Fix protoc install vulnerability - Githubissues

eclipse / kuksa.val

kuksa.val

Apache License 2.0

95 stars 51 forks source link

Fix protoc install vulnerability #630

Closed erikbosch closed 1 year ago

erikbosch commented 1 year ago

See https://cwe.mitre.org/data/definitions/22.html

Theoretical risk in short:

We download a malicious zip archive
The zip archive contains items like "../../usr/bin/something"
We might end up with installing unwanted files at wrong places

Tested that it does not affect normal install This was detected when running Github code scanning in my own fork