Path traversal in ClairCore - CVE-2021-3762
Published: September 29, 2021
Vulnerability identifier: #VU56930
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2021-3762
CWE-ID: CWE-22
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Red Hat Inc.
Affected software:
ClairCore
ClairCore
Detailed vulnerability description
The vulnerability allows a remote attacker to write arbitrary files to the system.
The vulnerability exists due to input validation error when processing directory traversal sequences. A remote attacker can supply a specially crafted container image which, when scanned by Clair, will allow to write arbitrary files on he filesystem.
Successful exploitation of the vulnerability may allow an attacker to compromise the affected system.
How to mitigate CVE-2021-3762
Install update from vendor's website.