rhsa-2021_3665
Vulnerability from csaf_redhat
Published
2021-09-28 21:19
Modified
2024-11-13 23:32
Summary
Red Hat Security Advisory: Red Hat Quay v3.5.7 bug fix and security update

Notes

Topic
Red Hat Quay 3.5.7 is now available with security update, bug fixes and various enhancements. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
This release of Quay 3.5.7 includes: Security Fix(es): * quay/claircore: directory traversal when scanning crafted container image layer allows for arbitrary file write (CVE-2021-3762) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat Quay 3.5.7 is now available with security update, bug fixes and various enhancements.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "This release of Quay 3.5.7 includes:\n\nSecurity Fix(es):\n\n* quay/claircore: directory traversal when scanning crafted container image layer allows for arbitrary file write (CVE-2021-3762)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2021:3665",
        "url": "https://access.redhat.com/errata/RHSA-2021:3665"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2000795",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2000795"
      },
      {
        "category": "external",
        "summary": "PROJQUAY-2480",
        "url": "https://issues.redhat.com/browse/PROJQUAY-2480"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3665.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Quay v3.5.7 bug fix and security update",
    "tracking": {
      "current_release_date": "2024-11-13T23:32:23+00:00",
      "generator": {
        "date": "2024-11-13T23:32:23+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.0"
        }
      },
      "id": "RHSA-2021:3665",
      "initial_release_date": "2021-09-28T21:19:17+00:00",
      "revision_history": [
        {
          "date": "2021-09-28T21:19:17+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2021-09-28T21:19:17+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-13T23:32:23+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Quay v3",
                "product": {
                  "name": "Quay v3",
                  "product_id": "8Base-Quay-3",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:quay:3::el8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Quay"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "quay/quay-bridge-operator-bundle@sha256:6c2ab763239f6e5a2a72890120bf1f20f6277850cec59a7e11cea2b6a06f12e8_amd64",
                "product": {
                  "name": "quay/quay-bridge-operator-bundle@sha256:6c2ab763239f6e5a2a72890120bf1f20f6277850cec59a7e11cea2b6a06f12e8_amd64",
                  "product_id": "quay/quay-bridge-operator-bundle@sha256:6c2ab763239f6e5a2a72890120bf1f20f6277850cec59a7e11cea2b6a06f12e8_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-bridge-operator-bundle@sha256:6c2ab763239f6e5a2a72890120bf1f20f6277850cec59a7e11cea2b6a06f12e8?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-bundle\u0026tag=v3.5.7-7"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "quay/quay-bridge-operator-rhel8@sha256:ccd53fb4b31b792175cfece28ae0b6a9956090eb273e82998444fc6c7f312e20_amd64",
                "product": {
                  "name": "quay/quay-bridge-operator-rhel8@sha256:ccd53fb4b31b792175cfece28ae0b6a9956090eb273e82998444fc6c7f312e20_amd64",
                  "product_id": "quay/quay-bridge-operator-rhel8@sha256:ccd53fb4b31b792175cfece28ae0b6a9956090eb273e82998444fc6c7f312e20_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-bridge-operator-rhel8@sha256:ccd53fb4b31b792175cfece28ae0b6a9956090eb273e82998444fc6c7f312e20?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-bridge-operator-rhel8\u0026tag=v3.5.7-11"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "quay/quay-builder-rhel8@sha256:76b5e1deb371d2514f2feb59b750ded7e1f76f48b35a532ad806f921f4a4e722_amd64",
                "product": {
                  "name": "quay/quay-builder-rhel8@sha256:76b5e1deb371d2514f2feb59b750ded7e1f76f48b35a532ad806f921f4a4e722_amd64",
