Vulnerability-Lookup

CVE-2021-21272 (GCVE-0-2021-21272)

Vulnerability from cvelistv5 – Published: 2021-01-25 18:30 – Updated: 2024-08-03 18:09

Title

zip slip in ORAS

Summary

ORAS is open source software which enables a way to push OCI Artifacts to OCI Conformant registries. ORAS is both a CLI for initial testing and a Go Module. In ORAS from version 0.4.0 and before version 0.9.0, there is a "zip-slip" vulnerability. The directory support feature allows the downloaded gzipped tarballs to be automatically extracted to the user-specified directory where the tarball can have symbolic links and hard links. A well-crafted tarball or tarballs allow malicious artifact providers linking, writing, or overwriting specific files on the host filesystem outside of the user-specified directory unexpectedly with the same permissions as the user who runs `oras pull`. Users of the affected versions are impacted if they are `oras` CLI users who runs `oras pull`, or if they are Go programs, which invoke `github.com/deislabs/oras/pkg/content.FileStore`. The problem has been fixed in version 0.9.0. For `oras` CLI users, there is no workarounds other than pulling from a trusted artifact provider. For `oras` package users, the workaround is to not use `github.com/deislabs/oras/pkg/content.FileStore`, and use other content stores instead, or pull from a trusted artifact provider.

Severity

7.7 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7820 records in the last 180 days details

