CVE-2021-41072 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2021-41072 Interim 1 15 2023-09-27T23:31:52Z current 2022-04-11T11:36:25Z 2023-09-27T23:31:52Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2021-41072 squashfs_opendir in unsquash-2.c in Squashfs-Tools 4.5 allows Directory Traversal, a different vulnerability than CVE-2021-40153. A squashfs filesystem that has been crafted to include a symbolic link and then contents under the same filename in a filesystem can cause unsquashfs to first create the symbolic link pointing outside the expected directory, and then the subsequent write operation will cause the unsquashfs process to write through the symbolic link elsewhere in the filesystem. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://www.suse.com/support/security/rating/ SUSE Security Ratings HPE Helion OpenStack 8 SUSE CaaS Platform 4.0 SUSE Enterprise Storage 6 SUSE Enterprise Storage 7 SUSE Enterprise Storage 7.1 SUSE Linux Enterprise Module for Basesystem 15 SP4 SUSE Linux Enterprise Module for Basesystem 15 SP5 SUSE Linux Enterprise High Performance Computing 12 SP5 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS SUSE Linux Enterprise Module for Basesystem 15 SP4 SUSE Linux Enterprise Module for Basesystem 15 SP5 SUSE Linux Enterprise Micro 5.1 SUSE Linux Enterprise Micro 5.2 SUSE Linux Enterprise Micro 5.3 SUSE Linux Enterprise Micro 5.4 SUSE Linux Enterprise Micro 5.5 SUSE Linux Enterprise Real Time 15 SP3 SUSE Linux Enterprise Server 11 SP3 for Teradata SUSE Linux Enterprise Server 11 SP4 LTSS SUSE Linux Enterprise Server 12 SP2-BCL SUSE Linux Enterprise Server 12 SP4-ESPOS SUSE Linux Enterprise Server 12 SP4-LTSS SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server 15 SP1-LTSS SUSE Linux Enterprise Server 15 SP2-LTSS SUSE Linux Enterprise Module for Basesystem 15 SP4 SUSE Linux Enterprise Module for Basesystem 15 SP5 SUSE Linux Enterprise Server Teradata 12 SP3 SUSE Linux Enterprise Server for SAP Applications 12 SP4 SUSE Linux Enterprise Server for SAP Applications 12 SP5 SUSE Linux Enterprise Server for SAP Applications 15 SP1 SUSE Linux Enterprise Server for SAP Applications 15 SP2 SUSE Linux Enterprise Server for SAP Applications 15 SP3 SUSE Linux Enterprise Module for Basesystem 15 SP4 SUSE Linux Enterprise Module for Basesystem 15 SP5 SUSE Manager Proxy 4.2 SUSE Linux Enterprise Module for Basesystem 15 SP4 SUSE Manager Retail Branch Server 4.2 SUSE Linux Enterprise Module for Basesystem 15 SP4 SUSE Manager Server 4.2 SUSE Linux Enterprise Module for Basesystem 15 SP4 SUSE OpenStack Cloud 8 SUSE OpenStack Cloud 9 SUSE OpenStack Cloud Crowbar 8 SUSE OpenStack Cloud Crowbar 9 openSUSE Tumbleweed squashfs squashfs-4.5.1-1.1 squashfs-4.5.1-1.1 as a component of openSUSE Tumbleweed squashfs as a component of HPE Helion OpenStack 8 squashfs as a component of SUSE CaaS Platform 4.0 squashfs as a component of SUSE Enterprise Storage 6 squashfs as a component of SUSE Enterprise Storage 7 squashfs as a component of SUSE Enterprise Storage 7.1 squashfs as a component of SUSE Linux Enterprise High Performance Computing 12 SP5 squashfs as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS squashfs as a component of SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS squashfs as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS squashfs as a component of SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS squashfs as a component of SUSE Linux Enterprise Micro 5.1 squashfs as a component of SUSE Linux Enterprise Micro 5.2 squashfs as a component of SUSE Linux Enterprise Micro 5.3 squashfs as a component of SUSE Linux Enterprise Micro 5.4 squashfs as a component of SUSE Linux Enterprise Micro 5.5 squashfs as a component of SUSE Linux Enterprise Module for Basesystem 15 SP4 squashfs as a component of SUSE Linux Enterprise Module for Basesystem 15 SP5 squashfs as a component of SUSE Linux