VulnerabilityModified
CVE-2021-40153
The filename is not validated for traversal outside of the destination directory, and thus allows writing to locations outside of the destination.
HIGH 8.1EPSS 2.50%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (2.50%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is then used by unsquashfs to create the new file during the unsquash. The filename is not validated for traversal outside of the destination directory, and thus allows writing to locations outside of the destination.
- CVSS 3.1
- 8.1 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
- EPSS
- 2.50% probability · 84th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-22
- Affected
- squashfs-tools project/squashfs-tools · fedoraproject/fedora · debian/debian linux · redhat/enterprise linux
- Source
- cve@mitre.org
References
- https://bugs.launchpad.net/ubuntu/+source/squashfs-tools/+bug/1941790Third Party Advisory
- https://github.com/plougher/squashfs-tools/commit/79b5a555058eef4e1e7ff220c344d39f8cd09646Patch, Third Party Advisory
- https://github.com/plougher/squashfs-tools/issues/72Exploit, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2021/08/msg00030.htmlMailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GSMRKVJMJFX3MB7D3PXJSYY3TLZROE5S/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RAOZ4BKWAC4Y3U2K5MMW3S77HWWXHQDL/
- https://security.gentoo.org/glsa/202305-29
- https://www.debian.org/security/2021/dsa-4967Third Party Advisory
- https://bugs.launchpad.net/ubuntu/+source/squashfs-tools/+bug/1941790Third Party Advisory
- https://github.com/plougher/squashfs-tools/commit/79b5a555058eef4e1e7ff220c344d39f8cd09646Patch, Third Party Advisory
- https://github.com/plougher/squashfs-tools/issues/72Exploit, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2021/08/msg00030.htmlMailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GSMRKVJMJFX3MB7D3PXJSYY3TLZROE5S/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RAOZ4BKWAC4Y3U2K5MMW3S77HWWXHQDL/
- https://security.gentoo.org/glsa/202305-29
- https://www.debian.org/security/2021/dsa-4967Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.