References

4 references

URL	Tags
https://github.com/deislabs/oras/security/advisor…	x_refsource_CONFIRM
https://github.com/deislabs/oras/commit/96cd90423…	x_refsource_MISC
https://github.com/deislabs/oras/releases/tag/v0.9.0	x_refsource_MISC
https://pkg.go.dev/github.com/deislabs/oras/pkg/oras	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
deislabs	oras	Affected: >= 0.4.0, < 0.9.0	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T18:09:15.220Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/deislabs/oras/security/advisories/GHSA-g5v4-5x39-vwhx"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/deislabs/oras/commit/96cd90423303f1bb42bd043cb4c36085e6e91e8e"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/deislabs/oras/releases/tag/v0.9.0"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://pkg.go.dev/github.com/deislabs/oras/pkg/oras"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "oras",
          "vendor": "deislabs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.4.0, \u003c 0.9.0"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ORAS is open source software which enables a way to push OCI Artifacts to OCI Conformant registries. ORAS is both a CLI for initial testing and a Go Module. In ORAS from version 0.4.0 and before version 0.9.0, there is a \"zip-slip\" vulnerability. The directory support feature allows the downloaded gzipped tarballs to be automatically extracted to the user-specified directory where the tarball can have symbolic links and hard links. A well-crafted tarball or tarballs allow malicious artifact providers linking, writing, or overwriting specific files on the host filesystem outside of the user-specified directory unexpectedly with the same permissions as the user who runs `oras pull`. Users of the affected versions are impacted if they are `oras` CLI users who runs `oras pull`, or if they are Go programs, which invoke `github.com/deislabs/oras/pkg/content.FileStore`. The problem has been fixed in version 0.9.0. For `oras` CLI users, there is no workarounds other than pulling from a trusted artifact provider. For `oras` package users, the workaround is to not use `github.com/deislabs/oras/pkg/content.FileStore`, and use other content stores instead, or pull from a trusted artifact provider."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-01-25T18:30:15.000Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/deislabs/oras/security/advisories/GHSA-g5v4-5x39-vwhx"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/deislabs/oras/commit/96cd90423303f1bb42bd043cb4c36085e6e91e8e"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/deislabs/oras/releases/tag/v0.9.0"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://pkg.go.dev/github.com/deislabs/oras/pkg/oras"
        }
      ],
      "source": {
        "advisory": "GHSA-g5v4-5x39-vwhx",
        "discovery": "UNKNOWN"
      },
      "title": "zip slip in ORAS",
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "security-advisories@github.com",
          "ID": "CVE-2021-21272",
          "STATE": "PUBLIC",
          "TITLE": "zip slip in ORAS"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "oras",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "\u003e= 0.4.0, \u003c 0.9.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "deislabs"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "ORAS is open source software which enables a way to push OCI Artifacts to OCI Conformant registries. ORAS is both a CLI for initial testing and a Go Module. In ORAS from version 0.4.0 and before version 0.9.0, there is a \"zip-slip\" vulnerability. The directory support feature allows the downloaded gzipped tarballs to be automatically extracted to the user-specified directory where the tarball can have symbolic links and hard links. A well-crafted tarball or tarballs allow malicious artifact providers linking, writing, or overwriting specific files on the host filesystem outside of the user-specified directory unexpectedly with the same permissions as the user who runs `oras pull`. Users of the affected versions are impacted if they are `oras` CLI users who runs `oras pull`, or if they are Go programs, which invoke `github.com/deislabs/oras/pkg/content.FileStore`. The problem has been fixed in version 0.9.0. For `oras` CLI users, there is no workarounds other than pulling from a trusted artifact provider. For `oras` package users, the workaround is to not use `github.com/deislabs/oras/pkg/content.FileStore`, and use other content stores instead, or pull from a trusted artifact provider."
            }
          ]
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.7,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/deislabs/oras/security/advisories/GHSA-g5v4-5x39-vwhx",
              "refsource": "CONFIRM",
              "url": "https://github.com/deislabs/oras/security/advisories/GHSA-g5v4-5x39-vwhx"
            },
            {
              "name": "https://github.com/deislabs/oras/commit/96cd90423303f1bb42bd043cb4c36085e6e91e8e",
              "refsource": "MISC",
              "url": "https://github.com/deislabs/oras/commit/96cd90423303f1bb42bd043cb4c36085e6e91e8e"
            },
            {
              "name": "https://github.com/deislabs/oras/releases/tag/v0.9.0",
              "refsource": "MISC",
              "url": "https://github.com/deislabs/oras/releases/tag/v0.9.0"
            },
            {
              "name": "https://pkg.go.dev/github.com/deislabs/oras/pkg/oras",
              "refsource": "MISC",
              "url": "https://pkg.go.dev/github.com/deislabs/oras/pkg/oras"
            }
          ]
        },
        "source": {
          "advisory": "GHSA-g5v4-5x39-vwhx",
          "discovery": "UNKNOWN"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2021-21272",
    "datePublished": "2021-01-25T18:30:15.000Z",
    "dateReserved": "2020-12-22T00:00:00.000Z",
    "dateUpdated": "2024-08-03T18:09:15.220Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2021-21272",
      "date": "2026-11-13",
      "epss": "0.01466",
      "percentile": "0.74078"
    },
    "fkie_nvd": {
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:deislabs:oras:*:*:*:*:*:*:*:*",
                  "matchCriteriaId": "93510360-3674-4A55-9BB0-5FA39B53B970",
                  "versionEndExcluding": "0.9.0",
                  "versionStartIncluding": "0.4.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "ORAS is open source software which enables a way to push OCI Artifacts to OCI Conformant registries. ORAS is both a CLI for initial testing and a Go Module. In ORAS from version 0.4.0 and before version 0.9.0, there is a \"zip-slip\" vulnerability. The directory support feature allows the downloaded gzipped tarballs to be automatically extracted to the user-specified directory where the tarball can have symbolic links and hard links. A well-crafted tarball or tarballs allow malicious artifact providers linking, writing, or overwriting specific files on the host filesystem outside of the user-specified directory unexpectedly with the same permissions as the user who runs `oras pull`. Users of the affected versions are impacted if they are `oras` CLI users who runs `oras pull`, or if they are Go programs, which invoke `github.com/deislabs/oras/pkg/content.FileStore`. The problem has been fixed in version 0.9.0. For `oras` CLI users, there is no workarounds other than pulling from a trusted artifact provider. For `oras` package users, the workaround is to not use `github.com/deislabs/oras/pkg/content.FileStore`, and use other content stores instead, or pull from a trusted artifact provider."
        },
        {
          "lang": "es",
          "value": "ORAS es un software de c\u00f3digo abierto que permite una forma de empujar artefactos OCI a registros conformes con OCI. ORAS es tanto un CLI para pruebas iniciales como un m\u00f3dulo Go. En ORAS a partir de la versi\u00f3n 0.4.0 y anterior a la versi\u00f3n 0.9.0, existe una vulnerabilidad de \"deslizamiento de zip\". La funci\u00f3n de soporte de directorios permite que los tarballs gzipped descargados se extraigan autom\u00e1ticamente al directorio especificado por el usuario, donde el tarball puede tener enlaces simb\u00f3licos y enlaces duros. Un tarball o tarballs bien elaborados permiten a los proveedores de artefactos maliciosos enlazar, escribir o sobrescribir archivos espec\u00edficos en el sistema de archivos del host fuera del directorio especificado por el usuario de forma inesperada con los mismos permisos que el usuario que ejecuta `oras pull`. Los usuarios de las versiones afectadas se ven afectados si son usuarios de `oras` CLI que ejecutan `oras pull`, o si son programas Go, que invocan `github.com/deislabs/oras/pkg/content.FileStore`. El problema ha sido corregido en la versi\u00f3n 0.9.0. Para los usuarios de la CLI de `oras`, no hay ninguna soluci\u00f3n que no sea la de extraer de un proveedor de artefactos de confianza. Para los usuarios del paquete `oras`, la soluci\u00f3n es no utilizar `github.com/deislabs/oras/pkg/content.FileStore`, y utilizar otros almacenes de contenido en su lugar, o tirar de un proveedor de artefactos de confianza"
        }
      ],
      "id": "CVE-2021-21272",
      "lastModified": "2024-11-21T05:47:54.250",
      "metrics": {
        "cvssMetricV2": [
          {
            "acInsufInfo": false,
            "baseSeverity": "MEDIUM",
            "cvssData": {
              "accessComplexity": "LOW",
              "accessVector": "NETWORK",
              "authentication": "SINGLE",
              "availabilityImpact": "NONE",
              "baseScore": 4.0,
              "confidentialityImpact": "NONE",
              "integrityImpact": "PARTIAL",
              "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
