VulnerableCode Package Details - pkg:rpm/redhat/openshift-enterprise-builder-container@4.8.0-202107152024.p0.git.70b7b95.assembly?arch=stream

Search for packages

Vulnerability	Summary	Fixed by
VCID-hscf-fc4z-aaaj Aliases: CVE-2021-3121 GHSA-c3h9-896r-86jm	An issue was discovered in GoGo Protobuf before 1.3.2. plugin/unmarshal/unmarshal.go lacks certain index validation, aka the "skippy peanut butter" issue.	There are no reported fixed by versions.
VCID-pt4c-1gws-aaar Aliases: CVE-2021-20206 GHSA-xjqr-g762-pxwp	An improper limitation of path name flaw was found in containernetworking/cni in versions before 0.8.1. When specifying the plugin to load in the 'type' field in the network configuration, it is possible to use special elements such as "../" separators to reference binaries elsewhere on the system. This flaw allows an attacker to execute other existing binaries other than the cni plugins/types, such as 'reboot'. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.	There are no reported fixed by versions.
VCID-xm6z-ve9f-aaae Aliases: CVE-2021-20291 GHSA-7qw8-847f-pggm	A deadlock vulnerability was found in 'github.com/containers/storage' in versions before 1.28.1. When a container image is processed, each layer is unpacked using `tar`. If one of those layers is not a valid `tar` archive this causes an error leading to an unexpected situation where the code indefinitely waits for the tar unpacked stream, which never finishes. An attacker could use this vulnerability to craft a malicious image, which when downloaded and stored by an application using containers/storage, would then cause a deadlock leading to a Denial of Service (DoS).	There are no reported fixed by versions.

Vulnerability

Summary

Fixed by

VCID-hscf-fc4z-aaaj
Aliases:
CVE-2021-3121
GHSA-c3h9-896r-86jm

An issue was discovered in GoGo Protobuf before 1.3.2. plugin/unmarshal/unmarshal.go lacks certain index validation, aka the "skippy peanut butter" issue.

There are no reported fixed by versions.

VCID-pt4c-1gws-aaar
Aliases:
CVE-2021-20206
GHSA-xjqr-g762-pxwp

An improper limitation of path name flaw was found in containernetworking/cni in versions before 0.8.1. When specifying the plugin to load in the 'type' field in the network configuration, it is possible to use special elements such as "../" separators to reference binaries elsewhere on the system. This flaw allows an attacker to execute other existing binaries other than the cni plugins/types, such as 'reboot'. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

There are no reported fixed by versions.

VCID-xm6z-ve9f-aaae
Aliases:
CVE-2021-20291
GHSA-7qw8-847f-pggm

A deadlock vulnerability was found in 'github.com/containers/storage' in versions before 1.28.1. When a container image is processed, each layer is unpacked using `tar`. If one of those layers is not a valid `tar` archive this causes an error leading to an unexpected situation where the code indefinitely waits for the tar unpacked stream, which never finishes. An attacker could use this vulnerability to craft a malicious image, which when downloaded and stored by an application using containers/storage, would then cause a deadlock leading to a Denial of Service (DoS).

There are no reported fixed by versions.

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Vulnerability

Summary

Aliases

This package is not known to fix vulnerabilities.

Next non-vulnerable version	None.
Latest non-vulnerable version	None.
Risk	4.0