CVE-2021-41072

Katalog CVE

CVSS 8.1 · High EPSS 2,3%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') pada squashfs-tools project squashfs-tools, debian linux. Skor CVSS 3.1 8.1 (High) menurut NVD.

Deskripsi (NVD)

squashfs_opendir in unsquash-2.c in Squashfs-Tools 4.5 allows Directory Traversal, a different vulnerability than CVE-2021-40153. A squashfs filesystem that has been crafted to include a symbolic link and then contents under the same filename in a filesystem can cause unsquashfs to first create the symbolic link pointing outside the expected directory, and then the subsequent write operation will cause the unsquashfs process to write through the symbolic link elsewhere in the filesystem.

Rincian

Terbit di NVD

14 September 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.1 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-59: Improper Link Resolution Before File Access ('Link Following')

EPSS (30 hari)

2,3% peluang dieksploitasi; lebih tinggi dari 82,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/plougher/squashfs-tools/commit/e0485802ec72996c20026da320650d8362f555bd patch · advisory pihak ketiga
• https://github.com/plougher/squashfs-tools/issues/72#issuecomment-913833405 exploit · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2021/10/msg00017.html mailing list · advisory pihak ketiga
• https://www.debian.org/security/2021/dsa-4987 advisory pihak ketiga
• https://security.gentoo.org/glsa/202305-29