                  "product_id": "quay/quay-builder-rhel8@sha256:76b5e1deb371d2514f2feb59b750ded7e1f76f48b35a532ad806f921f4a4e722_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-builder-rhel8@sha256:76b5e1deb371d2514f2feb59b750ded7e1f76f48b35a532ad806f921f4a4e722?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-builder-rhel8\u0026tag=v3.5.7-8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "quay/quay-builder-qemu-rhcos-rhel8@sha256:d0448bd89653695c1089dfcd12e2bcf4169ac732b1830c6c9cbb9909181778ed_amd64",
                "product": {
                  "name": "quay/quay-builder-qemu-rhcos-rhel8@sha256:d0448bd89653695c1089dfcd12e2bcf4169ac732b1830c6c9cbb9909181778ed_amd64",
                  "product_id": "quay/quay-builder-qemu-rhcos-rhel8@sha256:d0448bd89653695c1089dfcd12e2bcf4169ac732b1830c6c9cbb9909181778ed_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-builder-qemu-rhcos-rhel8@sha256:d0448bd89653695c1089dfcd12e2bcf4169ac732b1830c6c9cbb9909181778ed?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-builder-qemu-rhcos-rhel8\u0026tag=v3.5.7-8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "quay/clair-rhel8@sha256:bbfe6e82c9c01fb6f4d8c67e1af5a1e3e00486f902efc14a4e2fe22e5fcad65d_amd64",
                "product": {
                  "name": "quay/clair-rhel8@sha256:bbfe6e82c9c01fb6f4d8c67e1af5a1e3e00486f902efc14a4e2fe22e5fcad65d_amd64",
                  "product_id": "quay/clair-rhel8@sha256:bbfe6e82c9c01fb6f4d8c67e1af5a1e3e00486f902efc14a4e2fe22e5fcad65d_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/clair-rhel8@sha256:bbfe6e82c9c01fb6f4d8c67e1af5a1e3e00486f902efc14a4e2fe22e5fcad65d?arch=amd64\u0026repository_url=registry.redhat.io/quay/clair-rhel8\u0026tag=v3.5.7-8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "quay/quay-container-security-operator-bundle@sha256:68e766235bdcd8f3335e2ab6e09942d98b183b3e498abb65acab6481664d46ed_amd64",
                "product": {
                  "name": "quay/quay-container-security-operator-bundle@sha256:68e766235bdcd8f3335e2ab6e09942d98b183b3e498abb65acab6481664d46ed_amd64",
                  "product_id": "quay/quay-container-security-operator-bundle@sha256:68e766235bdcd8f3335e2ab6e09942d98b183b3e498abb65acab6481664d46ed_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-container-security-operator-bundle@sha256:68e766235bdcd8f3335e2ab6e09942d98b183b3e498abb65acab6481664d46ed?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-bundle\u0026tag=v3.5.7-7"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "quay/quay-container-security-operator-rhel8@sha256:1ebb1f1ec3e413984cab04bd605afa4e1ae17375bfb7fc835c1272320900b42b_amd64",
                "product": {
                  "name": "quay/quay-container-security-operator-rhel8@sha256:1ebb1f1ec3e413984cab04bd605afa4e1ae17375bfb7fc835c1272320900b42b_amd64",
                  "product_id": "quay/quay-container-security-operator-rhel8@sha256:1ebb1f1ec3e413984cab04bd605afa4e1ae17375bfb7fc835c1272320900b42b_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-container-security-operator-rhel8@sha256:1ebb1f1ec3e413984cab04bd605afa4e1ae17375bfb7fc835c1272320900b42b?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-container-security-operator-rhel8\u0026tag=v3.5.7-8"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "quay/quay-operator-bundle@sha256:722cf3c05eb5663a737cb1385b971b6d1f0c8b2595d5ac425f7b100c25e2fd26_amd64",
                "product": {
                  "name": "quay/quay-operator-bundle@sha256:722cf3c05eb5663a737cb1385b971b6d1f0c8b2595d5ac425f7b100c25e2fd26_amd64",
                  "product_id": "quay/quay-operator-bundle@sha256:722cf3c05eb5663a737cb1385b971b6d1f0c8b2595d5ac425f7b100c25e2fd26_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-operator-bundle@sha256:722cf3c05eb5663a737cb1385b971b6d1f0c8b2595d5ac425f7b100c25e2fd26?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-operator-bundle\u0026tag=v3.5.7-6"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "quay/quay-operator-rhel8@sha256:bca072adf2d667291fbc11a466f8c3e07ba2ba50495038b54c75e2633986b839_amd64",
                "product": {
                  "name": "quay/quay-operator-rhel8@sha256:bca072adf2d667291fbc11a466f8c3e07ba2ba50495038b54c75e2633986b839_amd64",
