Path Traversal in Linuxfoundation Spinnaker
CVE-2021-39143
Spinnaker is an open source, multi-cloud continuous delivery platform. A path traversal vulnerability was discovered in uses of TAR files by AppEngine for deployments. This uses a utility to extract files locally for deployment without validating the paths in that deployment don't override system files. This would allow an attacker to override files on the container, POTENTIALLY introducing a MITM type attack vector by replacing libraries or injecting wrapper files. Users are advised to update as soon as possible. For users unable to update disable Google AppEngine deployments and/or disable artifacts that provide TARs.
Vulnerability class: Path Traversal (Directory Traversal)
EPSS: 0.003 (27.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.6 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H.
Affected products
- Linuxfoundation Spinnaker
- Spinnaker — versions >= 1.26.0, < 1.26.7, >= 1.25.0, < 1.25.7, < 1.24.7
Weakness classification (CWE)
References
- security-advisories@github.com (Technical Description, x_refsource_CONFIRM, Exploit, Third Party Advisory)
Frequently asked questions
- What is CVE-2021-39143?
- CVE-2021-39143 is a medium-severity vulnerability in Linuxfoundation Spinnaker, classified under Path Traversal. CVSS score: 6.6/10. Published 2022-01-04.
- How severe is CVE-2021-39143?
- Medium severity. CVSS v3 base score is 6.6 out of 10.