              "version": "2.0"
            },
            "exploitabilityScore": 8.0,
            "impactScore": 2.9,
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": false,
            "obtainUserPrivilege": false,
            "source": "nvd@nist.gov",
            "type": "Primary",
            "userInteractionRequired": false
          }
        ],
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.7,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "CHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
              "version": "3.1"
            },
            "exploitabilityScore": 3.1,
            "impactScore": 4.0,
            "source": "security-advisories@github.com",
            "type": "Secondary"
          },
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 7.7,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "CHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
              "version": "3.1"
            },
            "exploitabilityScore": 3.1,
            "impactScore": 4.0,
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      },
      "published": "2021-01-25T19:15:12.847",
      "references": [
        {
          "source": "security-advisories@github.com",
          "tags": [
            "Patch"
          ],
          "url": "https://github.com/deislabs/oras/commit/96cd90423303f1bb42bd043cb4c36085e6e91e8e"
        },
        {
          "source": "security-advisories@github.com",
          "tags": [
            "Release Notes"
          ],
          "url": "https://github.com/deislabs/oras/releases/tag/v0.9.0"
        },
        {
          "source": "security-advisories@github.com",
          "tags": [
            "Patch",
            "Vendor Advisory"
          ],
          "url": "https://github.com/deislabs/oras/security/advisories/GHSA-g5v4-5x39-vwhx"
        },
        {
          "source": "security-advisories@github.com",
          "tags": [
            "Third Party Advisory"
          ],
          "url": "https://pkg.go.dev/github.com/deislabs/oras/pkg/oras"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch"
          ],
          "url": "https://github.com/deislabs/oras/commit/96cd90423303f1bb42bd043cb4c36085e6e91e8e"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Release Notes"
          ],
          "url": "https://github.com/deislabs/oras/releases/tag/v0.9.0"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Patch",
            "Vendor Advisory"
          ],
          "url": "https://github.com/deislabs/oras/security/advisories/GHSA-g5v4-5x39-vwhx"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Third Party Advisory"
          ],
          "url": "https://pkg.go.dev/github.com/deislabs/oras/pkg/oras"
        }
      ],
      "sourceIdentifier": "security-advisories@github.com",
      "vulnStatus": "Modified",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-22"
            }
          ],
          "source": "security-advisories@github.com",
          "type": "Secondary"
        },
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-59"
            }
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:deislabs:oras:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "93510360-3674-4A55-9BB0-5FA39B53B970",
                    "versionEndExcluding": "0.9.0",
                    "versionStartIncluding": "0.4.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "ORAS is open source software which enables a way to push OCI Artifacts to OCI Conformant registries. ORAS is both a CLI for initial testing and a Go Module. In ORAS from version 0.4.0 and before version 0.9.0, there is a \"zip-slip\" vulnerability. The directory support feature allows the downloaded gzipped tarballs to be automatically extracted to the user-specified directory where the tarball can have symbolic links and hard links. A well-crafted tarball or tarballs allow malicious artifact providers linking, writing, or overwriting specific files on the host filesystem outside of the user-specified directory unexpectedly with the same permissions as the user who runs `oras pull`. Users of the affected versions are impacted if they are `oras` CLI users who runs `oras pull`, or if they are Go programs, which invoke `github.com/deislabs/oras/pkg/content.FileStore`. The problem has been fixed in version 0.9.0. For `oras` CLI users, there is no workarounds other than pulling from a trusted artifact provider. For `oras` package users, the workaround is to not use `github.com/deislabs/oras/pkg/content.FileStore`, and use other content stores instead, or pull from a trusted artifact provider."
          },
          {
            "lang": "es",
            "value": "ORAS es un software de c\u00f3digo abierto que permite una forma de empujar artefactos OCI a registros conformes con OCI. ORAS es tanto un CLI para pruebas iniciales como un m\u00f3dulo Go. En ORAS a partir de la versi\u00f3n 0.4.0 y anterior a la versi\u00f3n 0.9.0, existe una vulnerabilidad de \"deslizamiento de zip\". La funci\u00f3n de soporte de directorios permite que los tarballs gzipped descargados se extraigan autom\u00e1ticamente al directorio especificado por el usuario, donde el tarball puede tener enlaces simb\u00f3licos y enlaces duros. Un tarball o tarballs bien elaborados permiten a los proveedores de artefactos maliciosos enlazar, escribir o sobrescribir archivos espec\u00edficos en el sistema de archivos del host fuera del directorio especificado por el usuario de forma inesperada con los mismos permisos que el usuario que ejecuta `oras pull`. Los usuarios de las versiones afectadas se ven afectados si son usuarios de `oras` CLI que ejecutan `oras pull`, o si son programas Go, que invocan `github.com/deislabs/oras/pkg/content.FileStore`. El problema ha sido corregido en la versi\u00f3n 0.9.0. Para los usuarios de la CLI de `oras`, no hay ninguna soluci\u00f3n que no sea la de extraer de un proveedor de artefactos de confianza. Para los usuarios del paquete `oras`, la soluci\u00f3n es no utilizar `github.com/deislabs/oras/pkg/content.FileStore`, y utilizar otros almacenes de contenido en su lugar, o tirar de un proveedor de artefactos de confianza"
          }
        ],
        "id": "CVE-2021-21272",
        "lastModified": "2024-11-21T05:47:54.250",
        "metrics": {
          "cvssMetricV2": [
            {
              "acInsufInfo": false,
              "baseSeverity": "MEDIUM",
              "cvssData": {
                "accessComplexity": "LOW",
                "accessVector": "NETWORK",
                "authentication": "SINGLE",
                "availabilityImpact": "NONE",
                "baseScore": 4.0,
                "confidentialityImpact": "NONE",
                "integrityImpact": "PARTIAL",
                "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
                "version": "2.0"
              },
              "exploitabilityScore": 8.0,
              "impactScore": 2.9,
              "obtainAllPrivilege": false,
              "obtainOtherPrivilege": false,
              "obtainUserPrivilege": false,
              "source": "nvd@nist.gov",
              "type": "Primary",
              "userInteractionRequired": false
            }
          ],
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 7.7,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.1,
              "impactScore": 4.0,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 7.7,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.1,
              "impactScore": 4.0,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2021-01-25T19:15:12.847",
        "references": [
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/deislabs/oras/commit/96cd90423303f1bb42bd043cb4c36085e6e91e8e"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Release Notes"
            ],
            "url": "https://github.com/deislabs/oras/releases/tag/v0.9.0"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Patch",
              "Vendor Advisory"
            ],
            "url": "https://github.com/deislabs/oras/security/advisories/GHSA-g5v4-5x39-vwhx"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://pkg.go.dev/github.com/deislabs/oras/pkg/oras"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/deislabs/oras/commit/96cd90423303f1bb42bd043cb4c36085e6e91e8e"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Release Notes"
            ],
            "url": "https://github.com/deislabs/oras/releases/tag/v0.9.0"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Patch",
              "Vendor Advisory"
            ],
            "url": "https://github.com/deislabs/oras/security/advisories/GHSA-g5v4-5x39-vwhx"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://pkg.go.dev/github.com/deislabs/oras/pkg/oras"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-22"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-59"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-14T07:00:08+00:00",
      "cve": "CVE-2021-21272",
      "id": "CVE-2021-21272",
      "initial_release_date": "2021-01-22T00:00:00+00:00",
      "product_status:known_affected": "19",
      "product_status:known_not_affected": "15",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "oras: zip-slip vulnerability via oras-pull",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-21272.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-10-17T01:40:27Z",
      "cve": "CVE-2021-21272",
      "id": "CVE-2021-21272",
      "initial_release_date": "2023-02-15T03:46:25Z",
      "product_status:known_affected": "394",
      "product_status:recommended": "97",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2021-21272",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/2023/cve-2021-21272.json",
      "version": "37"
    }
  }
}

