GitHub Advisoryadvisory · Go

GHSA-xjqr-g762-pxwp containernetworking/cni improper limitation of path name

HIGH Published 2022-02-15 Modified 2023-10-02 Official page ↗
Aliases
CVE-2021-20206
Ecosystem
Go
Packages
github.com/containernetworking/cni
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-20, CWE-22
Reviewed
2021-05-18

Affected packages

• Go github.com/containernetworking/cni: < 0.8.1 → fixed in 0.8.1

Description

An improper limitation of path name flaw was found in containernetworking/cni in versions before 0.8.1. When specifying the plugin to load in the 'type' field in the network configuration, it is possible to use special elements such as "../" separators to reference binaries elsewhere on the system. This flaw allows an attacker to execute other existing binaries other than the cni plugins/types, such as 'reboot'. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. Specific Go Packages Affected github.com/containernetworking/cni/pkg/invoke

Related

Alias · CVE (1)

  • CVE-2021-20206 An improper limitation of path name flaw was found in containernetworking/cni in versions before 0.8.1. vulnerability

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References