CVE-2021-29136: Improper input validation in umoci
Summary
CVE-2021-29136: Improper input validation in umoci. Affects github.com/opencontainers/umoci versions < 0.4.7. Fixed in 0.4.7. How to fix ↓
Also tracked for
- umoci · Debian:11
The same CVE-2021-29136 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is umoci, a tool for manipulating Open Container Initiative (OCI) images. It allows users to unpack and manipulate container images. Umoci versions 0.4.6 and earlier are vulnerable to an improper input validation issue.
Vulnerability Detail
The vulnerability in umoci arises from improper input validation. An attacker can exploit this vulnerability by creating a malicious layer with a symlink named "." or "/". When umoci processes this layer, it deletes inodes if they change types. As a result, the rootfs directory is replaced with an attacker-controlled symlink. Subsequent image layers are then applied on top of the target of the symlink, which could be any directory accessible to the user running umoci. While umoci has defenses against symlink-based attacks, they are all implemented relative to the rootfs directory. If the rootfs itself is a symlink, umoci resolves it first. This vulnerability affects both "umoci unpack" and "umoci raw unpack".
How To Fix
Latest published version: v0.6.0 as of 23 Oct 2026
go get github.com/opencontainers/umoci@v0.6.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.4.7
This is the first release that contains the fix.
go get github.com/opencontainers/umoci@v0.4.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If umoci is used as an unprivileged user with the --rootless flag, it will not be able to overwrite files that the user does not have access to. Another possible mitigation is to run umoci under an LSM (Linux Security Module) profile such as AppArmor or SELinux to restrict its access outside of container image directories.
Conclusion
Umoci versions 0.4.6 and earlier are vulnerable to an improper input validation issue that can be exploited by creating a malicious layer with a symlink. This can lead to the replacement of the rootfs directory with an attacker-controlled symlink, allowing subsequent image layers to be applied on top of an arbitrary directory accessible to the user running umoci. Users are advised to update to umoci version 0.4.7 to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/opencontainers/umoci →
FAQ
Umoci is a tool for manipulating Open Container Initiative (OCI) images.
Umoci versions 0.4.6 and earlier are affected.
An attacker can exploit this vulnerability by creating a malicious layer with a symlink named "." or "/".
Running umoci as an unprivileged user with the --rootless flag can limit its ability to overwrite files. Additionally, using an LSM profile such as AppArmor or SELinux can further restrict umoci's access outside of container image directories.
Yes, this vulnerability has been patched in umoci version 0.4.7.
