GO-2022-0230

Improper limitation of path name in github.com/containernetworking/cni

En bref

Publiée: 2022-07-01 20:17 UTC
Mise à jour: 2026-03-13 21:56 UTC
CVE: CVE-2021-20206
Alias: GHSA-xjqr-g762-pxwp

Description

The FindInPath function is vulnerable to directory traversal attacks, potentially permitting attackers to execute arbitrary binaries. This function does not sanitize its plugin parameter, so parameter names containing "../" or other such elements may reference arbitrary locations on the filesystem.

Paquets affectés

Paquet	Versions
Go · github.com/containernetworking/cni	introduced 0, fixed 0.8.1

Références

https://github.com/containernetworking/cni/pull/808 FIX
https://bugzilla.redhat.com/show_bug.cgi?id=1919391 WEB
https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMCONTAINERNETWORKINGCNIPKGINVOKE-1070549 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — Go Vulnerability Database