Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
halostatue/minitar
main @ 3a29ea0
7
Fixes
1
CVEs
HIGH
Peak severity
Highlights
Auth Bypass: 2 prior fixes. Scrutinize any change in this area.
trunk/ruwiki/lib/ruwiki/auth/gforge.rb: most-fixed (2 issues). Treat as high-risk during review.
5 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Path Traversal: Directory traversal via relative paths ('..') inside TAR archive headers allows remote attackers to write arbitrary files outside the extraction directory. This was a highly critical vulnerability tracked under CVE-2016-10173.
Denial of Service: Negative size values parsed from tar headers directly reach resource-intensive reading functions, potentially inducing unexpected resource exhaustion or infinite loops.
SQL Injection: Direct interpolation of unquoted username strings into queries executed via the postgres client allows authentication bypass and database exfiltration.