Zipslip vulnerability

[ankitdn]

While working with syzkaller Project, I found a Zipslip vulnerability in the artifact extraction process. The issue allows attackers to craft malicious tar.gz files containing path traversal sequences that result in unauthorized file creation or modification in system directories such as /etc.

CVE Link
CVE Report

[dvyukov]

in the artifact extraction process.

Where is that exactly?

[ankitdn]

This vulnerability affects zipslip package. It allows unauthorized file writing during artifact extraction. Please update the package to the patched version v3.6.12 or later to fix the issue.

[a-nogikh]

It looks like an Argo workflows vulnerability (it's used in syz-cluster). We don't mess with .tar.gz files ourselves and only let argo handle artifacts transfer itself, so I think we're not affected. Could still switch to a newer version, though (we use v3.6.2 while the CVE says it's fixed in v3.6.12+/v3.7.3+).

[dvyukov]

We have depndabot, it should take care of this automatically.

[tarasmadan]

#6414 to batch update everything

[a-nogikh]

We have depndabot, it should take care of this automatically.

It won't - it's not a Go package, but rather a set of k8s descriptions. The version must be bumped here:

syzkaller/syz-cluster/overlays/common/argo/kustomization.yaml

Lines 4 to 6 in b6605ba

	resources:
	- https://github.com/argoproj/argo-workflows/releases/download/v3.6.2/install.yaml
	- workflow-roles.yaml

[tarasmadan]

Is dependabot able to take care of this yaml file too?
Something like dependabot/dependabot-core#12506 .

[tarasmadan]

Closed by #6414 .
Please reopen if you disagree.