CVE-2021-29136
Fixed in a distro release EPSS <1%
Open Container Initiative umoci before 0.4.7 allows attackers to overwrite arbitrary host paths via a crafted image that causes symlink traversal when "umoci unpack" or "umoci raw unpack" is used.
Products: linuxfoundation umoci, sylabs singularity
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | github.com/opencontainers/umoci | 0.4.7 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | umoci | 0.4.7+ds-1 |
| Debian 13 | umoci | 0.4.7+ds-1 |
| Debian 14 | umoci | 0.4.7+ds-1 |
| SUSE Enterprise Storage 6 | umoci | 0.4.7-3.12.1 |
| SUSE Enterprise Storage 6 | umoci | 0.4.6-3.9.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS | umoci | 0.4.7-3.12.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP1-ESPOS | umoci | 0.4.6-3.9.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS | umoci | 0.4.6-3.9.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS | umoci | 0.4.7-3.12.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP3 | umoci | 0.4.7-3.12.1 |
| SUSE Linux Enterprise Module for Containers 15 SP2 | umoci | 0.4.6-3.9.1 |
| SUSE Linux Enterprise Module for Containers 15 SP2 | umoci | 0.4.7-3.12.1 |
| SUSE Linux Enterprise Module for Containers 15 SP3 | umoci | 0.4.7-3.12.1 |
| SUSE Linux Enterprise Server 15 SP1-BCL | umoci | 0.4.6-3.9.1 |
| SUSE Linux Enterprise Server 15 SP1-BCL | umoci | 0.4.7-3.12.1 |
| SUSE Linux Enterprise Server 15 SP1-LTSS | umoci | 0.4.6-3.9.1 |
| SUSE Linux Enterprise Server 15 SP1-LTSS | umoci | 0.4.7-3.12.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP1 | umoci | 0.4.7-3.12.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP1 | umoci | 0.4.6-3.9.1 |
| SUSE Manager Proxy 4.0 | umoci | 0.4.7-3.12.1 |
| SUSE Manager Proxy 4.0 | umoci | 0.4.6-3.9.1 |
| SUSE Manager Retail Branch Server 4.0 | umoci | 0.4.6-3.9.1 |
| SUSE Manager Retail Branch Server 4.0 | umoci | 0.4.7-3.12.1 |
| SUSE Manager Server 4.0 | umoci | 0.4.7-3.12.1 |
| SUSE Manager Server 4.0 | umoci | 0.4.6-3.9.1 |
| SUSE Package Hub 15 SP2 | singularity | 3.7.3-bp152.2.19.3 |
| Ubuntu 20.04 LTS | umoci | no fix |
| Ubuntu 22.04 LTS | umoci | no fix |
| openSUSE Leap 15.2 | umoci | 0.4.7-lp152.2.6.1 |
| openSUSE Leap 15.2 | umoci | 0.4.6-lp152.2.3.1 |
| openSUSE Leap 15.3 | umoci | 0.4.7-3.12.1 |
| openSUSE Tumbleweed | singularity | 3.8.3-1.2 |
| openSUSE Tumbleweed | umoci | 0.4.7-2.3 |