Openscap: openscap: arbitrary file write via path traversal in source datastream decomposition

Overview

A flaw was found in OpenSCAP. When decomposing a Source DataStream (SDS) file, the application does not properly validate relative file path attributes, leading to a path traversal vulnerability. An attacker can exploit this flaw by tricking a user or automated system into decomposing a crafted datastream containing directory traversal sequences. Successful exploitation allows unauthorized file creation or modification outside the intended target directory with the permissions of the executing process.

Affected

• openscap-main (all versions)
• openscap (all versions)
• openscap
• openscap (all versions)
• openscap (all versions)
• openscap (all versions)

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

Workarounds

Avoid extracting or decomposing untrusted SCAP Source DataStream (SDS) files. When processing externally supplied datastreams is necessary, perform the operation inside an isolated directory using a dedicated unprivileged user account or container sandbox with strictly bounded write privileges.

Caveat: Operating under an unprivileged user confines rogue file creation to that user's access scope, but does not prevent file corruption within directories accessible to that account.