CVE-2021-20206 – containernetworking-cni: Arbitrary path injection via type field in CNI configuration

https://notcve.org/view.php?id=CVE-2021-20206

An improper limitation of path name flaw was found in containernetworking/cni in versions before 0.8.1. When specifying the plugin to load in the 'type' field in the network configuration, it is possible to use special elements such as "../" separators to reference binaries elsewhere on the system. This flaw allows an attacker to execute other existing binaries other than the cni plugins/types, such as 'reboot'. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability. Se detectó una limitación inapropiada del fallo en el nombre de la ruta en containernetworking/cni en versiones anteriores a 0.8.1. • https://bugzilla.redhat.com/show_bug.cgi?id=1919391 https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMCONTAINERNETWORKINGCNIPKGINVOKE-1070549 https://access.redhat.com/security/cve/CVE-2021-20206 • CWE-20: Improper Input Validation CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •