diff options
| author | gaoyukun <[email protected]> | 2026-08-06 10:58:47 +0800 |
|---|---|---|
| committer | Victor Kareh <[email protected]> | 2026-08-08 11:56:43 +0000 |
| commit | c4b90ec015b82e2b85d9e5f5d2ea3486a7936c8b (patch) | |
| tree | 06d4eeae943f72b070f2dbb757a370b10f7b63be /src | |
| parent | f3a873211a13618e7efb4abcba7d3831d068e54c (diff) | |
| download | engrampa-c4b90ec015b82e2b85d9e5f5d2ea3486a7936c8b.tar.bz2 engrampa-c4b90ec015b82e2b85d9e5f5d2ea3486a7936c8b.tar.xz | |
fr-command-rpm: prevent path traversal when extracting RPM archives
CVE-2023-52138 fixes path traversal via crafted cpio archives by
adding --no-absolute-filenames to the cpio extraction command in
fr-command-cpio.c (commit 63d5dfa). However the same vulnerability
still exists in the RPM extraction path, which pipes rpm2cpio output
into 'cpio -idu' without that flag. A crafted RPM whose cpio payload
contains absolute paths can therefore write files outside the
extraction directory (e.g. ~/.ssh, ~/.bashrc).
Add the same --no-absolute-filenames flag to the rpm2cpio | cpio
pipeline to close the gap.
Diffstat (limited to 'src')
| -rw-r--r-- | src/fr-command-rpm.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/fr-command-rpm.c b/src/fr-command-rpm.c index 90e5954e..ab6ca397 100644 --- a/src/fr-command-rpm.c +++ b/src/fr-command-rpm.c @@ -208,7 +208,7 @@ fr_command_rpm_extract (FrCommand *comm, cmd = g_string_new ("rpm2cpio < "); g_string_append (cmd, comm->e_filename); - g_string_append (cmd, " | cpio -idu"); + g_string_append (cmd, " | cpio -idu --no-absolute-filenames"); for (scan = file_list; scan; scan = scan->next) { g_string_append (cmd, " "); char *filename = g_shell_quote (scan->data); |