CVE-2021-40153
published 2021-08-27CVE-2021-40153: squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is then used by unsquashfs to create the new file…
PriorityP341high8.1CVSS 3.1
AVNACLPRNUIRSUCNIHAH
EPSS
2.50%
84.6th percentile
squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is then used by unsquashfs to create the new file during the unsquash. The filename is not validated for traversal outside of the destination directory, and thus allows writing to locations outside of the destination.
Affected
22 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | squashfs-tools | < squashfs-tools 1:4.5-2 (bookworm) | squashfs-tools 1:4.5-2 (bookworm) |
| debian | squashfs-tools | < squashfs-tools 1:4.5-3 (bookworm) | squashfs-tools 1:4.5-3 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| msrc | cbl2_squashfs-tools_4.5.1-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl_mariner_2.0_arm | — | — |
| msrc | cbl_mariner_2.0_x64 | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| squashfs-tools_project | squashfs-tools | — | — |
| squashfs-tools_project | squashfs-tools | >= 0 < 1:4.4-2+deb11u2 | 1:4.4-2+deb11u2 |
| squashfs-tools_project | squashfs-tools | >= 0 < 1:4.4-2+deb11u1 | 1:4.4-2+deb11u1 |
| squashfs-tools_project | squashfs-tools | >= 0 < 1:4.5-3 | 1:4.5-3 |
| squashfs-tools_project | squashfs-tools | >= 0 < 1:4.5-2 | 1:4.5-2 |
| squashfs-tools_project | squashfs-tools | >= 0 < 1:4.5-3 | 1:4.5-3 |
| squashfs-tools_project | squashfs-tools | >= 0 < 1:4.5-2 | 1:4.5-2 |
| squashfs-tools_project | squashfs-tools | >= 0 < 1:4.5-3 | 1:4.5-3 |
| squashfs-tools_project | squashfs-tools | >= 0 < 1:4.5-2 | 1:4.5-2 |
| squashfs-tools_project | squashfs-tools | >= 0 < 1:4.3-3ubuntu2.16.04.3+esm1 | 1:4.3-3ubuntu2.16.04.3+esm1 |
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
nvdv2.05.8MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:P
osv8.1HIGH
vendor_debian8.1HIGH
vendor_msrc8.1HIGH
vendor_redhat8.1HIGH
vendor_ubuntu8.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Squashfs-Tools vulnerabilities
vendor_ubuntu·2021-09-15·CVSS 8.1
CVE-2021-40153 [HIGH] Squashfs-Tools vulnerabilities
Title: Squashfs-Tools vulnerabilities
Summary: Squashfs-Tools could be made to overwrite files.
USN-5078-1 fixed several vulnerabilities in Squashfs-Tools.
This update provides the corresponding update for Ubuntu 16.04 ESM.
Original advisory details:
Etienne Stalmans discovered that Squashfs-Tools mishandled certain
malformed SQUASHFS files. An attacker could use this vulnerability
to write arbitrary files to the filesystem. (CVE-2021-40153)
Richard Weinberger discovered that Squashfs-Tools mishandled certain
malformed SQUASHFS files. An attacker could use this vulnerability to
write arbitrary files to the filesystem. (CVE-2021-41072)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
squashfs-tools: possible Directory Traversal via symbolic link
vendor_redhat·2021-09-14·CVSS 8.1
CVE-2021-41072 [HIGH] CWE-59 squashfs-tools: possible Directory Traversal via symbolic link
squashfs-tools: possible Directory Traversal via symbolic link
squashfs_opendir in unsquash-2.c in Squashfs-Tools 4.5 allows Directory Traversal, a different vulnerability than CVE-2021-40153. A squashfs filesystem that has been crafted to include a symbolic link and then contents under the same filename in a filesystem can cause unsquashfs to first create the symbolic link pointing outside the expected directory, and then the subsequent write operation will cause the unsquashfs process to write through the symbolic link elsewhere in the filesystem.
