dive tar-slip in image file extraction
Terminal tool dive has a tar-slip flaw when extracting files from Docker image layers.
Khashayar Fereidani reported a tar-slip flaw in dive when extracting files from a container image. dive is a terminal UI for exploring Docker image layers, and inspecting images from public registries is its main use case. The filetree view's extract action, default keybinding ctrl+e, is the affected path. The post does not include a CVE or claim observed exploitation.
- Tar-slip occurs during dive's image file extraction.
- dive is a terminal UI for exploring Docker image layers.
- Extract is bound to ctrl+e in the filetree view by default.
- No CVE or confirmed exploitation is stated.
Posted by Khashayar Fereidani on Sep 26 # dive tar-slip in image file extraction https://fereidani.com/dive-tar-slip-in-image-file-extraction https://fereidani.com/contact ## Description dive is a terminal UI for exploring Docker image layers, and inspecting images pulled from public registries is its main use case. The filetree view has an extract action (the default keybinding is `ctrl+e`,...
This source does not provide full text. Read it at seclists.org.