CVE-2021-3762

HIGH7.8EPSS 8.7%

Path traversal in github.com/quay/claircore

Published: 3/4/2022Modified: 5/20/2024

Description

A maliciously crafted RPM file can cause the Scanner.Scan function to write files with arbitrary contents to arbitrary locations on the local filestem.

Affected packages (2)

Go/github.com/quay/claircorefrom 0, < 0.4.8
Go/github.com/quay/claircorefrom 0, < 1.1.0

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	HIGH7.8	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References (14)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2021-3762
PATCHhttps://github.com/quay/claircore
WEBhttps://bugzilla.redhat.com/show_bug.cgi?id=2000795
WEBhttps://github.com/quay/claircore/commit/691f2023a1720a0579e688b69a2f4bfe1f4b7821
WEBhttps://github.com/quay/claircore/commit/dff671c665141f126c072de8a744855d4916c9c7
WEBhttps://github.com/quay/claircore/commit/ed5f52aec1c82746725e9cc23e98316eab8be25a
WEBhttps://github.com/quay/claircore/commits/v0.4.8
WEBhttps://github.com/quay/claircore/commits/v0.5.5
WEBhttps://github.com/quay/claircore/commits/v1.1.0
WEBhttps://github.com/quay/claircore/pull/478
WEBhttps://github.com/quay/clair/pull/1379
WEBhttps://github.com/quay/clair/pull/1380
WEBhttps://pkg.go.dev/vuln/GO-2022-0346
WEBhttps://vulmon.com/exploitdetails?qidtp=maillist_oss_security&qid=d19fce9ede06e13dfb5630ece7f14f83