bit-oras-2021-21272

Vulnerability from bitnami_vulndb

Published

2024-03-06 11:00

Modified

2026-09-08 08:34

Summary

zip slip in ORAS

Details

ORAS is open source software which enables a way to push OCI Artifacts to OCI Conformant registries. ORAS is both a CLI for initial testing and a Go Module. In ORAS from version 0.4.0 and before version 0.9.0, there is a "zip-slip" vulnerability. The directory support feature allows the downloaded gzipped tarballs to be automatically extracted to the user-specified directory where the tarball can have symbolic links and hard links. A well-crafted tarball or tarballs allow malicious artifact providers linking, writing, or overwriting specific files on the host filesystem outside of the user-specified directory unexpectedly with the same permissions as the user who runs oras pull. Users of the affected versions are impacted if they are oras CLI users who runs oras pull, or if they are Go programs, which invoke github.com/deislabs/oras/pkg/content.FileStore. The problem has been fixed in version 0.9.0. For oras CLI users, there is no workarounds other than pulling from a trusted artifact provider. For oras package users, the workaround is to not use github.com/deislabs/oras/pkg/content.FileStore, and use other content stores instead, or pull from a trusted artifact provider.

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Bitnami",
        "name": "oras",
        "purl": "pkg:bitnami/oras"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.4.0"
            },
            {
              "fixed": "0.9.0"
            }
          ],
          "type": "SEMVER"
        }
      ],
      "severity": [
        {
          "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
          "type": "CVSS_V3"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-21272"
  ],
  "database_specific": {
    "cpes": [
      "cpe:2.3:a:deislabs:oras:*:*:*:*:*:*:*:*"
    ],
    "severity": "High"
  },
  "details": "ORAS is open source software which enables a way to push OCI Artifacts to OCI Conformant registries. ORAS is both a CLI for initial testing and a Go Module. In ORAS from version 0.4.0 and before version 0.9.0, there is a \"zip-slip\" vulnerability. The directory support feature allows the downloaded gzipped tarballs to be automatically extracted to the user-specified directory where the tarball can have symbolic links and hard links. A well-crafted tarball or tarballs allow malicious artifact providers linking, writing, or overwriting specific files on the host filesystem outside of the user-specified directory unexpectedly with the same permissions as the user who runs `oras pull`. Users of the affected versions are impacted if they are `oras` CLI users who runs `oras pull`, or if they are Go programs, which invoke `github.com/deislabs/oras/pkg/content.FileStore`. The problem has been fixed in version 0.9.0. For `oras` CLI users, there is no workarounds other than pulling from a trusted artifact provider. For `oras` package users, the workaround is to not use `github.com/deislabs/oras/pkg/content.FileStore`, and use other content stores instead, or pull from a trusted artifact provider.",
  "id": "BIT-oras-2021-21272",
  "modified": "2026-09-08T08:34:36.952Z",
  "published": "2024-03-06T11:00:05.176Z",
  "references": [
    {
      "type": "FIX",
      "url": "https://github.com/deislabs/oras/commit/96cd90423303f1bb42bd043cb4c36085e6e91e8e"
    },
    {
      "type": "ARTICLE",
      "url": "https://github.com/deislabs/oras/releases/tag/v0.9.0"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/deislabs/oras/security/advisories/GHSA-g5v4-5x39-vwhx"
    },
    {
      "type": "ADVISORY",
      "url": "https://pkg.go.dev/github.com/deislabs/oras/pkg/oras"
    },
    {
      "type": "WEB",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21272"
    }
  ],
  "schema_version": "1.5.0",
  "summary": "zip slip in ORAS"
}

FKIE_CVE-2021-21272

Vulnerability from fkie_nvd - Published: 2021-01-25 19:15 - Updated: 2026-06-17 03:35

Severity

7.7 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
7.7 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

Summary

References

URL	Tags
security-advisories@github.com	https://github.com/deislabs/oras/commit/96cd90423303f1bb42bd043cb4c36085e6e91e8e	Patch
security-advisories@github.com	https://github.com/deislabs/oras/releases/tag/v0.9.0	Release Notes
security-advisories@github.com	https://github.com/deislabs/oras/security/advisories/GHSA-g5v4-5x39-vwhx	Patch, Vendor Advisory
security-advisories@github.com	https://pkg.go.dev/github.com/deislabs/oras/pkg/oras	Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108	https://github.com/deislabs/oras/commit/96cd90423303f1bb42bd043cb4c36085e6e91e8e	Patch
af854a3a-2127-422b-91ae-364da2661108	https://github.com/deislabs/oras/releases/tag/v0.9.0	Release Notes
af854a3a-2127-422b-91ae-364da2661108	https://github.com/deislabs/oras/security/advisories/GHSA-g5v4-5x39-vwhx	Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108	https://pkg.go.dev/github.com/deislabs/oras/pkg/oras	Third Party Advisory

Impacted products

	Vendor	Product	Version
	deislabs	oras	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "oras",
          "vendor": "deislabs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 0.4.0, \u003c 0.9.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:deislabs:oras:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "93510360-3674-4A55-9BB0-5FA39B53B970",
              "versionEndExcluding": "0.9.0",
              "versionStartIncluding": "0.4.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "ORAS is open source software which enables a way to push OCI Artifacts to OCI Conformant registries. ORAS is both a CLI for initial testing and a Go Module. In ORAS from version 0.4.0 and before version 0.9.0, there is a \"zip-slip\" vulnerability. The directory support feature allows the downloaded gzipped tarballs to be automatically extracted to the user-specified directory where the tarball can have symbolic links and hard links. A well-crafted tarball or tarballs allow malicious artifact providers linking, writing, or overwriting specific files on the host filesystem outside of the user-specified directory unexpectedly with the same permissions as the user who runs `oras pull`. Users of the affected versions are impacted if they are `oras` CLI users who runs `oras pull`, or if they are Go programs, which invoke `github.com/deislabs/oras/pkg/content.FileStore`. The problem has been fixed in version 0.9.0. For `oras` CLI users, there is no workarounds other than pulling from a trusted artifact provider. For `oras` package users, the workaround is to not use `github.com/deislabs/oras/pkg/content.FileStore`, and use other content stores instead, or pull from a trusted artifact provider."
    },
    {
      "lang": "es",
      "value": "ORAS es un software de c\u00f3digo abierto que permite una forma de empujar artefactos OCI a registros conformes con OCI. ORAS es tanto un CLI para pruebas iniciales como un m\u00f3dulo Go. En ORAS a partir de la versi\u00f3n 0.4.0 y anterior a la versi\u00f3n 0.9.0, existe una vulnerabilidad de \"deslizamiento de zip\". La funci\u00f3n de soporte de directorios permite que los tarballs gzipped descargados se extraigan autom\u00e1ticamente al directorio especificado por el usuario, donde el tarball puede tener enlaces simb\u00f3licos y enlaces duros. Un tarball o tarballs bien elaborados permiten a los proveedores de artefactos maliciosos enlazar, escribir o sobrescribir archivos espec\u00edficos en el sistema de archivos del host fuera del directorio especificado por el usuario de forma inesperada con los mismos permisos que el usuario que ejecuta `oras pull`. Los usuarios de las versiones afectadas se ven afectados si son usuarios de `oras` CLI que ejecutan `oras pull`, o si son programas Go, que invocan `github.com/deislabs/oras/pkg/content.FileStore`. El problema ha sido corregido en la versi\u00f3n 0.9.0. Para los usuarios de la CLI de `oras`, no hay ninguna soluci\u00f3n que no sea la de extraer de un proveedor de artefactos de confianza. Para los usuarios del paquete `oras`, la soluci\u00f3n es no utilizar `github.com/deislabs/oras/pkg/content.FileStore`, y utilizar otros almacenes de contenido en su lugar, o tirar de un proveedor de artefactos de confianza"
    }
  ],
  "id": "CVE-2021-21272",
  "lastModified": "2026-06-17T03:35:10.050",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "NONE",
          "baseScore": 4.0,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.0,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.7,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 4.0,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.7,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 4.0,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2021-01-25T19:15:12.847",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/deislabs/oras/commit/96cd90423303f1bb42bd043cb4c36085e6e91e8e"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/deislabs/oras/releases/tag/v0.9.0"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://github.com/deislabs/oras/security/advisories/GHSA-g5v4-5x39-vwhx"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://pkg.go.dev/github.com/deislabs/oras/pkg/oras"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/deislabs/oras/commit/96cd90423303f1bb42bd043cb4c36085e6e91e8e"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Release Notes"
      ],
      "url": "https://github.com/deislabs/oras/releases/tag/v0.9.0"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://github.com/deislabs/oras/security/advisories/GHSA-g5v4-5x39-vwhx"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://pkg.go.dev/github.com/deislabs/oras/pkg/oras"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-59"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

