CVE-2021-29136: Improper Input Validation

February 15, 2022

The Open Container Initiative’s umoci allows attackers to overwrite arbitrary host paths via a crafted image that causes symlink traversal when umoci unpack or umoci raw unpack is used.

References

www.openwall.com/lists/oss-security/2021/04/06/2
github.com/advisories/GHSA-9m95-8hx6-7p9v
github.com/opencontainers/umoci/commit/d9efc31daf2206f7d3fdb839863cf7a576a2eb57
github.com/opencontainers/umoci/security/advisories/GHSA-9m95-8hx6-7p9v
nvd.nist.gov/vuln/detail/CVE-2021-29136

Code Behaviors & Features

Detect and mitigate CVE-2021-29136 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →