containernetworking/cni improper limitation of path name

ALTO 7.2CVE-2021-20206 · GHSA-xjqr-g762-pxwp · GO-2022-0230 · Published 26/03/2021 · updated 17/06/2026

In breve

CVE-2021-20206 è una vulnerabilità ALTO (CVSS 7.2) che riguarda github.com/containernetworking/cni, container network interface (linuxfoundation).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.5%, superiore al 74.7% delle vulnerabilità.
Correzione: aggiornare a 0.8.1 o successiva.

Package	Affected versions	Patched versions
github.com/containernetworking/cni Go	`< 0.8.1`	`0.8.1`
container network interface linuxfoundation	`< 0.8.1`	`0.8.1`

Description

An improper limitation of path name flaw was found in containernetworking/cni in versions before 0.8.1. When specifying the plugin to load in the 'type' field in the network configuration, it is possible to use special elements such as "../" separators to reference binaries elsewhere on the system. This flaw allows an attacker to execute other existing binaries other than the cni plugins/types, such as 'reboot'. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.