PT-2021-4277 · Dino+1 · Dino+1

Cturt · Published 2021-06-07 · Updated 2021-08-14 · CVE-2021-33896

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Dino versions 0.1.2 and earlier Dino versions 0.2.x before 0.2.1

Description The issue is related to an error with URI-encoded path separators, allowing for Directory Traversal, but only for the creation of new files. This could potentially allow a remote attacker to impact data integrity.

Recommendations For Dino versions 0.1.2 and earlier, update to version 0.1.2 or later. For Dino versions 0.2.x before 0.2.1, update to version 0.2.1 or later. As a temporary workaround, consider restricting the use of URI-encoded path separators until a patch is available.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

ALT-PU-2021-1945

BDU:2021-04885

CVE-2021-33896

MGASA-2021-0401

Affected Products

Alt Linux

Dino

References · 22

• https://cve.org/CVERecord?id=CVE-2021-33896 · Security Note
• https://ubuntu.com/security/CVE-2021-33896 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ODN4ZSTBYIW25DO3FNRK6FQRGSYGT57I · Vendor Advisory
• https://dino.im/blog · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-33896 · Security Note
• http://openwall.com/lists/oss-security/2021/06/07/2 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-33896 · Vendor Advisory
• https://dino.im/security/cve-2021-33896 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/P55V3TVSVXREOJAJRXNUSBEUZFOU54V3 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2021-0401.html · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-33896 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2021-0401 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/P55V3TVSVXREOJAJRXNUSBEUZFOU54V3 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-33896 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-04885 · Security Note