#VU51962 UNIX symbolic link following in umoci - CVE-2021-29136
Published: April 7, 2021
Vulnerability identifier: #VU51962
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2021-29136
CWE-ID: CWE-61
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
umoci
umoci
Software vendor:
umo.ci
umo.ci
Description
The vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to a symlink following issue when processing crafted images. A remote attacker can create a specially crafted image with symbolic link to a critical file on the system and overwrite it, when "umoci unpack" or "umoci raw unpack" is used.
Successful exploitation of this vulnerability may result in privilege escalation.
Remediation
Install updates from vendor's website.