CVE-2021-29136 - Open Container Initiative umoci before 0.4.7 allows attackers to overwrite arbitrary host paths via a crafted image that causes symlink traversal when "umoci unpack" or "umoci raw unpack" is used

Back Back to CVE browser

MEDIUM

Open Container Initiative umoci before 0.4.7 allows attackers to overwrite arbitrary host paths via a crafted image that causes symlink traversal when "umoci unpack" or "umoci raw unpack" is used

Published Apr 6, 2021

5.5

MEDIUM

CVSS 3.1

EPSS 0.34%

Description

Open Container Initiative umoci before 0.4.7 allows attackers to overwrite arbitrary host paths via a crafted image that causes symlink traversal when "umoci unpack" or "umoci raw unpack" is used.

Affected products

Ecosystem	Package	Introduced	Fixed
Go	github.com/opencontainers/umoci	0	0.4.7

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-20

Improper Input Validation

References (6)

http://www.openwall.com/lists/oss-security/2021/04/06/2
x_refsource_MISCMailing ListPatchThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-0942
Advisory
https://github.com/advisories/GHSA-9m95-8hx6-7p9v
Advisory
https://github.com/opencontainers/umoci/commit/d9efc31daf2206f7d3fdb839863cf7a576a2eb57
x_refsource_CONFIRMPatchThird Party Advisory
https://github.com/opencontainers/umoci/security/advisories/GHSA-9m95-8hx6-7p9v
x_refsource_CONFIRMThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2021-29136

Link	Providers	Tags
http://www.openwall.com/lists/oss-security/2021/04/06/2		x_refsource_MISCMailing ListPatchThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-0942		Advisory
https://github.com/advisories/GHSA-9m95-8hx6-7p9v		Advisory
https://github.com/opencontainers/umoci/commit/d9efc31daf2206f7d3fdb839863cf7a576a2eb57		x_refsource_CONFIRMPatchThird Party Advisory
https://github.com/opencontainers/umoci/security/advisories/GHSA-9m95-8hx6-7p9v		x_refsource_CONFIRMThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2021-29136