CVE-2021-3762: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
(updated )
A directory traversal vulnerability was found in the ClairCore engine of Clair. An attacker can exploit this by supplying a crafted container image which, when scanned by Clair, allows for arbitrary file write on the filesystem, potentially allowing for remote code execution.
References
- bugzilla.redhat.com/show_bug.cgi?id=2000795
- github.com/advisories/GHSA-mq47-6wwv-v79w
- github.com/quay/clair/pull/1379
- github.com/quay/clair/pull/1380
- github.com/quay/claircore/commit/691f2023a1720a0579e688b69a2f4bfe1f4b7821
- github.com/quay/claircore/commit/dff671c665141f126c072de8a744855d4916c9c7
- github.com/quay/claircore/pull/478
- nvd.nist.gov/vuln/detail/CVE-2021-3762
- vulmon.com/exploitdetails?qidtp=maillist_oss_security&qid=d19fce9ede06e13dfb5630ece7f14f83
Code Behaviors & Features
Detect and mitigate CVE-2021-3762 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →