SharpCompress is a fully managed C# library to deal with many compression types and formats. Versions prior to 0.29.0 are vulnerable to partial path traversal. SharpCompress recreates a hierarchy of directories under destinationDirectory if ExtractFullPath is set to true in options. In order to prevent extraction outside the destination directory the destinationFileName path is verified to begin with fullDestinationDirectoryPath. However, prior to version 0.29.0, it is not enforced that fullDestinationDirectoryPath ends with slash. If the destinationDirectory is not slash terminated like `/home/user/dir` it is possible to create a file with a name thats begins as the destination directory one level up from the directory, i.e. `/home/user/dir.sh`. Because of the file name and destination directory constraints the arbitrary file creation impact is limited and depends on the use case. This issue is fixed in SharpCompress version 0.29.0.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - SharpCompress is a fully managed C# library to deal with many compression types and formats. Versions
    prior to 0.29.0 are vulnerable to partial path traversal. SharpCompress recreates a hierarchy of
    directories under destinationDirectory if ExtractFullPath is set to true in options. In order to prevent
    extraction outside the destination directory the destinationFileName path is verified to begin with
    fullDestinationDirectoryPath. However, prior to version 0.29.0, it is not enforced that
    fullDestinationDirectoryPath ends with slash. If the destinationDirectory is not slash terminated like
    `/home/user/dir` it is possible to create a file with a name thats begins as the destination directory one
    level up from the directory, i.e. `/home/user/dir.sh`. Because of the file name and destination directory
    constraints the arbitrary file creation impact is limited and depends on the use case. This issue is fixed
    in SharpCompress version 0.29.0. (CVE-2021-39208)

ID	Name	Product	Family	Type	Severity
474019	Echo: SharpCompress: security update to 0.23.0+echo.1	Tenable Cloud Security	Echo Local Security Checks	Local	medium
474019	Echo: SharpCompress: security update to 0.23.0+echo.1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
416486	SCA: security update for sharpcompress (GHSA-jp7f-grcv-6mjf)	Tenable Cloud Security	SCA Checks	Local	medium
416486	SCA: security update for sharpcompress (GHSA-jp7f-grcv-6mjf)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2021-39208

medium

Tenable Plugins

medium

medium

medium

medium