OpenSCAP'te kaynak DataStream ayrıştırmasında dosya yolu geçişi ile keyfi dosya yazma açığı

A flaw was found in OpenSCAP. When decomposing a Source DataStream (SDS) file, the application does not properly validate relative file path attributes, leading to a path traversal vulnerability. An attacker can exploit this flaw by tricking a user or automated system into decomposing a crafted datastream containing directory traversal sequences. Successful exploitation allows unauthorized file creation or modification outside the intended target directory with the permissions of the executing process.

Üreticinin geçici önlemi (İngilizce)

Avoid extracting or decomposing untrusted SCAP Source DataStream (SDS) files. When processing externally supplied datastreams is necessary, perform the operation inside an isolated directory using a dedicated unprivileged user account or container sandbox with strictly bounded write privileges.

Caveat: Operating under an unprivileged user confines rogue file creation to that user's access scope, but does not prevent file corruption within directories accessible to that account.