GO-2022-0230

Improper limitation of path name in github.com/containernetworking/cni

At a glance

Published: 2022-07-01 20:17 UTC
Updated: 2026-03-13 21:56 UTC
CVE: CVE-2021-20206
Aliases: GHSA-xjqr-g762-pxwp

Description

The FindInPath function is vulnerable to directory traversal attacks, potentially permitting attackers to execute arbitrary binaries. This function does not sanitize its plugin parameter, so parameter names containing "../" or other such elements may reference arbitrary locations on the filesystem.

Affected packages

Package	Versions
Go · github.com/containernetworking/cni	introduced 0, fixed 0.8.1

References

https://github.com/containernetworking/cni/pull/808 FIX
https://bugzilla.redhat.com/show_bug.cgi?id=1919391 WEB
https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMCONTAINERNETWORKINGCNIPKGINVOKE-1070549 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — Go Vulnerability Database