A directory traversal flaw was found in squashfs-tools. During extraction, a file can escape the destination directory by using a symbolic link, and a regular file with an identical name. This flaw allows a specially crafted squashfs archive
Microsoft
squashfs_opendir in unsquash-2.c in Squashfs-Tools 4.5 allows Directory Traversal a different vulnerability than CVE-2021-40153. A squashfs filesystem that has been crafted to include a symbolic link
vendor_msrc·2021-09-14·CVSS 8.1
CVE-2021-41072 [HIGH] CWE-22 squashfs_opendir in unsquash-2.c in Squashfs-Tools 4.5 allows Directory Traversal a different vulnerability than CVE-2021-40153. A squashfs filesystem that has been crafted to include a symbolic link
squashfs_opendir in unsquash-2.c in Squashfs-Tools 4.5 allows Directory Traversal a different vulnerability than CVE-2021-40153. A squashfs filesystem that has been crafted to include a symbolic link and then contents under the same filename in a filesystem can cause unsquashfs to first create the symbolic link pointing outside the expected directory and then the subsequent write operation will cause the unsquashfs process to write through the symbolic link elsewhere in the filesystem.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure v
Ubuntu
Squashfs-Tools vulnerability
vendor_ubuntu·2021-08-31
CVE-2021-40153 Squashfs-Tools vulnerability
Title: Squashfs-Tools vulnerability
Summary: squashfs-tools could be made to overwrite files.
Etienne Stalmans discovered that Squashfs-Tools mishandled certain malformed SQUASHFS files. An attacker could use this vulnerability to write arbitrary files to the filesystem.
Instructions: In general, a standard system update will make all the necessary changes.
Microsoft
squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is then used by unsquashfs to create the new file during the unsquash. The filename is not valid
vendor_msrc·2021-08-10·CVSS 8.1
CVE-2021-40153 [HIGH] CWE-22 squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is then used by unsquashfs to create the new file during the unsquash. The filename is not valid
squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is then used by unsquashfs to create the new file during the unsquash. The filename is not validated for traversal outside of the destination directory and thus allows writing to locations outside of the destination.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in O
Debian
CVE-2021-40153: squashfs-tools - squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in th...
vendor_debian·2021·CVSS 8.1
CVE-2021-40153 [HIGH] CVE-2021-40153: squashfs-tools - squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in th...
squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is then used by unsquashfs to create the new file during the unsquash. The filename is not validated for traversal outside of the destination directory, and thus allows writing to locations outside of the destination.
Scope: local
bookworm: resolved (fixed in 1:4.5-2)
bullseye: resolved (fixed in 1:4.4-2+deb11u1)
forky: resolved (fixed in 1:4.5-2)
sid: resolved (fixed in 1:4.5-2)
trixie: resolved (fixed in 1:4.5-2)
Debian
CVE-2021-41072: squashfs-tools - squashfs_opendir in unsquash-2.c in Squashfs-Tools 4.5 allows Directory Traversa...
vendor_debian·2021·CVSS 8.1
CVE-2021-41072 [HIGH] CVE-2021-41072: squashfs-tools - squashfs_opendir in unsquash-2.c in Squashfs-Tools 4.5 allows Directory Traversa...
squashfs_opendir in unsquash-2.c in Squashfs-Tools 4.5 allows Directory Traversal, a different vulnerability than CVE-2021-40153. A squashfs filesystem that has been crafted to include a symbolic link and then contents under the same filename in a filesystem can cause unsquashfs to first create the symbolic link pointing outside the expected directory, and then the subsequent write operation will cause the unsquashfs process to write through the symbolic link elsewhere in the filesystem.
Scope: local
bookworm: resolved (fixed in 1:4.5-3)
bullseye: resolved (fixed in 1:4.4-2+deb11u2)
forky: resolved (fixed in 1:4.5-3)
sid: resolved (fixed in 1:4.5-3)
trixie: resolved (fixed in 1:4.5-3)
Red Hat
squashfs-tools: unvalidated filepaths allow writing outside of destination
vendor_redhat·2019-09-10·CVSS 8.1
CVE-2021-40153 [HIGH] CWE-22 squashfs-tools: unvalidated filepaths allow writing outside of destination
squashfs-tools: unvalidated filepaths allow writing outside of destination
squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is then used by unsquashfs to create the new file during the unsquash. The filename is not validated for traversal outside of the destination directory, and thus allows writing to locations outside of the destination.
A flaw was found in Squashfs-tools, where it is vulnerable to attacks similar to zip-slip. During extraction, a file can escape the destination directory either via the '../' string to access the parent directory or via symlinks. This flaw allows a specially crafted squashfs archive to install or overwrite files outside of the destination directory.
