CVE-2021-20206: containernetworking/cni Improper Limitation of Path Name
Summary
CVE-2021-20206: Improper limitation of path name in github.com/containernetworking/cni. Affects github.com/containernetworking/cni versions < 0.8.1. Fixed in 0.8.1. How to fix ↓
Also tracked for
- golang-github-appc-cni · Debian:11
The same CVE-2021-20206 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The containernetworking/cni package is a Go package that provides networking support for containers. It is commonly used in container orchestration platforms like Kubernetes. The package allows users to specify network configurations for containers, including the plugin to load. However, versions before 0.8.1 have a vulnerability that allows an attacker to execute arbitrary binaries on the system by using special elements in the 'type' field of the network configuration. This can lead to confidentiality, integrity, and availability issues.
Vulnerability Detail
The vulnerability in containernetworking/cni arises from an improper limitation of path name. By using special elements like "../" separators in the 'type' field of the network configuration, an attacker can reference binaries elsewhere on the system. This allows them to execute existing binaries other than the cni plugins/types, such as 'reboot'. The impact of this vulnerability is significant, as it can compromise the confidentiality, integrity, and availability of the system.
How To Fix
Minimum fixed version
0.8.1
This is the first release that contains the fix.
go get github.com/containernetworking/cni@v0.8.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version of the containernetworking/cni package as soon as possible.
Conclusion
The containernetworking/cni package has a vulnerability that allows an attacker to execute arbitrary binaries on the system. To mitigate this vulnerability, it is recommended to upgrade to version 0.8.1 or later of the package. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for github.com/containernetworking/cni →
FAQ
containernetworking/cni is a Go package that provides networking support for containers, commonly used in container orchestration platforms like Kubernetes.
This vulnerability allows an attacker to execute arbitrary binaries on the system, compromising confidentiality, integrity, and availability.
To fix this vulnerability, upgrade to version 0.8.1 or later of the containernetworking/cni package.
There is no known workaround for this vulnerability. It is recommended to upgrade to the fixed version of the package.
You can find more information about this vulnerability in the CVE-2021-20206 advisory.