Enterprise Real Time 15 SP3 squashfs as a component of SUSE Linux Enterprise Server 11 SP3 for Teradata squashfs as a component of SUSE Linux Enterprise Server 11 SP4 LTSS squashfs as a component of SUSE Linux Enterprise Server 12 SP2-BCL squashfs as a component of SUSE Linux Enterprise Server 12 SP4-ESPOS squashfs as a component of SUSE Linux Enterprise Server 12 SP4-LTSS squashfs as a component of SUSE Linux Enterprise Server 12 SP5 squashfs as a component of SUSE Linux Enterprise Server 15 SP1-LTSS squashfs as a component of SUSE Linux Enterprise Server 15 SP2-LTSS squashfs as a component of SUSE Linux Enterprise Server Teradata 12 SP3 squashfs as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 squashfs as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 squashfs as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP1 squashfs as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP2 squashfs as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP3 squashfs as a component of SUSE Manager Proxy 4.2 squashfs as a component of SUSE Manager Retail Branch Server 4.2 squashfs as a component of SUSE Manager Server 4.2 squashfs as a component of SUSE OpenStack Cloud 8 squashfs as a component of SUSE OpenStack Cloud 9 squashfs as a component of SUSE OpenStack Cloud Crowbar 8 squashfs as a component of SUSE OpenStack Cloud Crowbar 9 squashfs_opendir in unsquash-2.c in Squashfs-Tools 4.5 allows Directory Traversal, a different vulnerability than CVE-2021-40153. A squashfs filesystem that has been crafted to include a symbolic link and then contents under the same filename in a filesystem can cause unsquashfs to first create the symbolic link pointing outside the expected directory, and then the subsequent write operation will cause the unsquashfs process to write through the symbolic link elsewhere in the filesystem. CVE-2021-41072 openSUSE Tumbleweed:squashfs-4.5.1-1.1 HPE Helion OpenStack 8:squashfs SUSE CaaS Platform 4.0:squashfs SUSE Enterprise Storage 6:squashfs SUSE Enterprise Storage 7.1:squashfs SUSE Enterprise Storage 7:squashfs SUSE Linux Enterprise High Performance Computing 12 SP5:squashfs SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:squashfs SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:squashfs SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS:squashfs SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS:squashfs SUSE Linux Enterprise Micro 5.1:squashfs SUSE Linux Enterprise Micro 5.2:squashfs SUSE Linux Enterprise Micro 5.3:squashfs SUSE Linux Enterprise Micro 5.4:squashfs SUSE Linux Enterprise Micro 5.5:squashfs SUSE Linux Enterprise Module for Basesystem 15 SP4:squashfs SUSE Linux Enterprise Module for Basesystem 15 SP5:squashfs SUSE Linux Enterprise Real Time 15 SP3:squashfs SUSE Linux Enterprise Server 11 SP3 for Teradata:squashfs SUSE Linux Enterprise Server 11 SP4 LTSS:squashfs SUSE Linux Enterprise Server 12 SP2-BCL:squashfs SUSE Linux Enterprise Server 12 SP4-ESPOS:squashfs SUSE Linux Enterprise Server 12 SP4-LTSS:squashfs SUSE Linux Enterprise Server 12 SP5:squashfs SUSE Linux Enterprise Server 15 SP1-LTSS:squashfs SUSE Linux Enterprise Server 15 SP2-LTSS:squashfs SUSE Linux Enterprise Server Teradata 12 SP3:squashfs SUSE Linux Enterprise Server for SAP Applications 12 SP4:squashfs SUSE Linux Enterprise Server for SAP Applications 12 SP5:squashfs SUSE Linux Enterprise Server for SAP Applications 15 SP1:squashfs SUSE Linux Enterprise Server for SAP Applications 15 SP2:squashfs SUSE Linux Enterprise Server for SAP Applications 15 SP3:squashfs SUSE Manager Proxy 4.2:squashfs SUSE Manager Retail Branch Server 4.2:squashfs SUSE Manager Server 4.2:squashfs SUSE OpenStack Cloud 8:squashfs SUSE OpenStack Cloud 9:squashfs SUSE OpenStack Cloud Crowbar 8:squashfs SUSE OpenStack Cloud Crowbar 9:squashfs moderate 5.8 AV:N/AC:M/Au:N/C:N/I:P/A:P 6.6 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N