GHSA-G5V4-5X39-VWHX

Vulnerability from github – Published: 2022-02-15 00:32 – Updated: 2022-10-25 20:26

Summary

Zip slip directory exploit in github.com/deislabs/oras

Details

Impact

The directory support (#55) allows the downloaded gzipped tarballs to be automatically extracted to the user-specified directory where the tarball can have symbolic links and hard links.

A well-crafted tarball or tarballs allow malicious artifact providers linking, writing, or overwriting specific files on the host filesystem outside of the user-specified directory unexpectedly with the same permissions as the user who runs oras pull.

Precisely, the following users of the affected versions are impacted - oras CLI users who runs oras pull. - Go programs, which invokes github.com/deislabs/oras/pkg/content.FileStore.

Patches

The problem has been patched by the PR linked with this advisory. Users should upgrade their oras CLI and packages to 0.9.0.

Workarounds

For oras CLI users, there is no workarounds other than pulling from a trusted artifact provider.

For oras package users, the workaround is to not use github.com/deislabs/oras/pkg/content.FileStore, and use other content stores instead, or pull from a trusted artifact provider.

References

Zip Slip

For more information

If you have any questions or comments about this advisory: * Open an issue on the GitHub repo * Email the list of maintainers

Severity

7.7 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/deislabs/oras"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.9.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-21272"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22",
      "CWE-59"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-05-21T14:42:50Z",
    "nvd_published_at": "2021-01-25T19:15:00Z",
    "severity": "HIGH"
  },
  "details": "### Impact\nThe directory support (#55) allows the downloaded gzipped tarballs to be automatically extracted to the user-specified directory where the tarball can have symbolic links and hard links.\n\nA well-crafted tarball or tarballs allow malicious artifact providers linking, writing, or overwriting specific files on the host filesystem outside of the user-specified directory unexpectedly with the same permissions as the user who runs `oras pull`. \n\nPrecisely, the following users of the affected versions are impacted\n- `oras` CLI users who runs `oras pull`.\n- Go programs, which invokes `github.com/deislabs/oras/pkg/content.FileStore`.\n\n### Patches\nThe problem has been patched by the PR linked with this advisory. Users should upgrade their `oras` CLI and packages to `0.9.0`.\n\n### Workarounds\nFor `oras` CLI users, there is no workarounds other than pulling from a trusted artifact provider.\n\nFor `oras` package users, the workaround is to not use `github.com/deislabs/oras/pkg/content.FileStore`, and use other content stores instead, or pull from a trusted artifact provider.\n\n### References\n- [Zip Slip](https://github.com/snyk/zip-slip-vulnerability)\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue on the [GitHub repo](https://github.com/deislabs/oras)\n* Email the [list of maintainers](https://github.com/deislabs/oras/blob/main/MAINTAINERS)",
  "id": "GHSA-g5v4-5x39-vwhx",
  "modified": "2022-10-25T20:26:42Z",
  "published": "2022-02-15T00:32:04Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/deislabs/oras/security/advisories/GHSA-g5v4-5x39-vwhx"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21272"
    },
    {
      "type": "WEB",
      "url": "https://github.com/deislabs/oras/commit/96cd90423303f1bb42bd043cb4c36085e6e91e8e"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/deislabs/oras"
    },
    {
      "type": "WEB",
      "url": "https://github.com/deislabs/oras/releases/tag/v0.9.0"
    },
    {
      "type": "WEB",
      "url": "https://pkg.go.dev/github.com/deislabs/oras/pkg/oras"
    },
    {
      "type": "WEB",
      "url": "https://pkg.go.dev/vuln/GO-2021-0099"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Zip slip directory exploit in github.com/deislabs/oras"
}

