Oras · Oras · CVE-2021-21272
Name of the Vulnerable Software and Affected Versions:
ORAS versions 0.4.0 through 0.9.0
Description:
The issue is related to a "zip-slip" vulnerability in the directory support feature of ORAS, which allows downloaded gzipped tarballs to be automatically extracted to a user-specified directory. This directory can contain symbolic links and hard links, allowing a well-crafted tarball to link, write, or overwrite specific files on the host filesystem outside of the user-specified directory with the same permissions as the user who runs `oras pull`. The affected users are `oras` CLI users who run `oras pull` and Go programs that invoke `github.com/deislabs/oras/pkg/content.FileStore`.
Recommendations:
For `oras` CLI users, there is no workaround other than pulling from a trusted artifact provider.
For `oras` package users, the workaround is to not use `github.com/deislabs/oras/pkg/content.FileStore`, and use other content stores instead, or pull from a trusted artifact provider.
Users should upgrade their `oras` CLI and packages to version 0.9.0 to resolve the issue.