CVE-2021-29133 Path traversal in n/a
Local attackers can read arbitrary files on the filesystem due to missing verification in haserl, affecting Alpine Linux systems.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-29133?
CVE-2021-29133 is a medium-severity path traversal vulnerability in n/a, published on 24 Mar 2021. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Lack of verification in haserl, a component of Alpine Linux Configuration Framework, before 0.9.36 allows local users to read the contents of any file on the filesystem.
Which versions are affected by CVE-2021-29133?
It affects 1 product.
Linux distribution packages (6)
haserl SUSE:Package Hub 15 SP1 | All versions | 0.9.36-bp153.2.3.1 |
haserl SUSE:Package Hub 15 SP2 | All versions | 0.9.36-bp153.2.3.1 |
haserl SUSE:Package Hub 15 SP3 | All versions | 0.9.36-bp153.2.3.1 |
haserl openSUSE:Leap 15.2 | All versions | 0.9.36-bp153.2.3.1 |
haserl openSUSE:Leap 15.3 | All versions | 0.9.36-bp153.2.3.1 |
haserl openSUSE:Tumbleweed | All versions | 0.9.36-1.3 |
Products include Haserl Project Haserl.
How do I fix CVE-2021-29133?
Upgrade to a fixed version.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2021-29133 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-29133 exists.
Public exploit code: 1 Metasploit module.
Sources
Also known as ALPINE-CVE-2021-29133, GHSA-55p6-pg28-3hh3, openSUSE-SU-2021:1279-1, openSUSE-SU-2024:10840-1.