Bug 2000795 (CVE-2021-3762)

Summary:	CVE-2021-3762 quay/claircore: directory traversal when scanning crafted container image layer allows for arbitrary file write
Product:	[Other] Security Response	Reporter:	Sam Fowler <sfowler>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	urgent	Docs Contact:
Priority:	urgent
Version:	unspecified	CC:	bdettelb, dhughes, fmissi, gmcgoldr, hdonnay, hgovinda, jcroslan, security-response-team, sfowler, snikolov, stevsmit, tomckay, ymittal
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	quay/claircore 0.5.5, quay/claircore 0.4.8	Doc Type:	If docs needed, set a value
Doc Text:	A directory traversal vulnerability was found in the ClairCore engine of Clair. An attacker can exploit this by supplying a crafted container image which, when scanned by Clair, allows for arbitrary file write on the filesystem, potentially allowing for remote code execution.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-09-29 00:21:07 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2000666, 2003980

Description Sam Fowler 2021-09-03 00:10:28 UTC

A vulnerability in Clair allows overwriting an arbitrary file anywhere in the filesystem, when scanning a malicious Docker layer. In most if not all instances this could lead to remote code execution on the Clair scanner instance.

Comment 8 errata-xmlrpc 2021-09-28 16:29:58 UTC

This issue has been addressed in the following products:

  Red Hat Quay 3

Via RHSA-2021:3665 https://access.redhat.com/errata/RHSA-2021:3665

Comment 9 Product Security DevOps Team 2021-09-29 00:21:07 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2021-3762

Comment 10 Przemyslaw Roguski 2021-09-29 18:22:53 UTC

Upstream PRs:
https://github.com/quay/claircore/pull/478
https://github.com/quay/clair/pull/1379
https://github.com/quay/clair/pull/1380