Improper limitation of path name in github.com/containernetworking/cni
Overview
Source
ID
GO-2022-0230
Aliases
CVE-2021-20206
GHSA-xjqr-g762-pxwp
Affected package
Description
The FindInPath function is vulnerable to directory traversal attacks, potentially permitting attackers to execute arbitrary binaries.
This function does not sanitize its plugin parameter, so parameter names containing "../" or other such elements may reference arbitrary locations on the filesystem.
Summary
651
Total packages affected
help_outline
Packages with at least one version that is affected by the advisory or has an affected dependency.
247
Packages with a known fix
help_outline
Packages with versions affected by the advisory that have a greater version that is not affected.
0.05%
Total ecosystem affected
help_outline
The proportion of packages in the ecosystem that are affected by the advisory (fixed or not).
Affected Version: Introduced: 0, Fixed: 0.8.1
Patched/Unaffected
Affected