GSD-2021-21272

Vulnerability from gsd - Updated: 2023-12-13 01:23

Details

Aliases

CVE-2021-21272

Aliases

CVE-2021-21272

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2021-21272",
    "description": "ORAS is open source software which enables a way to push OCI Artifacts to OCI Conformant registries. ORAS is both a CLI for initial testing and a Go Module. In ORAS from version 0.4.0 and before version 0.9.0, there is a \"zip-slip\" vulnerability. The directory support feature allows the downloaded gzipped tarballs to be automatically extracted to the user-specified directory where the tarball can have symbolic links and hard links. A well-crafted tarball or tarballs allow malicious artifact providers linking, writing, or overwriting specific files on the host filesystem outside of the user-specified directory unexpectedly with the same permissions as the user who runs `oras pull`. Users of the affected versions are impacted if they are `oras` CLI users who runs `oras pull`, or if they are Go programs, which invoke `github.com/deislabs/oras/pkg/content.FileStore`. The problem has been fixed in version 0.9.0. For `oras` CLI users, there is no workarounds other than pulling from a trusted artifact provider. For `oras` package users, the workaround is to not use `github.com/deislabs/oras/pkg/content.FileStore`, and use other content stores instead, or pull from a trusted artifact provider.",
    "id": "GSD-2021-21272",
    "references": [
      "https://www.suse.com/security/cve/CVE-2021-21272.html",
      "https://access.redhat.com/errata/RHSA-2021:3016"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "aliases": [
        "CVE-2021-21272"
      ],
      "details": "ORAS is open source software which enables a way to push OCI Artifacts to OCI Conformant registries. ORAS is both a CLI for initial testing and a Go Module. In ORAS from version 0.4.0 and before version 0.9.0, there is a \"zip-slip\" vulnerability. The directory support feature allows the downloaded gzipped tarballs to be automatically extracted to the user-specified directory where the tarball can have symbolic links and hard links. A well-crafted tarball or tarballs allow malicious artifact providers linking, writing, or overwriting specific files on the host filesystem outside of the user-specified directory unexpectedly with the same permissions as the user who runs `oras pull`. Users of the affected versions are impacted if they are `oras` CLI users who runs `oras pull`, or if they are Go programs, which invoke `github.com/deislabs/oras/pkg/content.FileStore`. The problem has been fixed in version 0.9.0. For `oras` CLI users, there is no workarounds other than pulling from a trusted artifact provider. For `oras` package users, the workaround is to not use `github.com/deislabs/oras/pkg/content.FileStore`, and use other content stores instead, or pull from a trusted artifact provider.",
      "id": "GSD-2021-21272",
      "modified": "2023-12-13T01:23:11.274609Z",
      "schema_version": "1.4.0"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "security-advisories@github.com",
        "ID": "CVE-2021-21272",
        "STATE": "PUBLIC",
        "TITLE": "zip slip in ORAS"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "oras",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "\u003e= 0.4.0, \u003c 0.9.0"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "deislabs"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "ORAS is open source software which enables a way to push OCI Artifacts to OCI Conformant registries. ORAS is both a CLI for initial testing and a Go Module. In ORAS from version 0.4.0 and before version 0.9.0, there is a \"zip-slip\" vulnerability. The directory support feature allows the downloaded gzipped tarballs to be automatically extracted to the user-specified directory where the tarball can have symbolic links and hard links. A well-crafted tarball or tarballs allow malicious artifact providers linking, writing, or overwriting specific files on the host filesystem outside of the user-specified directory unexpectedly with the same permissions as the user who runs `oras pull`. Users of the affected versions are impacted if they are `oras` CLI users who runs `oras pull`, or if they are Go programs, which invoke `github.com/deislabs/oras/pkg/content.FileStore`. The problem has been fixed in version 0.9.0. For `oras` CLI users, there is no workarounds other than pulling from a trusted artifact provider. For `oras` package users, the workaround is to not use `github.com/deislabs/oras/pkg/content.FileStore`, and use other content stores instead, or pull from a trusted artifact provider."
          }
        ]
      },
      "impact": {
        "cvss": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 7.7,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
          "version": "3.1"
        }
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://github.com/deislabs/oras/security/advisories/GHSA-g5v4-5x39-vwhx",
            "refsource": "CONFIRM",
            "url": "https://github.com/deislabs/oras/security/advisories/GHSA-g5v4-5x39-vwhx"
          },
          {
            "name": "https://github.com/deislabs/oras/commit/96cd90423303f1bb42bd043cb4c36085e6e91e8e",
            "refsource": "MISC",
            "url": "https://github.com/deislabs/oras/commit/96cd90423303f1bb42bd043cb4c36085e6e91e8e"
          },
          {
            "name": "https://github.com/deislabs/oras/releases/tag/v0.9.0",
            "refsource": "MISC",
            "url": "https://github.com/deislabs/oras/releases/tag/v0.9.0"
          },
          {
            "name": "https://pkg.go.dev/github.com/deislabs/oras/pkg/oras",
            "refsource": "MISC",
            "url": "https://pkg.go.dev/github.com/deislabs/oras/pkg/oras"
          }
        ]
      },
      "source": {
        "advisory": "GHSA-g5v4-5x39-vwhx",
        "discovery": "UNKNOWN"
      }
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "\u003cv0.9.0",
          "affected_versions": "All versions before 0.9.0",
          "cvss_v2": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-22",
            "CWE-937"
          ],
          "date": "2022-02-15",
          "description": "ORAS is open source software which enables a way to push OCI Artifacts to OCI Conformant registries. ORAS suffers from a `zip-slip` vulnerability. The directory support feature allows the downloaded gzipped tarballs to be automatically extracted to the user-specified directory where the tarball can have symbolic links and hard links. A well-crafted tarball or tarballs allow malicious artifact providers linking, writing, or overwriting specific files on the host filesystem outside of the user-specified directory unexpectedly with the same permissions as the user who runs `oras pull`.",
          "fixed_versions": [
            "v0.9.0"
          ],
          "identifier": "CVE-2021-21272",
          "identifiers": [
            "GHSA-g5v4-5x39-vwhx",
            "CVE-2021-21272"
          ],
          "not_impacted": "All versions starting from 0.9.0",
          "package_slug": "go/github.com/deislabs/oras",
          "pubdate": "2022-02-15",
          "solution": "Upgrade to version 0.9.0 or above.",
          "title": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
          "urls": [
            "https://github.com/deislabs/oras/security/advisories/GHSA-g5v4-5x39-vwhx",
            "https://nvd.nist.gov/vuln/detail/CVE-2021-21272",
            "https://github.com/deislabs/oras/commit/96cd90423303f1bb42bd043cb4c36085e6e91e8e",
            "https://github.com/deislabs/oras/releases/tag/v0.9.0",
            "https://pkg.go.dev/github.com/deislabs/oras/pkg/oras",
            "https://github.com/advisories/GHSA-g5v4-5x39-vwhx"
          ],
          "uuid": "372f90ae-00e7-4cb8-ba24-ec8285b238de",
          "versions": [
            {
              "commit": {
                "sha": "96cd90423303f1bb42bd043cb4c36085e6e91e8e",
                "tags": [
                  "v0.9.0"
                ],
                "timestamp": "20210122152641"
              },
              "number": "v0.9.0"
            }
          ]
        },
        {
          "affected_range": "\u003cv0.9.0",
          "affected_versions": "All versions before 0.9.0",
          "cvss_v2": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-59",
            "CWE-937"
          ],
          "date": "2023-02-07",
          "description": "ORAS is open source software which enables a way to push OCI Artifacts to OCI Conformant registries. ORAS is both a CLI for initial testing and a Go Module. In ORAS from version 0.4.0 and before version 0.9.0, there is a \"zip-slip\" vulnerability. The directory support feature allows the downloaded gzipped tarballs to be automatically extracted to the user-specified directory where the tarball can have symbolic links and hard links. A well-crafted tarball or tarballs allow malicious artifact providers linking, writing, or overwriting specific files on the host filesystem outside of the user-specified directory unexpectedly with the same permissions as the user who runs `oras pull`. Users of the affected versions are impacted if they are `oras` CLI users who runs `oras pull`, or if they are Go programs, which invoke `github.com/deislabs/oras/pkg/content.FileStore`. The problem has been fixed in version 0.9.0. For `oras` CLI users, there is no workarounds other than pulling from a trusted artifact provider. For `oras` package users, the workaround is to not use `github.com/deislabs/oras/pkg/content.FileStore`, and use other content stores instead, or pull from a trusted artifact provider.",
