CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2021-3762
Critical (9.8) in redhat. EPSS 4.8% chance of exploitation in the next 30 days. Fixed in github.com/quay/claircore 0.4.8, 0.5.5, 1.1.0.
A directory traversal vulnerability was found in the ClairCore engine of Clair. An attacker can exploit this by supplying a crafted container image which, when scanned by Clair, allows for arbitrary file write on the filesystem, potentially allowing for remote code execution.
Severity
- EPSS
- 4.8% chance of exploitation in the next 30 days; higher than 91% of CVEs (scores of 2026-10-31)
- CWE
- CWE-22
- Published
- Modified
- Record from
- the NVD, synced
Affected
- redhat:clair
- redhat:quay
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-mq47-6wwv-v79w | Go | github.com/quay/claircore | <0.4.8 | 0.4.8 |
| GHSA-mq47-6wwv-v79w | Go | github.com/quay/claircore | >=1.0.0 <1.1.0 | 1.1.0 |
| GHSA-mq47-6wwv-v79w | Go | github.com/quay/claircore | >=0.5.0 <0.5.5 | 0.5.5 |
| GO-2022-0346 | Go | github.com/quay/claircore | <1.1.0 | 1.1.0 |