CVE-2021-29136
Summary
| CVE | CVE-2021-29136 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2021-04-06 16:15:00 UTC |
|---|
| Updated | 2021-05-20 14:32:00 UTC |
|---|
| Description | Open Container Initiative umoci before 0.4.7 allows attackers to overwrite arbitrary host paths via a crafted image that causes symlink traversal when "umoci unpack" or "umoci raw unpack" is used. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| malicious layer with symlink entry for "/" allows overwriting of host files · Advisory · opencontainers/umoci · GitHub |
CONFIRM |
github.com |
|
| oss-security - CVE-2021-29136: umoci: malicious layer with symlink entry for "/"
allows overwriting of host files |
MISC |
www.openwall.com |
|
| layer: don't permit / type to be changed on extraction · opencontainers/umoci@d9efc31 · GitHub |
CONFIRM |
github.com |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 174885 SUSE Enterprise Linux Security Update for umoci (SUSE-SU-2021:1116-1)
- 180111 Debian Security Update for umoci (CVE-2021-29136)
- 501700 Alpine Linux Security Update for umoci
- 506244 Alpine Linux Security Update for singularity
- 750110 SUSE Enterprise Linux Security Update for umoci (SUSE-SU-2021:1863-1)
- 750170 OpenSUSE Security Update for umoci (openSUSE-SU-2021:0846-1)
- 750270 OpenSUSE Security Update for umoci (openSUSE-SU-2021:0548-1)
- 750900 OpenSUSE Security Update for umoci (openSUSE-SU-2021:1863-1)