                  "product_id": "quay/quay-operator-rhel8@sha256:bca072adf2d667291fbc11a466f8c3e07ba2ba50495038b54c75e2633986b839_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-operator-rhel8@sha256:bca072adf2d667291fbc11a466f8c3e07ba2ba50495038b54c75e2633986b839?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-operator-rhel8\u0026tag=v3.5.7-6"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "quay/quay-rhel8@sha256:dc4f2c32b41edf2ee79bb424ce0fbeaed7f53108e0c568b7e9808d8ce3ed36b3_amd64",
                "product": {
                  "name": "quay/quay-rhel8@sha256:dc4f2c32b41edf2ee79bb424ce0fbeaed7f53108e0c568b7e9808d8ce3ed36b3_amd64",
                  "product_id": "quay/quay-rhel8@sha256:dc4f2c32b41edf2ee79bb424ce0fbeaed7f53108e0c568b7e9808d8ce3ed36b3_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/quay-rhel8@sha256:dc4f2c32b41edf2ee79bb424ce0fbeaed7f53108e0c568b7e9808d8ce3ed36b3?arch=amd64\u0026repository_url=registry.redhat.io/quay/quay-rhel8\u0026tag=v3.5.7-8"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quay/clair-rhel8@sha256:bbfe6e82c9c01fb6f4d8c67e1af5a1e3e00486f902efc14a4e2fe22e5fcad65d_amd64 as a component of Quay v3",
          "product_id": "8Base-Quay-3:quay/clair-rhel8@sha256:bbfe6e82c9c01fb6f4d8c67e1af5a1e3e00486f902efc14a4e2fe22e5fcad65d_amd64"
        },
        "product_reference": "quay/clair-rhel8@sha256:bbfe6e82c9c01fb6f4d8c67e1af5a1e3e00486f902efc14a4e2fe22e5fcad65d_amd64",
        "relates_to_product_reference": "8Base-Quay-3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quay/quay-bridge-operator-bundle@sha256:6c2ab763239f6e5a2a72890120bf1f20f6277850cec59a7e11cea2b6a06f12e8_amd64 as a component of Quay v3",
          "product_id": "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:6c2ab763239f6e5a2a72890120bf1f20f6277850cec59a7e11cea2b6a06f12e8_amd64"
        },
        "product_reference": "quay/quay-bridge-operator-bundle@sha256:6c2ab763239f6e5a2a72890120bf1f20f6277850cec59a7e11cea2b6a06f12e8_amd64",
        "relates_to_product_reference": "8Base-Quay-3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quay/quay-bridge-operator-rhel8@sha256:ccd53fb4b31b792175cfece28ae0b6a9956090eb273e82998444fc6c7f312e20_amd64 as a component of Quay v3",
          "product_id": "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:ccd53fb4b31b792175cfece28ae0b6a9956090eb273e82998444fc6c7f312e20_amd64"
        },
        "product_reference": "quay/quay-bridge-operator-rhel8@sha256:ccd53fb4b31b792175cfece28ae0b6a9956090eb273e82998444fc6c7f312e20_amd64",
        "relates_to_product_reference": "8Base-Quay-3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quay/quay-builder-qemu-rhcos-rhel8@sha256:d0448bd89653695c1089dfcd12e2bcf4169ac732b1830c6c9cbb9909181778ed_amd64 as a component of Quay v3",
          "product_id": "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:d0448bd89653695c1089dfcd12e2bcf4169ac732b1830c6c9cbb9909181778ed_amd64"
        },
        "product_reference": "quay/quay-builder-qemu-rhcos-rhel8@sha256:d0448bd89653695c1089dfcd12e2bcf4169ac732b1830c6c9cbb9909181778ed_amd64",
        "relates_to_product_reference": "8Base-Quay-3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quay/quay-builder-rhel8@sha256:76b5e1deb371d2514f2feb59b750ded7e1f76f48b35a532ad806f921f4a4e722_amd64 as a component of Quay v3",
          "product_id": "8Base-Quay-3:quay/quay-builder-rhel8@sha256:76b5e1deb371d2514f2feb59b750ded7e1f76f48b35a532ad806f921f4a4e722_amd64"
        },
        "product_reference": "quay/quay-builder-rhel8@sha256:76b5e1deb371d2514f2feb59b750ded7e1f76f48b35a532ad806f921f4a4e722_amd64",
        "relates_to_product_reference": "8Base-Quay-3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quay/quay-container-security-operator-bundle@sha256:68e766235bdcd8f3335e2ab6e09942d98b183b3e498abb65acab6481664d46ed_amd64 as a component of Quay v3",
          "product_id": "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:68e766235bdcd8f3335e2ab6e09942d98b183b3e498abb65acab6481664d46ed_amd64"
        },
        "product_reference": "quay/quay-container-security-operator-bundle@sha256:68e766235bdcd8f3335e2ab6e09942d98b183b3e498abb65acab6481664d46ed_amd64",
        "relates_to_product_reference": "8Base-Quay-3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quay/quay-container-security-operator-rhel8@sha256:1ebb1f1ec3e413984cab04bd605afa4e1ae17375bfb7fc835c1272320900b42b_amd64 as a component of Quay v3",
