search

grpc / grpc-dart

The Dart language implementation of gRPC.
https://pub.dev/packages/grpc
Apache License 2.0
861 stars 271 forks source link

security vulnerability in `archive` <= 3.3.7 #677

Closed mockturtl closed 1 year ago

mockturtl commented 1 year ago

GitHub's Dependabot notified me of security vulnerabilities in archive, which is used by GzipCodec.

An issue in Archive v3.3.7 allows attackers to execute a path traversal via extracting a crafted zip file.

An issue in Archive v3.3.7 allows attackers to spoof zip filenames which can lead to inconsistent filename parsing.

Details, CVE: https://pub.dev/packages/archive/changelog#338---september-02-2023

You may wish to consider bumping the version constraint to archive: ^3.3.8.

mraleph commented 1 year ago

These vulnerabilities don't affect grpc because there are no files extracted to disk or archives being traversed.