[Secure-testing-team] Bug#868572: ruby-mixlib-archive: CVE-2017-1000026

[Salvatore Bonaccorso]

Source: ruby-mixlib-archive
Version: 0.2.0-1
Severity: important
Tags: upstream patch security fixed-upstream
Forwarded: https://github.com/chef/mixlib-archive/pull/6

Hi,

the following vulnerability was published for ruby-mixlib-archive.

CVE-2017-1000026[0]:
| Chef Software's mixlib-archive versions 0.3.0 and older are vulnerable
| to a directory traversal attack allowing attackers to overwrite
| arbitrary files by using ".." in tar archive entries

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2017-1000026
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000026
[1] https://github.com/chef/mixlib-archive/pull/6

Regards,
Salvatore