github.com/quay/claircore@v1.5.28/rhel/rhcc/testdata/cve-2021-3762.xml

<?xml version="1.0" encoding="utf-8"?>
<cvemap updated="2021-11-16T19:11:00" license="CC BY 4.0, https://creativecommons.org/licenses/by/4.0/">

<Vulnerability name="CVE-1999-0002">
    <Details source="Mitre" xml:lang="en:us">
Buffer overflow in NFS mountd gives root access to remote attackers, mostly in Linux systems.
    </Details>
    <Statement xml:lang="en:us">
This issue has been addressed in nfs-server packages as shipped in Red Hat Linux since version nfs-server-2.2beta37.
    </Statement>
</Vulnerability>

<Vulnerability name="CVE-2004-0976">
    <ThreatSeverity>Low</ThreatSeverity>
    <PublicDate>2004-09-30T00:00:00</PublicDate>
    <Bugzilla id="1617339" url="https://bugzilla.redhat.com/show_bug.cgi?id=1617339" xml:lang="en:us">
CVE-2004-0976 security flaw
    </Bugzilla>
    <Details source="Mitre" xml:lang="en:us">
Multiple scripts in the perl package in Trustix Secure Linux 1.5 through 2.1 and other operating systems allows local users to overwrite files via a symlink attack on temporary files.
    </Details>
    <Statement xml:lang="en:us">
Red Hat is aware of this issue and is tracking it via the following bug:
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=140058

The Red Hat Security Response Team has rated this issue as having low security impact, a future update may address this flaw.  More information regarding issue severity can be found here:
http://www.redhat.com/security/updates/classification/

Red Hat Enterprise Linux 5 is not vulnerable to this issue as it contains a backported patch.
    </Statement>
    <AffectedRelease cpe="cpe:/o:redhat:enterprise_linux:3">
        <ProductName>Red Hat Enterprise Linux 3</ProductName>
        <ReleaseDate>2005-12-20T00:00:00</ReleaseDate>
        <Advisory type="RHSA" url="https://access.redhat.com/errata/RHSA-2005:881">RHSA-2005:881</Advisory>
        <Package name="perl">perl-2:5.8.0-90.4</Package>
    </AffectedRelease>
</Vulnerability>

<Vulnerability name="CVE-2013-1690">
    <ThreatSeverity>Critical</ThreatSeverity>
    <PublicDate>2013-06-25T00:00:00</PublicDate>
    <Bugzilla id="977602" url="https://bugzilla.redhat.com/show_bug.cgi?id=977602" xml:lang="en:us">
CVE-2013-1690 Mozilla: Execution of unmapped memory through onreadystatechange event (MFSA 2013-53)
    </Bugzilla>
    <CVSS status="verified">
        <CVSSBaseScore>6.8</CVSSBaseScore>
        <CVSSScoringVector>AV:N/AC:M/Au:N/C:P/I:P/A:P</CVSSScoringVector>
    </CVSS>
    <Details source="Mitre" xml:lang="en:us">
Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not properly handle onreadystatechange events in conjunction with page reloading, which allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted web site that triggers an attempt to execute data at an unmapped memory location.
    </Details>
    <AffectedRelease cpe="cpe:/o:redhat:enterprise_linux:5">
        <ProductName>Red Hat Enterprise Linux 5</ProductName>
        <ReleaseDate>2013-06-25T00:00:00</ReleaseDate>
        <Advisory type="RHSA" url="https://access.redhat.com/errata/RHSA-2013:0981">RHSA-2013:0981</Advisory>
        <Package name="firefox">firefox-0:17.0.7-1.el5_9</Package>
    </AffectedRelease>
    <AffectedRelease cpe="cpe:/o:redhat:enterprise_linux:5">
        <ProductName>Red Hat Enterprise Linux 5</ProductName>
        <ReleaseDate>2013-06-25T00:00:00</ReleaseDate>
        <Advisory type="RHSA" url="https://access.redhat.com/errata/RHSA-2013:0981">RHSA-2013:0981</Advisory>
        <Package name="xulrunner">xulrunner-0:17.0.7-1.el5_9</Package>
    </AffectedRelease>
    <AffectedRelease cpe="cpe:/o:redhat:enterprise_linux:5">
        <ProductName>Red Hat Enterprise Linux 5</ProductName>
        <ReleaseDate>2013-06-25T00:00:00</ReleaseDate>
        <Advisory type="RHSA" url="https://access.redhat.com/errata/RHSA-2013:0982">RHSA-2013:0982</Advisory>
        <Package name="thunderbird">thunderbird-0:17.0.7-1.el5_9</Package>
    </AffectedRelease>
    <AffectedRelease cpe="cpe:/o:redhat:enterprise_linux:6">
        <ProductName>Red Hat Enterprise Linux 6</ProductName>
        <ReleaseDate>2013-06-25T00:00:00</ReleaseDate>
        <Advisory type="RHSA" url="https://access.redhat.com/errata/RHSA-2013:0981">RHSA-2013:0981</Advisory>
        <Package name="firefox">firefox-0:17.0.7-1.el6_4</Package>
    </AffectedRelease>
    <AffectedRelease cpe="cpe:/o:redhat:enterprise_linux:6">
        <ProductName>Red Hat Enterprise Linux 6</ProductName>
        <ReleaseDate>2013-06-25T00:00:00</ReleaseDate>
        <Advisory type="RHSA" url="https://access.redhat.com/errata/RHSA-2013:0981">RHSA-2013:0981</Advisory>
        <Package name="xulrunner">xulrunner-0:17.0.7-1.el6_4</Package>
    </AffectedRelease>
    <AffectedRelease cpe="cpe:/o:redhat:enterprise_linux:6">
        <ProductName>Red Hat Enterprise Linux 6</ProductName>
        <ReleaseDate>2013-06-25T00:00:00</ReleaseDate>
        <Advisory type="RHSA" url="https://access.redhat.com/errata/RHSA-2013:0982">RHSA-2013:0982</Advisory>
        <Package name="thunderbird">thunderbird-0:17.0.7-1.el6_4</Package>
    </AffectedRelease>
    <References xml:lang="en:us">
http://www.mozilla.org/security/announce/2013/mfsa2013-53.html
    </References>
</Vulnerability>



