analysis and mitigation
Overview
A path traversal vulnerability was discovered in stereoscope when processing OCI tar archives. The vulnerability, identified as CVE-2024-24579, affects versions prior to 0.0.1 of the github.com/anchore/stereoscope package. The issue was disclosed and patched on January 31, 2024, affecting the package's tar archive processing functionality (GitHub Advisory).
Technical details
The vulnerability exists in the tar archive processing functionality, specifically in the github.com/anchore/stereoscope/pkg/file.UntarToDirectory() function, the github.com/anchore/stereoscope/pkg/image/oci.TarballImageProvider struct, and the higher level github.com/anchore/stereoscope/pkg/image.Image.Read() function. The issue has been assigned a CVSS v3.1 score of 5.3 (Moderate) with a vector string of CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L. The vulnerability is classified as CWE-22 (GitHub Advisory).
Impact
When stereoscope attempts to unarchive contents from a crafted OCI tar archive, it can result in writing to paths outside of the unarchive temporary directory, potentially leading to unauthorized file system access. The vulnerability affects confidentiality, integrity, and availability at a low level (GitHub Advisory).
Mitigation and workarounds
The vulnerability has been patched in version 0.0.1 of stereoscope. As a workaround, users can switch to using an OCI layout by unarchiving the tar archive and providing the unarchived directory to stereoscope instead of using the OCI archive directly (GitHub Advisory).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management