Fluid Attacks Database

Description

In OCaml opam before 2.5.1, a .install field containing a destination filepath can use ../ to reach a parent directory.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 11	opam	=2.0.8-1 \|\| >=0 <2.0.8-1+deb11u1	2.0.8-1+deb11u1
debian 12	opam	=2.1.2-1 \|\| >=0 <2.1.2-1+deb12u1	2.1.2-1+deb12u1
debian 13	opam	=2.3.0-1 \|\| >=0 <2.3.0-1+deb13u1	2.3.0-1+deb13u1
debian 14	opam	=2.3.0-1 \|\| =2.4.1-1 \|\| =2.5.0-1 \|\| >=0 <2.5.1-1	2.5.1-1
rpm rhel10	ocaml-dune	-	-

Aliases

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.