          "fixed_versions": [
            "v0.9.0"
          ],
          "identifier": "CVE-2021-21272",
          "identifiers": [
            "GHSA-g5v4-5x39-vwhx",
            "CVE-2021-21272"
          ],
          "not_impacted": "All versions starting from 0.9.0",
          "package_slug": "go/github.com/deislabs/oras/pkg/content",
          "pubdate": "2022-02-15",
          "solution": "Upgrade to version 0.9.0 or above.",
          "title": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
          "urls": [
            "https://github.com/deislabs/oras/security/advisories/GHSA-g5v4-5x39-vwhx",
            "https://nvd.nist.gov/vuln/detail/CVE-2021-21272",
            "https://github.com/deislabs/oras/commit/96cd90423303f1bb42bd043cb4c36085e6e91e8e",
            "https://github.com/deislabs/oras/releases/tag/v0.9.0",
            "https://pkg.go.dev/github.com/deislabs/oras/pkg/oras",
            "https://pkg.go.dev/vuln/GO-2021-0099",
            "https://github.com/advisories/GHSA-g5v4-5x39-vwhx"
          ],
          "uuid": "d6d369f8-df8d-41a0-ad17-41d073bfe2e9",
          "versions": [
            {
              "commit": {
                "sha": "96cd90423303f1bb42bd043cb4c36085e6e91e8e",
                "tags": [
                  "v0.9.0"
                ],
                "timestamp": "20210122152641"
              },
              "number": "v0.9.0"
            }
          ]
        },
        {
          "affected_range": "\u003e=v0.4.0 \u003cv0.9.0",
          "affected_versions": "All versions starting from 0.4.0 before 0.9.0",
          "cvss_v2": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-59",
            "CWE-937"
          ],
          "date": "2022-10-25",
          "description": "ORAS is open source software which enables a way to push OCI Artifacts to OCI Conformant registries.For `oras` CLI users, there is no workarounds other than pulling from a trusted artifact provider. For `oras` package users, the workaround is to not use `github.com/deislabs/oras/pkg/content.FileStore`, and use other content stores instead, or pull from a trusted artifact provider.",
          "fixed_versions": [
            "v0.9.0"
          ],
          "identifier": "CVE-2021-21272",
          "identifiers": [
            "CVE-2021-21272",
            "GHSA-g5v4-5x39-vwhx"
          ],
          "not_impacted": "All versions before 0.4.0, all versions starting from 0.9.0",
          "package_slug": "go/github.com/deislabs/oras/pkg/oras",
          "pubdate": "2021-01-25",
          "solution": "Upgrade to version 0.9.0 or above.",
          "title": "Path Traversal",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2021-21272"
          ],
          "uuid": "9078f635-6641-4f98-b288-0bc1acd26670",
          "versions": [
            {
              "commit": {
                "sha": "daecb6fb4acd5194059994e6f4bd367ad00b3b76",
                "tags": [
                  "v0.4.0"
                ],
                "timestamp": "20190419173700"
              },
              "number": "v0.4.0"
            },
            {
              "commit": {
                "sha": "96cd90423303f1bb42bd043cb4c36085e6e91e8e",
                "tags": [
                  "v0.9.0"
                ],
                "timestamp": "20210122152641"
              },
              "number": "v0.9.0"
            }
          ]
        }
      ]
    },
    "nvd.nist.gov": {
      "cve": {
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:deislabs:oras:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "93510360-3674-4A55-9BB0-5FA39B53B970",
                    "versionEndExcluding": "0.9.0",
                    "versionStartIncluding": "0.4.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "descriptions": [
          {
            "lang": "en",
            "value": "ORAS is open source software which enables a way to push OCI Artifacts to OCI Conformant registries. ORAS is both a CLI for initial testing and a Go Module. In ORAS from version 0.4.0 and before version 0.9.0, there is a \"zip-slip\" vulnerability. The directory support feature allows the downloaded gzipped tarballs to be automatically extracted to the user-specified directory where the tarball can have symbolic links and hard links. A well-crafted tarball or tarballs allow malicious artifact providers linking, writing, or overwriting specific files on the host filesystem outside of the user-specified directory unexpectedly with the same permissions as the user who runs `oras pull`. Users of the affected versions are impacted if they are `oras` CLI users who runs `oras pull`, or if they are Go programs, which invoke `github.com/deislabs/oras/pkg/content.FileStore`. The problem has been fixed in version 0.9.0. For `oras` CLI users, there is no workarounds other than pulling from a trusted artifact provider. For `oras` package users, the workaround is to not use `github.com/deislabs/oras/pkg/content.FileStore`, and use other content stores instead, or pull from a trusted artifact provider."
          },
          {
            "lang": "es",
            "value": "ORAS es un software de c\u00f3digo abierto que permite una forma de empujar artefactos OCI a registros conformes con OCI. ORAS es tanto un CLI para pruebas iniciales como un m\u00f3dulo Go. En ORAS a partir de la versi\u00f3n 0.4.0 y anterior a la versi\u00f3n 0.9.0, existe una vulnerabilidad de \"deslizamiento de zip\". La funci\u00f3n de soporte de directorios permite que los tarballs gzipped descargados se extraigan autom\u00e1ticamente al directorio especificado por el usuario, donde el tarball puede tener enlaces simb\u00f3licos y enlaces duros. Un tarball o tarballs bien elaborados permiten a los proveedores de artefactos maliciosos enlazar, escribir o sobrescribir archivos espec\u00edficos en el sistema de archivos del host fuera del directorio especificado por el usuario de forma inesperada con los mismos permisos que el usuario que ejecuta `oras pull`. Los usuarios de las versiones afectadas se ven afectados si son usuarios de `oras` CLI que ejecutan `oras pull`, o si son programas Go, que invocan `github.com/deislabs/oras/pkg/content.FileStore`. El problema ha sido corregido en la versi\u00f3n 0.9.0. Para los usuarios de la CLI de `oras`, no hay ninguna soluci\u00f3n que no sea la de extraer de un proveedor de artefactos de confianza. Para los usuarios del paquete `oras`, la soluci\u00f3n es no utilizar `github.com/deislabs/oras/pkg/content.FileStore`, y utilizar otros almacenes de contenido en su lugar, o tirar de un proveedor de artefactos de confianza"
          }
        ],
        "id": "CVE-2021-21272",
        "lastModified": "2024-02-21T20:39:19.723",
        "metrics": {
          "cvssMetricV2": [
            {
              "acInsufInfo": false,
              "baseSeverity": "MEDIUM",
              "cvssData": {
                "accessComplexity": "LOW",
                "accessVector": "NETWORK",
                "authentication": "SINGLE",
                "availabilityImpact": "NONE",
                "baseScore": 4.0,
                "confidentialityImpact": "NONE",
                "integrityImpact": "PARTIAL",
                "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
                "version": "2.0"
              },
              "exploitabilityScore": 8.0,
              "impactScore": 2.9,
              "obtainAllPrivilege": false,
              "obtainOtherPrivilege": false,
              "obtainUserPrivilege": false,
              "source": "nvd@nist.gov",
              "type": "Primary",
              "userInteractionRequired": false
            }
          ],
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 7.7,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.1,
              "impactScore": 4.0,
              "source": "nvd@nist.gov",
              "type": "Primary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 7.7,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 3.1,
              "impactScore": 4.0,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ]
        },
        "published": "2021-01-25T19:15:12.847",
        "references": [
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Patch"
            ],
            "url": "https://github.com/deislabs/oras/commit/96cd90423303f1bb42bd043cb4c36085e6e91e8e"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Release Notes"
            ],
            "url": "https://github.com/deislabs/oras/releases/tag/v0.9.0"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Patch",
              "Vendor Advisory"
            ],
            "url": "https://github.com/deislabs/oras/security/advisories/GHSA-g5v4-5x39-vwhx"
          },
          {
            "source": "security-advisories@github.com",
            "tags": [
              "Third Party Advisory"
            ],
            "url": "https://pkg.go.dev/github.com/deislabs/oras/pkg/oras"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-59"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-22"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    }
  }
}

