CVE-2021-41072
Summary
| CVE | CVE-2021-41072 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2021-09-14 01:15:00 UTC |
| Updated | 2023-05-30 06:15:00 UTC |
| Description | squashfs_opendir in unsquash-2.c in Squashfs-Tools 4.5 allows Directory Traversal, a different vulnerability than CVE-2021-40153. A squashfs filesystem that has been crafted to include a symbolic link and then contents under the same filename in a filesystem can cause unsquashfs to first create the symbolic link pointing outside the expected directory, and then the subsequent write operation will cause the unsquashfs process to write through the symbolic link elsewhere in the filesystem. |
Risk And Classification
Problem Types: CWE-22 | CWE-59
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Operating System | Debian | Debian Linux | 10.0 | All | All | All |
| Operating System | Debian | Debian Linux | 11.0 | All | All | All |
| Operating System | Debian | Debian Linux | 9.0 | All | All | All |
| Application | Squashfs-tools Project | Squashfs-tools | 4.5 | All | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| squashfs-tools: Multiple Vulnerabilities (GLSA 202305-29) — Gentoo security | GENTOO | security.gentoo.org | |
| unsquashfs - unvalidated filepaths allow writing outside of destination · Issue #72 · plougher/squashfs-tools · GitHub | MISC | github.com | |
| [SECURITY] [DLA 2789-1] squashfs-tools security update | MLIST | lists.debian.org | |
| Unsquashfs: additional write outside destination directory exploit fix · plougher/squashfs-tools@e048580 · GitHub | MISC | github.com | |
| Debian -- Security Information -- DSA-4987-1 squashfs-tools | DEBIAN | www.debian.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 178823 Debian Security Update for squashfs-tools (DSA 4987-1)
- 178845 Debian Security Update for squashfs-tools (DLA 2789-1)
- 184431 Debian Security Update for squashfs-tools (CVE-2021-41072)
- 198500 Ubuntu Security Notification for Squashfs-Tools Vulnerability (USN-5078-1)
- 198537 Ubuntu Security Notification for Squashfs-Tools Vulnerability (USN-5078-3)
- 355609 Amazon Linux Security Advisory for squashfs-tools : ALAS2-2023-2152
- 501784 Alpine Linux Security Update for squashfs-tools
- 504425 Alpine Linux Security Update for squashfs-tools
- 671158 EulerOS Security Update for squashfs-tools (EulerOS-SA-2021-2814)
- 671188 EulerOS Security Update for squashfs-tools (EulerOS-SA-2021-2936)
- 671216 EulerOS Security Update for squashfs-tools (EulerOS-SA-2022-1019)
- 671226 EulerOS Security Update for squashfs-tools (EulerOS-SA-2022-1039)
- 671232 EulerOS Security Update for squashfs-tools (EulerOS-SA-2022-1189)
- 671285 EulerOS Security Update for squashfs-tools (EulerOS-SA-2022-1216)
- 671297 EulerOS Security Update for squashfs-tools (EulerOS-SA-2022-1235)
- 710736 Gentoo Linux squashfs-tools Multiple Vulnerabilities (GLSA 202305-29)
- 755254 SUSE Enterprise Linux Security Update for squashfs (SUSE-SU-2023:4424-1)
- 755351 SUSE Enterprise Linux Security Update for squashfs (SUSE-SU-2023:4591-1)
- 901101 Common Base Linux Mariner (CBL-Mariner) Security Update for squashfs-tools (7464-1)