description: A directory traversal vulnerability was found in the ClairCore engine of Clair. An attacker can exploit this by supplying a crafted container image which, when scanned by Clair, allows for arbitrary file write on the filesystem, potentially allowing for remote code execution.
problem types: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
affected:
{
product: quay/claircore
vendor: n/a
versions:
status: affected, version: Affects v0.4.6 and higher, v0.5.3 and higher | Fixedin claircore v0.4.8, v0.5.5.
}