Package: squashfs-tools (Red Hat Enterprise Linu
GHSA
GHSA-98f5-57cr-27p7: squashfs_opendir in unsquash-1
ghsa_unreviewed·2022-05-24
CVE-2021-40153 [CRITICAL] CWE-22 GHSA-98f5-57cr-27p7: squashfs_opendir in unsquash-1
squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is then used by unsquashfs to create the new file during the unsquash. The filename is not validated for traversal outside of the destination directory, and thus allows writing to locations outside of the destination.
GHSA
GHSA-f6m6-9fjw-69qm: squashfs_opendir in unsquash-2
ghsa_unreviewed·2022-05-24·CVSS 8.1
CVE-2021-41072 [HIGH] CWE-22 GHSA-f6m6-9fjw-69qm: squashfs_opendir in unsquash-2
squashfs_opendir in unsquash-2.c in Squashfs-Tools 4.5 allows Directory Traversal, a different vulnerability than CVE-2021-40153. A squashfs filesystem that has been crafted to include a symbolic link and then contents under the same filename in a filesystem can cause unsquashfs to first create the symbolic link pointing outside the expected directory, and then the subsequent write operation will cause the unsquashfs process to write through the symbolic link elsewhere in the filesystem.
OSV
squashfs-tools vulnerabilities
osv·2021-09-15·CVSS 8.1
CVE-2021-40153 [HIGH] squashfs-tools vulnerabilities
squashfs-tools vulnerabilities
USN-5078-1 fixed several vulnerabilities in Squashfs-Tools.
This update provides the corresponding update for Ubuntu 16.04 ESM.
Original advisory details:
Etienne Stalmans discovered that Squashfs-Tools mishandled certain
malformed SQUASHFS files. An attacker could use this vulnerability
to write arbitrary files to the filesystem. (CVE-2021-40153)
Richard Weinberger discovered that Squashfs-Tools mishandled certain
malformed SQUASHFS files. An attacker could use this vulnerability to
write arbitrary files to the filesystem. (CVE-2021-41072)
OSV
CVE-2021-41072: squashfs_opendir in unsquash-2
osv·2021-09-14·CVSS 8.1
CVE-2021-41072 [HIGH] CVE-2021-41072: squashfs_opendir in unsquash-2
squashfs_opendir in unsquash-2.c in Squashfs-Tools 4.5 allows Directory Traversal, a different vulnerability than CVE-2021-40153. A squashfs filesystem that has been crafted to include a symbolic link and then contents under the same filename in a filesystem can cause unsquashfs to first create the symbolic link pointing outside the expected directory, and then the subsequent write operation will cause the unsquashfs process to write through the symbolic link elsewhere in the filesystem.
OSV
CVE-2021-40153: squashfs_opendir in unsquash-1
osv·2021-08-27·CVSS 8.1
CVE-2021-40153 [HIGH] CVE-2021-40153: squashfs_opendir in unsquash-1
squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename in the directory entry; this is then used by unsquashfs to create the new file during the unsquash. The filename is not validated for traversal outside of the destination directory, and thus allows writing to locations outside of the destination.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://bugs.launchpad.net/ubuntu/+source/squashfs-tools/+bug/1941790https://github.com/plougher/squashfs-tools/commit/79b5a555058eef4e1e7ff220c344d39f8cd09646https://github.com/plougher/squashfs-tools/issues/72https://lists.debian.org/debian-lts-announce/2021/08/msg00030.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GSMRKVJMJFX3MB7D3PXJSYY3TLZROE5S/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RAOZ4BKWAC4Y3U2K5MMW3S77HWWXHQDL/https://security.gentoo.org/glsa/202305-29https://www.debian.org/security/2021/dsa-4967https://bugs.launchpad.net/ubuntu/+source/squashfs-tools/+bug/1941790https://github.com/plougher/squashfs-tools/commit/79b5a555058eef4e1e7ff220c344d39f8cd09646https://github.com/plougher/squashfs-tools/issues/72https://lists.debian.org/debian-lts-announce/2021/08/msg00030.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GSMRKVJMJFX3MB7D3PXJSYY3TLZROE5S/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RAOZ4BKWAC4Y3U2K5MMW3S77HWWXHQDL/https://security.gentoo.org/glsa/202305-29https://www.debian.org/security/2021/dsa-4967
2021-08-27
Published