Future of mholt/archiver fork?

Syft
1

Hi,

Our Sonatype Nexus is reporting a problem with anchore/archiver/v3 library claiming it is vulnerable to CVE-2024-0406.

Looking at the pinned forks issue on GitHub, the message suggests there is a fix for this CVE in anchore’s fork of the mholt library so in this case Nexus might be wrong. Can you confirm that this CVE is fixed in the anchore fork?

However, the mholt/achiver library that was originally forked is now deprecated (and archived) in favour of a new library mholt/archives. Are there any plans to upgrade away from mholt/archiver?

Thanks
Dan

2

Hey @danrollason :waving_hand:, yes we have CVE-2024-0406 fixed in the fork (via this PR). I don’t think there’s a reason to stay on the fork, but if memory serves there was a blocking issue when we tried to update to archiver v4. However, it looks like a user in the community has contributed an unreviewed update to archives, so I suspect whatever the issue we ran into with the other library has been mitigated and we will probably start using the newer one before long.

2 Likes