          "product_id": "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:1ebb1f1ec3e413984cab04bd605afa4e1ae17375bfb7fc835c1272320900b42b_amd64"
        },
        "product_reference": "quay/quay-container-security-operator-rhel8@sha256:1ebb1f1ec3e413984cab04bd605afa4e1ae17375bfb7fc835c1272320900b42b_amd64",
        "relates_to_product_reference": "8Base-Quay-3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quay/quay-operator-bundle@sha256:722cf3c05eb5663a737cb1385b971b6d1f0c8b2595d5ac425f7b100c25e2fd26_amd64 as a component of Quay v3",
          "product_id": "8Base-Quay-3:quay/quay-operator-bundle@sha256:722cf3c05eb5663a737cb1385b971b6d1f0c8b2595d5ac425f7b100c25e2fd26_amd64"
        },
        "product_reference": "quay/quay-operator-bundle@sha256:722cf3c05eb5663a737cb1385b971b6d1f0c8b2595d5ac425f7b100c25e2fd26_amd64",
        "relates_to_product_reference": "8Base-Quay-3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quay/quay-operator-rhel8@sha256:bca072adf2d667291fbc11a466f8c3e07ba2ba50495038b54c75e2633986b839_amd64 as a component of Quay v3",
          "product_id": "8Base-Quay-3:quay/quay-operator-rhel8@sha256:bca072adf2d667291fbc11a466f8c3e07ba2ba50495038b54c75e2633986b839_amd64"
        },
        "product_reference": "quay/quay-operator-rhel8@sha256:bca072adf2d667291fbc11a466f8c3e07ba2ba50495038b54c75e2633986b839_amd64",
        "relates_to_product_reference": "8Base-Quay-3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "quay/quay-rhel8@sha256:dc4f2c32b41edf2ee79bb424ce0fbeaed7f53108e0c568b7e9808d8ce3ed36b3_amd64 as a component of Quay v3",
          "product_id": "8Base-Quay-3:quay/quay-rhel8@sha256:dc4f2c32b41edf2ee79bb424ce0fbeaed7f53108e0c568b7e9808d8ce3ed36b3_amd64"
        },
        "product_reference": "quay/quay-rhel8@sha256:dc4f2c32b41edf2ee79bb424ce0fbeaed7f53108e0c568b7e9808d8ce3ed36b3_amd64",
        "relates_to_product_reference": "8Base-Quay-3"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Yanir Tsarimi"
          ],
          "organization": "Orca Security"
        }
      ],
      "cve": "CVE-2021-3762",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "discovery_date": "2021-09-02T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:6c2ab763239f6e5a2a72890120bf1f20f6277850cec59a7e11cea2b6a06f12e8_amd64",
            "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:ccd53fb4b31b792175cfece28ae0b6a9956090eb273e82998444fc6c7f312e20_amd64",
            "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:d0448bd89653695c1089dfcd12e2bcf4169ac732b1830c6c9cbb9909181778ed_amd64",
            "8Base-Quay-3:quay/quay-builder-rhel8@sha256:76b5e1deb371d2514f2feb59b750ded7e1f76f48b35a532ad806f921f4a4e722_amd64",
            "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:68e766235bdcd8f3335e2ab6e09942d98b183b3e498abb65acab6481664d46ed_amd64",
            "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:1ebb1f1ec3e413984cab04bd605afa4e1ae17375bfb7fc835c1272320900b42b_amd64",
            "8Base-Quay-3:quay/quay-operator-bundle@sha256:722cf3c05eb5663a737cb1385b971b6d1f0c8b2595d5ac425f7b100c25e2fd26_amd64",
            "8Base-Quay-3:quay/quay-operator-rhel8@sha256:bca072adf2d667291fbc11a466f8c3e07ba2ba50495038b54c75e2633986b839_amd64",
            "8Base-Quay-3:quay/quay-rhel8@sha256:dc4f2c32b41edf2ee79bb424ce0fbeaed7f53108e0c568b7e9808d8ce3ed36b3_amd64"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2000795"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A directory traversal vulnerability was found in the ClairCore engine of Clair. An attacker can exploit this by supplying a crafted container image which, when scanned by Clair, allows for arbitrary file write on the filesystem, potentially allowing for remote code execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "quay/claircore: directory traversal when scanning crafted container image layer allows for arbitrary file write",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Only a single version of Red Hat Quay, 3.5.6 is affected by this vulnerability. All previous released versions of Red Hat Quay are not affected by this vulnerability.\n\nThe overall vulnerability is rated as Critical for the ClairCore engine, but only rated Important for the Red Hat Quay product. In Red Hat Quay, Clair runs as the \u0027nobody\u0027 user in an unprivileged container, limiting the impact to modification of non-sensitives files in that container.\n\nRed Hat Advanced Cluster Security is not affected by this vulnerability.\n\nQuay.io is not affected by this vulnerability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-Quay-3:quay/clair-rhel8@sha256:bbfe6e82c9c01fb6f4d8c67e1af5a1e3e00486f902efc14a4e2fe22e5fcad65d_amd64"
