Path traversal in ClairCore - CVE-2021-3762
Published: September 29, 2021
Vulnerability identifier: #VU56930
CSH Severity: Medium
CVSS v4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-3762
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to write arbitrary files to the system.
The vulnerability exists due to input validation error when processing directory traversal sequences. A remote attacker can supply a specially crafted container image which, when scanned by Clair, will allow to write arbitrary files on he filesystem.
Successful exploitation of the vulnerability may allow an attacker to compromise the affected system.
Affected software
ClairCore
Quay
Quay
How to mitigate CVE-2021-3762
Install update from vendor's website.
ClairCore - addressed in versions 0.4.8, 0.5.5
Quay - update to 3.5.7
Quay - update to 3.5.7