Advisory Database
  • Advisories
  • Dependency Scanning
  1. golang
  2. ›
  3. github.com/deislabs/oras/pkg/content
  4. ›
  5. CVE-2021-21272

CVE-2021-21272: Improper Link Resolution Before File Access ('Link Following')

February 15, 2022 (updated February 7, 2023)

ORAS is open source software which enables a way to push OCI Artifacts to OCI Conformant registries. ORAS is both a CLI for initial testing and a Go Module. In ORAS from version 0.4.0 and before version 0.9.0, there is a “zip-slip” vulnerability. The directory support feature allows the downloaded gzipped tarballs to be automatically extracted to the user-specified directory where the tarball can have symbolic links and hard links. A well-crafted tarball or tarballs allow malicious artifact providers linking, writing, or overwriting specific files on the host filesystem outside of the user-specified directory unexpectedly with the same permissions as the user who runs oras pull. Users of the affected versions are impacted if they are oras CLI users who runs oras pull, or if they are Go programs, which invoke github.com/deislabs/oras/pkg/content.FileStore. The problem has been fixed in version 0.9.0. For oras CLI users, there is no workarounds other than pulling from a trusted artifact provider. For oras package users, the workaround is to not use github.com/deislabs/oras/pkg/content.FileStore, and use other content stores instead, or pull from a trusted artifact provider.

References

  • github.com/advisories/GHSA-g5v4-5x39-vwhx
  • github.com/deislabs/oras/commit/96cd90423303f1bb42bd043cb4c36085e6e91e8e
  • github.com/deislabs/oras/releases/tag/v0.9.0
  • github.com/deislabs/oras/security/advisories/GHSA-g5v4-5x39-vwhx
  • nvd.nist.gov/vuln/detail/CVE-2021-21272
  • pkg.go.dev/github.com/deislabs/oras/pkg/oras
  • pkg.go.dev/vuln/GO-2021-0099

Code Behaviors & Features

Detect and mitigate CVE-2021-21272 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →

Affected versions

All versions before 0.9.0

Fixed versions

  • v0.9.0

Solution

Upgrade to version 0.9.0 or above.

Impact 7.7 HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

Learn more about CVSS

Weakness

  • CWE-59: Improper Link Resolution Before File Access ('Link Following')

Source file

go/github.com/deislabs/oras/pkg/content/CVE-2021-21272.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Wed, 14 May 2025 12:15:59 +0000.