PT-2021-14379 · Oras+1 · Oras+1

Jdolitsky · Published 2021-01-25 · Updated 2025-11-28 · CVE-2021-21272

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: ORAS versions 0.4.0 through 0.9.0

Description: The issue is related to a "zip-slip" vulnerability in the directory support feature of ORAS, which allows downloaded gzipped tarballs to be automatically extracted to a user-specified directory. This directory can contain symbolic links and hard links, allowing a well-crafted tarball to link, write, or overwrite specific files on the host filesystem outside of the user-specified directory with the same permissions as the user who runs oras pull. The affected users are oras CLI users who run oras pull and Go programs that invoke github.com/deislabs/oras/pkg/content.FileStore.

Recommendations: For oras CLI users, there is no workaround other than pulling from a trusted artifact provider. For oras package users, the workaround is to not use github.com/deislabs/oras/pkg/content.FileStore, and use other content stores instead, or pull from a trusted artifact provider. Users should upgrade their oras CLI and packages to version 0.9.0 to resolve the issue.

Fix

Path traversal

Link Following

Weakness Enumeration

CWE-22

CWE-59

Related Identifiers

BIT-ORAS-2021-21272

CVE-2021-21272

GHSA-G5V4-5X39-VWHX

GO-2021-0099

OPENSUSE-SU-2022_4606-1

OPENSUSE-SU-2024:12345-1

OPENSUSE-SU-2025:15779-1

SUSE-SU-2022:4606-1

SUSE-SU-2022_4606-1

Affected Products

Oras

Suse

References · 42

• https://github.com/deislabs/oras/commit/96cd90423303f1bb42bd043cb4c36085e6e91e8e · Patch
• https://github.com/deislabs/oras/security/advisories/GHSA-g5v4-5x39-vwhx · Vendor Advisory
• https://osv.dev/vulnerability/BIT-oras-2021-21272 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2021-0099 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15779-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21272 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:12345-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-g5v4-5x39-vwhx · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-21272 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:4606-1 · Vendor Advisory
• https://github.com/deislabs/oras/releases/tag/v0.9.0 · Note
• https://github.com/deislabs/oras · Note
• https://t.me/cvenotify/72132 · Telegram Post
• https://suse.com/security/cve/CVE-2025-58190 · Note
• https://bugzilla.suse.com/1206469 · Note