Missing vulnerability: path traversal on R

[MichaelChirico]

https://bugs.r-project.org/show_bug.cgi?id=17853 / https://www.cvedetails.com/vulnerability-list/vendor_id-17929/product_id-90722/R-project-Cran.html would be another good example to include.

[glin]

Since this is a vulnerability with R, and not an R package specifically, I think this would be out of scope for the database. I'm not sure if there's an OSV equivalent for programming languages, but that would be useful. Besides that one, there was the RDS CVE from a while back, https://nvd.nist.gov/vuln/detail/cve-2024-27322

[MichaelChirico]

It would not be a horrible kludge to associate this vulnerability with package {utils}, which comes with all R installations and which is attached by default to all R sessions (it can be excluded from R to get "lightweight" sessions). The vulnerability was fixed by fixing utils::untar(). {utils} is not found on CRAN, so it still might be out-of-scope for this database.

The RDS one is a bit hazier; it would be a slightly more horrible kludge to associate the vulnerability with package {base}, which strictly speaking is an R package, but which has extremely fuzzy boundaries and R can't run without it.

[glin]

Right, yeah.. the built-in packages are all versioned with the R version so technically that could work. But definitely a gray area indeed, since it's not a typical package you would be able to install and update from CRAN. There is no CRAN web page or source repository for these packages either. I'd still err on the side of out-of-scope, but maybe others have different thoughts.