x/vulndb: potential Go vuln in github.com/cli/cli/v2: GHSA-2m9h-r57g-45pj

[GoVulnBot]

Advisory GHSA-2m9h-r57g-45pj references a vulnerability in the following Go modules:

Module
github.com/cli/cli
github.com/cli/cli/v2

Description:

Summary

A security vulnerability has been identified in GitHub CLI that could create or overwrite files in unintended directories when users download a malicious GitHub Actions workflow artifact through gh run download.

Details

This vulnerability stems from a GitHub Actions workflow artifact named .. when downloaded using gh run download. The artifact name and --dir flag are used to determine the artifact’s download path. When the artifact is named .., the resulting files within the artifact are extracted exactly 1 directory higher than the specified --dir flag valu...

References:

• ADVISORY: GHSA-2m9h-r57g-45pj
• ADVISORY: GHSA-2m9h-r57g-45pj
• FIX: cli/cli@1136764

Cross references:

• github.com/cli/cli appears in 3 other report(s):
  • data/reports/GO-2022-0395.yaml (x/vulndb: potential Go vuln in github.com/cli/cli: GHSA-fqfh-778m-2v32 #395)
  • data/reports/GO-2024-3269.yaml (x/vulndb: potential Go vuln in github.com/cli/cli/v2: GHSA-p2h2-3vg9-4p87 #3269)
  • data/reports/GO-2024-3296.yaml (x/vulndb: potential Go vuln in github.com/cli/cli/v2: GHSA-jwcm-9g39-pmcw #3296)
• github.com/cli/cli/v2 appears in 2 other report(s):
  • data/reports/GO-2024-3269.yaml (x/vulndb: potential Go vuln in github.com/cli/cli/v2: GHSA-p2h2-3vg9-4p87 #3269)
  • data/reports/GO-2024-3296.yaml (x/vulndb: potential Go vuln in github.com/cli/cli/v2: GHSA-jwcm-9g39-pmcw #3296)

See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/cli/cli
      vulnerable_at: 1.14.0
    - module: github.com/cli/cli/v2
      versions:
        - fixed: 2.63.1
      vulnerable_at: 2.63.0
summary: |-
    Downloading malicious GitHub Actions workflow artifact results in path traversal
    vulnerability in github.com/cli/cli
cves:
    - CVE-2024-54132
ghsas:
    - GHSA-2m9h-r57g-45pj
references:
    - advisory: https://github.com/advisories/GHSA-2m9h-r57g-45pj
    - advisory: https://github.com/cli/cli/security/advisories/GHSA-2m9h-r57g-45pj
    - fix: https://github.com/cli/cli/commit/1136764c369aaf0cae4ec2ee09dc35d871076932
source:
    id: GHSA-2m9h-r57g-45pj
    created: 2024-12-04T16:01:38.762410731Z
review_status: UNREVIEWED

[gopherbot]

Change https://go.dev/cl/633598 mentions this issue: data/reports: add 6 unreviewed reports