CVE-2021-29136: Improper Input Validation

February 15, 2022

The Open Container Initiative’s umoci allows attackers to overwrite arbitrary host paths via a crafted image that causes symlink traversal when umoci unpack or umoci raw unpack is used.

References

www.openwall.com/lists/oss-security/2021/04/06/2
github.com/advisories/GHSA-9m95-8hx6-7p9v
github.com/opencontainers/umoci/commit/d9efc31daf2206f7d3fdb839863cf7a576a2eb57
github.com/opencontainers/umoci/security/advisories/GHSA-9m95-8hx6-7p9v
nvd.nist.gov/vuln/detail/CVE-2021-29136

Detect and mitigate CVE-2021-29136 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →