CVE-2022-41920

EUVD-2022-7401
Lancet is a general utility library for the go programming language. Affected versions are subject to a ZipSlip issue when using the fileutil package to unzip files. This issue has been addressed and a fix will be included in versions 2.1.10 and 1.3.4. Users are advised to upgrade. There are no known workarounds for this issue.
Path Traversal
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
GitHub_MCNA
6.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Base Score
CVSS 3.x
EPSS Score
Percentile: 74%
Affected Products (NVD)
VendorProductVersion
lancet_projectlancet
𝑥
< 1.3.4
lancet_projectlancet
2.0.0 ≤
𝑥
< 2.1.10
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/duke-git/lancet/commit/f133b32faa05eb93e66175d01827afa4b7094572
https://github.com/duke-git/lancet/commit/f869a0a67098e92d24ddd913e188b32404fa72c9
https://github.com/duke-git/lancet/issues/62
https://github.com/duke-git/lancet/security/advisories/GHSA-pp3f-xrw5-q5j4
https://github.com/duke-git/lancet/commit/f133b32faa05eb93e66175d01827afa4b7094572
https://github.com/duke-git/lancet/commit/f869a0a67098e92d24ddd913e188b32404fa72c9
https://github.com/duke-git/lancet/issues/62
https://github.com/duke-git/lancet/security/advisories/GHSA-pp3f-xrw5-q5j4