OPENSUSE-SU-2024:12345-1

Vulnerability from csaf_opensuse - Published: 2024-06-15 00:00 - Updated: 2026-09-20 20:36

Summary

helm-3.9.4-3.1 on GA media

Severity

Moderate

Scope

1 vulnerability in this advisory, including CVE-2021-21272.

CVE-2021-21272

7.7 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

Recommended: 16 products

Open the full advisory

OPENSUSE-SU-2025:15779-1

Vulnerability from csaf_opensuse - Published: 2025-11-28 00:00 - Updated: 2026-09-20 21:45

Summary

helm3-3.19.2-1.1 on GA media

Severity

Moderate

Scope

20 vulnerabilities in this advisory, including CVE-2021-21272.

CVE-2021-21272

7.7 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

Recommended: 16 products

Open the full advisory

RHSA-2021:3016

Vulnerability from csaf_redhat - Published: 2021-08-06 00:48 - Updated: 2026-02-18 08:24

Summary

Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes version 2.3

Severity

Important

Scope

31 vulnerabilities in this advisory, including CVE-2021-21272.

CVE-2021-21272

A flaw was found in oras. The directory support feature allows the downloaded gzipped tarballs to be automatically extracted to the user-specified directory where the tarball can have symbolic links and hard links. A well-crafted tarball or tarballs allow malicious artifact providers linking, writing, or overwriting specific files on the host filesystem outside of the user-specified directory unexpectedly with the same permissions as the user who runs `oras pull`.

7.1 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:N

Fixed: 11 products Known not affected: 132 products

https://access.redhat.com/errata/RHSA-2021:3016

Open the full advisory

RHSA-2021_3016

Vulnerability from csaf_redhat - Published: 2021-08-06 00:48 - Updated: 2024-12-17 21:50

Summary

Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes version 2.3

Severity

Important

Scope

31 vulnerabilities in this advisory, including CVE-2021-21272.

CVE-2021-21272

7.1 (High)


                
                  CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:N

Fixed: 11 products Known not affected: 132 products

https://access.redhat.com/errata/RHSA-2021:3016

Open the full advisory

SUSE-SU-2022:4606-1

Vulnerability from csaf_suse - Published: 2022-12-22 08:32 - Updated: 2022-12-22 08:32

Summary

Security update for helm

Severity

Moderate

Scope

5 vulnerabilities in this advisory, including CVE-2021-21272.

CVE-2021-21272

7.7 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

Recommended: 21 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2021-21272 (GCVE-0-2021-21272)

Vulnerability from bitnami_vulndb

Impact

Patches

Workarounds

References

For more information

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour