Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Go package

github.com/opencontainers/umoci

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 5.5GoPublished

    Improper input validation in umoci

    CVE-2021-29136 · GHSA-9m95-8hx6-7p9v

    Affected
    • Go github.com/opencontainers/umoci < 0.4.7
    Fixed in
    0.4.7· Vendor fix available
    Issue
    Impact umoci 0.4.6 and earlier can be tricked into modifying host files by creating a malicious layer that has a symlink with the name "." (or "/"). Because umoci deletes inodes if they change types, this results in the rootfs directory being replaced with an attacker-controlled symlink. Subsequent image layers will then be applied on top of the target of the symlink (which could be any directory on the host filesystem the user running umoci has access to). While umoci does have defences against symlink-based attacks, they are all implemented by resolving things relative to the rootfs directory -- if the rootfs itself is a symlink, umoci resolves it first. This vulnerability affects both "umoci unpack" and "umoci raw unpack". Patches This issue has been patched in umoci 0.4.7, see the references section for the specific commit which fixed this vulnerability. Workarounds Note that if you use umoci as an unprivileged user (using the --rootless flag) then umoci will not be able to…

    Recommended action: Upgrade to 0.4.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →