The GitHub CLI is GitHub’s official command line tool. A security vulnerability has been identified in GitHub CLI that could create or overwrite files in unintended directories when users download a malicious GitHub Actions workflow artifact through gh run download. This vulnerability stems from a GitHub Actions workflow artifact named .. when downloaded using gh run download. The artifact name and --dir flag are used to determine the artifact’s download path. When the artifact is named .., the resulting files within the artifact are extracted exactly 1 directory higher than the specified --dir flag value. This vulnerability is fixed in 2.63.1.

The remote Ubuntu 24.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8012-1 advisory.

    It was discovered that GitHub CLI could behave unexpectedly if users downloaded a malicious GitHub Actions     workflow artifact through gh run download. An attacker could possibly use this issue to create or     overwrite files in unintended directories. (CVE-2024-54132)

    It was discovered that GitHub CLI could behave unexpectedly when cloning repositories containing git     submodules hosted outside of GitHub.com and ghe.com. An attacker could possibly use this issue to gather     authentication tokens. (CVE-2024-53858)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The GitHub CLI is GitHub's official command line tool. A security vulnerability has been identified in     GitHub CLI that could create or overwrite files in unintended directories when users download a malicious     GitHub Actions workflow artifact through gh run download. This vulnerability stems from a GitHub Actions     workflow artifact named .. when downloaded using gh run download. The artifact name and --dir flag are     used to determine the artifact's download path. When the artifact is named .., the resulting files within     the artifact are extracted exactly 1 directory higher than the specified --dir flag value. This     vulnerability is fixed in 2.63.1. (CVE-2024-54132)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of gh installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-54132 advisory.

  - The GitHub CLI is GitHub's official command line tool. A security vulnerability has been identified in     GitHub CLI that could create or overwrite files in unintended directories when users download a malicious     GitHub Actions workflow artifact through gh run download. This vulnerability stems from a GitHub Actions     workflow artifact named .. when downloaded using gh run download. The artifact name and --dir flag are     used to determine the artifact's download path. When the artifact is named .., the resulting files within     the artifact are extracted exactly 1 directory higher than the specified --dir flag value. This     vulnerability is fixed in 2.63.1. (CVE-2024-54132)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The GitHub CLI is GitHub’s official command line tool. A security vulnerability has been identified in
    GitHub CLI that could create or overwrite files in unintended directories when users download a malicious
    GitHub Actions workflow artifact through gh run download. This vulnerability stems from a GitHub Actions
    workflow artifact named .. when downloaded using gh run download. The artifact name and --dir flag are
    used to determine the artifact’s download path. When the artifact is named .., the resulting files within
    the artifact are extracted exactly 1 directory higher than the specified --dir flag value. This
    vulnerability is fixed in 2.63.1. (CVE-2024-54132)

The version of gh installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-54132 advisory.

  - The GitHub CLI is GitHub's official command line tool. A security vulnerability has been identified in     GitHub CLI that could create or overwrite files in unintended directories when users download a malicious     GitHub Actions workflow artifact through gh run download. This vulnerability stems from a GitHub Actions     workflow artifact named .. when downloaded using gh run download. The artifact name and --dir flag are     used to determine the artifact's download path. When the artifact is named .., the resulting files within     the artifact are extracted exactly 1 directory higher than the specified --dir flag value. This     vulnerability is fixed in 2.63.1. (CVE-2024-54132)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
298152	Ubuntu 24.04 LTS : GitHub CLI vulnerabilities (USN-8012-1)	Nessus	Ubuntu Local Security Checks	Local	medium
230572	Linux Distros Unpatched Vulnerability : CVE-2024-54132	Nessus	Misc.	Local	medium
216093	Azure Linux 3.0 Security Update: gh (CVE-2024-54132)	Nessus	Azure Linux Local Security Checks	Local	medium
408986	SCA: security update for github.com/cli/cli/v2 (GHSA-2m9h-r57g-45pj)	Tenable Cloud Security	SCA Checks	Local	medium
408986	SCA: security update for github.com/cli/cli/v2 (GHSA-2m9h-r57g-45pj)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
213307	CBL Mariner 2.0 Security Update: gh (CVE-2024-54132)	Nessus	MarinerOS Local Security Checks	Local	medium

Detections

Analytics

CVE-2024-54132

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium