vulnerability
Arch Linux: Directory traversal (CVE-2021-32760)
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 7 | (AV:N/AC:M/Au:N/C:P/I:P/A:P) | Jul 19, 2021 | Jul 11, 2025 | Nov 27, 2025 |
Severity
7
CVSS
(AV:N/AC:M/Au:N/C:P/I:P/A:P)
Published
Jul 19, 2021
Added
Jul 11, 2025
Modified
Nov 27, 2025
Description
A bug was found in containerd version prior to 1.5.4 where pulling and extracting a specially-crafted container image can result in Unix file permission changes for existing files in the host's filesystem. Changes to file permissions can deny access to the expected owner of the file, widen access to others, or set extended bits like setuid, setgid, and sticky. This bug does not directly allow files to be read, modified, or executed without an additional cooperating process.
Solution
arch-linux-upgrade-latest
References
- CVE-2021-32760
- https://attackerkb.com/topics/CVE-2021-32760
- URL-https://github.com/containerd/containerd/releases/tag/v1.4.8
- URL-https://github.com/containerd/containerd/releases/tag/v1.5.4
- URL-https://github.com/containerd/containerd/security/advisories/GHSA-c72p-9xmj-rx3w
- URL-https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DDMNDPJJTP3J5GOEDB66F6MGXUTRG3Y3/
- URL-https://security.archlinux.org/ASA-202107-70
- URL-https://security.gentoo.org/glsa/202401-31
- CWE-668
- CWE-732
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.