From d1a6d1f94e7717642c6b4ca8bc3c75d2fd8a3c88 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Tue, 21 Jan 2025 20:28:34 +0000
Subject: [PATCH] Publish Advisories

GHSA-wpfp-cm49-9m9q
GHSA-wpfp-cm49-9m9q
---
 .../GHSA-wpfp-cm49-9m9q.json                  | 61 +++++++++++++++++++
 .../GHSA-wpfp-cm49-9m9q.json                  | 36 -----------
 2 files changed, 61 insertions(+), 36 deletions(-)
 create mode 100644 advisories/github-reviewed/2025/01/GHSA-wpfp-cm49-9m9q/GHSA-wpfp-cm49-9m9q.json
 delete mode 100644 advisories/unreviewed/2025/01/GHSA-wpfp-cm49-9m9q/GHSA-wpfp-cm49-9m9q.json

diff --git a/advisories/github-reviewed/2025/01/GHSA-wpfp-cm49-9m9q/GHSA-wpfp-cm49-9m9q.json b/advisories/github-reviewed/2025/01/GHSA-wpfp-cm49-9m9q/GHSA-wpfp-cm49-9m9q.json
new file mode 100644
index 00000000000..80f866ce7f2
--- /dev/null
+++ b/advisories/github-reviewed/2025/01/GHSA-wpfp-cm49-9m9q/GHSA-wpfp-cm49-9m9q.json
@@ -0,0 +1,61 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-wpfp-cm49-9m9q",
+  "modified": "2025-01-21T20:27:08Z",
+  "published": "2025-01-21T18:31:07Z",
+  "aliases": [
+    "CVE-2025-0377"
+  ],
+  "summary": "HashiCorp go-slug Vulnerable to Zip Slip Attack",
+  "details": "## Summary\nHashiCorp’s go-slug library is vulnerable to a zip-slip style attack when a non-existing user-provided path is extracted from the tar entry. This vulnerability, identified as CVE-2025-0377, is fixed in go-slug 0.16.3.\n\n## Background\nHashiCorp’s go-slug shared library offers functions for packing and unpacking Terraform Enterprise compatible slugs. Slugs are gzip compressed tar files containing Terraform configuration files.\n\n## Details\nWhen go-slug performs an extraction, the filename/extraction path is taken from the tar entry via the header.Name. It was discovered that the unpacking step improperly validated paths, potentially leading to path traversal, allowing an attacker to write an arbitrary file during extraction.\n\n## Remediation\nConsumers of the go-slug shared library should evaluate the risk associated with this issue in the context of their go-slug usage and upgrade go-slug to 0.16.3 or later.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Go",
+        "name": "github.com/hashicorp/go-slug"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "0.16.3"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0377"
+    },
+    {
+      "type": "WEB",
+      "url": "https://discuss.hashicorp.com/t/hcsec-2025-01-hashicorp-go-slug-vulnerable-to-zip-slip-attack"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "github.com/hashicorp/go-slug"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-59"
+    ],
+    "severity": "HIGH",
+    "github_reviewed": true,
+    "github_reviewed_at": "2025-01-21T20:27:08Z",
+    "nvd_published_at": "2025-01-21T16:15:14Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2025/01/GHSA-wpfp-cm49-9m9q/GHSA-wpfp-cm49-9m9q.json b/advisories/unreviewed/2025/01/GHSA-wpfp-cm49-9m9q/GHSA-wpfp-cm49-9m9q.json
deleted file mode 100644
index 1c7eaf5033c..00000000000
--- a/advisories/unreviewed/2025/01/GHSA-wpfp-cm49-9m9q/GHSA-wpfp-cm49-9m9q.json
+++ /dev/null
@@ -1,36 +0,0 @@
-{
-  "schema_version": "1.4.0",
-  "id": "GHSA-wpfp-cm49-9m9q",
-  "modified": "2025-01-21T18:31:07Z",
-  "published": "2025-01-21T18:31:07Z",
-  "aliases": [
-    "CVE-2025-0377"
-  ],
-  "details": "HashiCorp’s go-slug library is vulnerable to a zip-slip style attack when a non-existing user-provided path is extracted from the tar entry.",
-  "severity": [
-    {
-      "type": "CVSS_V3",
-      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
-    }
-  ],
-  "affected": [],
-  "references": [
-    {
-      "type": "ADVISORY",
-      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0377"
-    },
-    {
-      "type": "WEB",
-      "url": "https://discuss.hashicorp.com/t/hcsec-2025-01-hashicorp-go-slug-vulnerable-to-zip-slip-attack"
-    }
-  ],
-  "database_specific": {
-    "cwe_ids": [
-      "CWE-59"
-    ],
-    "severity": "HIGH",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
-    "nvd_published_at": "2025-01-21T16:15:14Z"
-  }
-}
\ No newline at end of file