dive tar-slip in image file extraction
Terminal tool dive has a tar-slip flaw when extracting files from Docker image layers.
Khashayar Fereidani reported a tar-slip flaw in dive when extracting files from a container image. dive is a terminal UI for exploring Docker image layers, and inspecting images from public registries is its main use case. The filetree view's extract action, default keybinding ctrl+e, is the affected path. The post does not include a CVE or claim observed exploitation.
- Tar-slip occurs during dive's image file extraction.
- dive is a terminal UI for exploring Docker image layers.
- Extract is bound to ctrl+e in the filetree view by default.
- No CVE or confirmed exploitation is stated.
From the original article
Posted by Khashayar Fereidani on Sep 26 # dive tar-slip in image file extraction https://fereidani. com/dive-tar-slip-in-image-file-extraction https://fereidani. com/contact ## Description dive is a terminal UI for exploring Docker image layers, and inspecting images pulled from public registries is its main use case.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.