CVE-2021-29136

Опубликовано: 06 апр. 2021

Источник: nvd

CVSS3: 5.5

CVSS2: 2.1

EPSS Низкий

Описание

Open Container Initiative umoci before 0.4.7 allows attackers to overwrite arbitrary host paths via a crafted image that causes symlink traversal when "umoci unpack" or "umoci raw unpack" is used.

Ссылки

http://www.openwall.com/lists/oss-security/2021/04/06/2
Mailing List
Patch
Third Party Advisory
https://github.com/opencontainers/umoci/commit/d9efc31daf2206f7d3fdb839863cf7a576a2eb57
Patch
Third Party Advisory
https://github.com/opencontainers/umoci/security/advisories/GHSA-9m95-8hx6-7p9v
Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/04/06/2
Mailing List
Patch
Third Party Advisory
https://github.com/opencontainers/umoci/commit/d9efc31daf2206f7d3fdb839863cf7a576a2eb57
Patch
Third Party Advisory
https://github.com/opencontainers/umoci/security/advisories/GHSA-9m95-8hx6-7p9v
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:linuxfoundation:umoci:*:*:*:*:*:*:*:*

Версия до 0.4.7 (исключая)

cpe:2.3:a:sylabs:singularity:*:*:*:*:*:*:*:*

Версия до 3.7.3 (исключая)

EPSS

Процентиль: 36%

0.00146

Низкий

5.5 Medium

CVSS3

2.1 Low

CVSS2

Дефекты

CWE-20

Связанные уязвимости

CVE-2021-29136

CVSS3: 5.5

ubuntu

почти 5 лет назад

Open Container Initiative umoci before 0.4.7 allows attackers to overwrite arbitrary host paths via a crafted image that causes symlink traversal when "umoci unpack" or "umoci raw unpack" is used.

CVE-2021-29136

CVSS3: 5.5

debian

почти 5 лет назад

Open Container Initiative umoci before 0.4.7 allows attackers to overw ...

openSUSE-SU-2021:1863-1

suse-cvrf

больше 4 лет назад

Security update for umoci

openSUSE-SU-2021:0846-1

suse-cvrf

больше 4 лет назад

Security update for umoci

openSUSE-SU-2021:0548-1

suse-cvrf

почти 5 лет назад

Security update for umoci

EPSS

Процентиль: 36%

0.00146

Низкий

5.5 Medium

CVSS3

2.1 Low

CVSS2

Дефекты

CWE-20