by Kastro
Paper/Archive/CVE-2021-3762

CVE-2021-3762

redhat — A directory traversal vulnerability was found in the ClairCore engine of Clair.

EPSS 5%CVSS 9.8
critical.is priorityof 100
48
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 92.0.920 × 2018.4No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

A directory traversal vulnerability was found in the ClairCore engine of Clair. An attacker can exploit this by supplying a crafted container image which, when scanned by Clair, allows for arbitrary file write on the filesystem, potentially allowing for remote code execution.

Affected

ProductAffectedFixed inSource
quay/claircoreAffects v0.4.6 and higher, v0.5.3 and higher | Fixedin claircore v0.4.8, v0.5.5.–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

refbugzilla.redhat.com/show_bug.cgi?id=2000795refgithub.com/quay/claircore/pull/478refgithub.com/quay/clair/pull/1379refgithub.com/quay/clair/pull/1380refgithub.com/quay/claircore/commit/691f2023a1720a0579e688b69a2f4bfe1f4b7821refvulmon.com/exploitdetails?qidtp=maillist_oss_security&qid=d19fce9ede06e13dfb5630ece7f14f83