        ],
        "known_not_affected": [
          "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:6c2ab763239f6e5a2a72890120bf1f20f6277850cec59a7e11cea2b6a06f12e8_amd64",
          "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:ccd53fb4b31b792175cfece28ae0b6a9956090eb273e82998444fc6c7f312e20_amd64",
          "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:d0448bd89653695c1089dfcd12e2bcf4169ac732b1830c6c9cbb9909181778ed_amd64",
          "8Base-Quay-3:quay/quay-builder-rhel8@sha256:76b5e1deb371d2514f2feb59b750ded7e1f76f48b35a532ad806f921f4a4e722_amd64",
          "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:68e766235bdcd8f3335e2ab6e09942d98b183b3e498abb65acab6481664d46ed_amd64",
          "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:1ebb1f1ec3e413984cab04bd605afa4e1ae17375bfb7fc835c1272320900b42b_amd64",
          "8Base-Quay-3:quay/quay-operator-bundle@sha256:722cf3c05eb5663a737cb1385b971b6d1f0c8b2595d5ac425f7b100c25e2fd26_amd64",
          "8Base-Quay-3:quay/quay-operator-rhel8@sha256:bca072adf2d667291fbc11a466f8c3e07ba2ba50495038b54c75e2633986b839_amd64",
          "8Base-Quay-3:quay/quay-rhel8@sha256:dc4f2c32b41edf2ee79bb424ce0fbeaed7f53108e0c568b7e9808d8ce3ed36b3_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2021-3762"
        },
        {
          "category": "external",
          "summary": "RHBZ#2000795",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2000795"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2021-3762",
          "url": "https://www.cve.org/CVERecord?id=CVE-2021-3762"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-3762",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3762"
        }
      ],
      "release_date": "2021-09-28T12:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2021-09-28T21:19:17+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "8Base-Quay-3:quay/clair-rhel8@sha256:bbfe6e82c9c01fb6f4d8c67e1af5a1e3e00486f902efc14a4e2fe22e5fcad65d_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2021:3665"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "8Base-Quay-3:quay/clair-rhel8@sha256:bbfe6e82c9c01fb6f4d8c67e1af5a1e3e00486f902efc14a4e2fe22e5fcad65d_amd64",
            "8Base-Quay-3:quay/quay-bridge-operator-bundle@sha256:6c2ab763239f6e5a2a72890120bf1f20f6277850cec59a7e11cea2b6a06f12e8_amd64",
            "8Base-Quay-3:quay/quay-bridge-operator-rhel8@sha256:ccd53fb4b31b792175cfece28ae0b6a9956090eb273e82998444fc6c7f312e20_amd64",
            "8Base-Quay-3:quay/quay-builder-qemu-rhcos-rhel8@sha256:d0448bd89653695c1089dfcd12e2bcf4169ac732b1830c6c9cbb9909181778ed_amd64",
            "8Base-Quay-3:quay/quay-builder-rhel8@sha256:76b5e1deb371d2514f2feb59b750ded7e1f76f48b35a532ad806f921f4a4e722_amd64",
            "8Base-Quay-3:quay/quay-container-security-operator-bundle@sha256:68e766235bdcd8f3335e2ab6e09942d98b183b3e498abb65acab6481664d46ed_amd64",
            "8Base-Quay-3:quay/quay-container-security-operator-rhel8@sha256:1ebb1f1ec3e413984cab04bd605afa4e1ae17375bfb7fc835c1272320900b42b_amd64",
            "8Base-Quay-3:quay/quay-operator-bundle@sha256:722cf3c05eb5663a737cb1385b971b6d1f0c8b2595d5ac425f7b100c25e2fd26_amd64",
            "8Base-Quay-3:quay/quay-operator-rhel8@sha256:bca072adf2d667291fbc11a466f8c3e07ba2ba50495038b54c75e2633986b839_amd64",
            "8Base-Quay-3:quay/quay-rhel8@sha256:dc4f2c32b41edf2ee79bb424ce0fbeaed7f53108e0c568b7e9808d8ce3ed36b3_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "8Base-Quay-3:quay/clair-rhel8@sha256:bbfe6e82c9c01fb6f4d8c67e1af5a1e3e00486f902efc14a4e2fe22e5fcad65d_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "quay/claircore: directory traversal when scanning crafted container image layer allows for arbitrary file write"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.