Veracode Vulnerability DatabaseVERACODE:29942Directory Traversal
5.5 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
2.1 Low
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:L/AC:L/Au:N/C:N/I:P/A:N
Open Container Initiative umoci is vulnerable to directory traversal. It allows attackers to overwrite arbitrary host paths via a crafted image that causes symlink traversal when “umoci unpack” or “umoci raw unpack” is used.
| CPE | Name | Operator | Version |
|---|---|---|---|
| umoci:sid | eq | 0.4.5+dfsg-1 | |
| umoci:bullseye | eq | 0.4.5+dfsg-1 | |
| umoci:edge | eq | 0.4.5-r0 | |
| umoci:edge | eq | 0.4.5-r1 | |
| umoci:edge | eq | 0.4.6-r0 | |
| umoci:3.13 | eq | 0.4.6-r0 |
Related
5.5 Medium
CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
2.1 Low
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:L/AC:L/Au:N/C:N/I:P/A:N