VulnerabilityAnalyzed
CVE-2024-0406
This flaw allows an attacker to create a specially crafted tar file, which, when unpacked, may allow access to restricted files or directories.
HIGH 7.8EPSS 0.93%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.93%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
A flaw was discovered in the mholt/archiver package. This flaw allows an attacker to create a specially crafted tar file, which, when unpacked, may allow access to restricted files or directories. This issue can allow the creation or overwriting of files with the user's or application's privileges using the library.
- CVSS 3.1
- 7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- EPSS
- 0.93% probability · 59th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-22
- Affected
- mholt/archiver · redhat/advanced cluster security · redhat/openshift container platform
- Source
- secalert@redhat.com
References
- https://access.redhat.com/errata/RHSA-2025:2449Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2024-0406Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2257749Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2024-0406Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2257749Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.