Vulnerability identifier: #VU54999
Vulnerability risk: Medium
Exploitation vector: Network
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to archive package allows chmod of file outside of unpack target directory. A remote attacker can deny access to the expected owner of the file, widen access to others, or set extended bits like setuid, setgid, and sticky.
Install updates from vendor's website.
Vulnerable software versions
containerd: 1.4.0 - 1.4.7, 1.5.0 - 1.5.3
Fixed software versions
Can this vulnerability be exploited remotely?
Is there known malware, which exploits this vulnerability?