<Vulnerability name="CVE-2021-3762">
    <ThreatSeverity>Critical</ThreatSeverity>
    <PublicDate>2021-09-28T12:00:00</PublicDate>
    <Bugzilla id="2000795" url="https://bugzilla.redhat.com/show_bug.cgi?id=2000795" xml:lang="en:us">
CVE-2021-3762 quay/claircore: directory traversal when scanning crafted container image layer allows for arbitrary file write
    </Bugzilla>
    <CVSS3 status="verified">
        <CVSS3BaseScore>9.8</CVSS3BaseScore>
        <CVSS3ScoringVector>CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H</CVSS3ScoringVector>
    </CVSS3>
    <CWE>CWE-22</CWE>
    <Details source="Red Hat" xml:lang="en:us">
A directory traversal vulnerability was found in the ClairCore engine of Clair. An attacker can exploit this by supplying a crafted container image which, when scanned by Clair, allows for arbitrary file write on the filesystem, potentially allowing for remote code execution.
    </Details>
    <Statement xml:lang="en:us">
Only a single version of Red Hat Quay, 3.5.6 is affected by this vulnerability. All previous released versions of Red Hat Quay are not affected by this vulnerability.

The overall vulnerability is rated as Critical for the ClairCore engine, but only rated Important for the Red Hat Quay product. In Red Hat Quay, Clair runs as the 'nobody' user in an unprivileged container, limiting the impact to modification of non-sensitives files in that container.

Red Hat Advanced Cluster Security is not affected by this vulnerability.

Quay.io is not affected by this vulnerability.
    </Statement>
    <Acknowledgement xml:lang="en:us">
Red Hat would like to thank Yanir Tsarimi (Orca Security) for reporting this issue.
    </Acknowledgement>
    <Mitigation xml:lang="en:us">
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    </Mitigation>
    <AffectedRelease cpe="cpe:/a:redhat:quay:3" impact="important">
        <ProductName>Red Hat Quay 3</ProductName>
        <ReleaseDate>2021-09-28T00:00:00</ReleaseDate>
        <Advisory type="RHSA" url="https://access.redhat.com/errata/RHSA-2021:3665">RHSA-2021:3665</Advisory>
        <Package name="quay/clair-rhel8">quay/clair-rhel8:v3.5.7-8</Package>
    </AffectedRelease>
    <UpstreamFix>quay/claircore 0.5.5, quay/claircore 0.4.8</UpstreamFix>
</Vulnerability>

</cvemap>