2 lines
2.0 KiB
JSON
2 lines
2.0 KiB
JSON
{"affected":[{"affectedData":[{"collectionURL":"https://atomgit.com/src-openeuler/iSulad","defaultStatus":"affected","packageName":"iSulad","platforms":["Linux"],"product":"iSulad","programFiles":["src/daemon/modules/image/oci/oci_load.c"],"repo":"https://atomgit.com/openeuler/iSulad","vendor":"openEuler","versions":[{"lessThanOrEqual":"2.1.6","status":"affected","version":"0","versionType":"rpm"}]}],"source":"securities@openeuler.org"}],"cveTags":[],"descriptions":[{"lang":"en","value":"Relative path traversal vulnerability in openEuler iSulad on Linux.\n\nThis vulnerability is associated with program file src/daemon/modules/image/oci/oci_load.c.\n\n\n\nThis issue affects iSulad: through 2.1.6.\n\n\n\nIn oci_load.c, oci_load_process_manifest() does not sanitize the Config path of manifest.json. A malicious tar package can enable the isulad with the root permission to read any file on the host."}],"id":"CVE-2026-111435","lastModified":"2026-11-12T10:17:27.797","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":7.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"NONE","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N","version":"3.1"},"exploitabilityScore":2.8,"impactScore":4.0,"source":"securities@openeuler.org","type":"Secondary"}]},"published":"2026-11-12T04:17:17.483","references":[{"source":"securities@openeuler.org","url":"https://atomgit.com/openeuler/iSulad/commit/370889a81f1e7381de68ad7ded88b3439e266af5?ref=master&prId=2646"},{"source":"securities@openeuler.org","url":"https://atomgit.com/src-openeuler/iSulad/pull/812"},{"source":"securities@openeuler.org","url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-4865"}],"sourceIdentifier":"securities@openeuler.org","vulnStatus":"Received","weaknesses":[{"description":[{"lang":"en","value":"CWE-23"}],"source":"securities@openeuler.org","type":"Secondary"}]}
|