CVE catalog

CVE-2021-29136

umoci: CVE-2021-29136

Severity: High · CVSS 7.3CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Published: Apr 6, 2021, 4:15:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.34% · Oct 25, 2026

Open Container Initiative umoci before 0.4.7 allows attackers to overwrite arbitrary host paths via a crafted image that causes symlink traversal when "umoci unpack" or "umoci raw unpack" is used.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	umoci	sid	`0.6.0+ds-1`	fixed
Debian	umoci	forky	`0.6.0+ds-1`	fixed
Debian	umoci	trixie	`0.4.7+ds-4`	fixed
Debian	umoci	bookworm	`0.4.7+ds-3`	fixed
Opensuse	umoci	tumbleweed	`0.4.7-2.3`	fixed
Suse	umoci	linux enterprise module for containers 15 sp2	`0.4.7-3.12.1`	fixed
Suse	umoci	linux enterprise module for containers 15 sp3	`0.4.7-3.12.1`	fixed
Suse	umoci	linux enterprise high performance computing 15 sp1-espos	`0.4.7-3.12.1`	fixed
Suse	umoci	linux enterprise high performance computing 15 sp1-ltss	`0.4.7-3.12.1`	fixed
Suse	umoci	linux enterprise server 15 sp1-bcl	`0.4.7-3.12.1`	fixed
Suse	umoci	linux enterprise server 15 sp1-ltss	`0.4.7-3.12.1`	fixed
Suse	umoci	linux enterprise server for sap applications 15 sp1	`0.4.7-3.12.1`	fixed
Suse	umoci	manager proxy 4.0	`0.4.7-3.12.1`	fixed
Suse	umoci	manager retail branch server 4.0	`0.4.7-3.12.1`	fixed
Suse	umoci	manager server 4.0	`0.4.7-3.12.1`	fixed
Suse	umoci	enterprise storage 6	`0.4.7-3.12.1`	fixed
Suse	singularity	package hub 15 sp2	`3.7.3-bp152.2.19.3`	fixed
Opensuse	umoci	leap 15.2	`0.4.6-lp152.2.3.1`	fixed
Opensuse	umoci	leap 15.2	`0.4.7-lp152.2.6.1`	fixed
Suse	umoci	linux enterprise module for containers 15 sp2	`0.4.6-3.9.1`	fixed
Suse	umoci	linux enterprise high performance computing 15 sp1-espos	`0.4.6-3.9.1`	fixed
Suse	umoci	linux enterprise high performance computing 15 sp1-ltss	`0.4.6-3.9.1`	fixed
Suse	umoci	linux enterprise server 15 sp1-bcl	`0.4.6-3.9.1`	fixed
Suse	umoci	linux enterprise server 15 sp1-ltss	`0.4.6-3.9.1`	fixed
Suse	umoci	linux enterprise server for sap applications 15 sp1	`0.4.6-3.9.1`	fixed
Suse	umoci	manager proxy 4.0	`0.4.6-3.9.1`	fixed
Suse	umoci	manager retail branch server 4.0	`0.4.6-3.9.1`	fixed
Suse	umoci	manager server 4.0	`0.4.6-3.9.1`	fixed
Suse	umoci	enterprise storage 6	`0.4.6-3.9.1`	fixed
Suse	umoci	linux enterprise module for basesystem 15 sp3	`0.4.7-3.12.1`	fixed
Opensuse	umoci	leap 15.3	`0.4.7-3.12.1`	fixed
Ubuntu	umoci	20.04	`0.4.4+dfsg-1`	vulnerable
Ubuntu	umoci	20.04	`0.4.4+dfsg-5`	vulnerable
Ubuntu	umoci	20.04	`0.4.5+dfsg-1`	vulnerable
Ubuntu	umoci	22.04	`0.4.7+ds-2`	vulnerable
Ubuntu	umoci	22.04	`0.4.7+ds-2build1`	vulnerable
Ubuntu	umoci	22.04	`0.4.7+ds-2ubuntu0.1`	vulnerable

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	umoci	source	sid	`0.4.7+ds-1`	not yet assigned	Not reported	Not reported
Debian	umoci	source	forky	`0.4.7+ds-1`	not yet assigned	Not reported	Not reported
Debian	umoci	source	trixie	`0.4.7+ds-1`	not yet assigned	Not reported	Not reported
Debian	umoci	source	bookworm	`0.4.7+ds-1`	not yet assigned	Not reported	Not reported
Opensuse	umoci	rpm	tumbleweed	`0.4.7-2.3`	Not reported	OPENSUSE-SU-2024:11482-1	Not reported
Suse	umoci	rpm	linux enterprise module for containers 15 sp2	`0.4.7-3.12.1`	Not reported	SUSE-SU-2021:1863-1	Not reported
Suse	umoci	rpm	linux enterprise module for containers 15 sp3	`0.4.7-3.12.1`	Not reported	SUSE-SU-2021:1863-1	Not reported
Suse	umoci	rpm	linux enterprise high performance computing 15 sp1-espos	`0.4.7-3.12.1`	Not reported	SUSE-SU-2021:1863-1	Not reported
Suse	umoci	rpm	linux enterprise high performance computing 15 sp1-ltss	`0.4.7-3.12.1`	Not reported	SUSE-SU-2021:1863-1	Not reported
Suse	umoci	rpm	linux enterprise server 15 sp1-bcl	`0.4.7-3.12.1`	Not reported	SUSE-SU-2021:1863-1	Not reported
Suse	umoci	rpm	linux enterprise server 15 sp1-ltss	`0.4.7-3.12.1`	Not reported	SUSE-SU-2021:1863-1	Not reported
Suse	umoci	rpm	linux enterprise server for sap applications 15 sp1	`0.4.7-3.12.1`	Not reported	SUSE-SU-2021:1863-1	Not reported
Suse	umoci	rpm	manager proxy 4.0	`0.4.7-3.12.1`	Not reported	SUSE-SU-2021:1863-1	Not reported
Suse	umoci	rpm	manager retail branch server 4.0	`0.4.7-3.12.1`	Not reported	SUSE-SU-2021:1863-1	Not reported
Suse	umoci	rpm	manager server 4.0	`0.4.7-3.12.1`	Not reported	SUSE-SU-2021:1863-1	Not reported
Suse	umoci	rpm	enterprise storage 6	`0.4.7-3.12.1`	Not reported	SUSE-SU-2021:1863-1	Not reported
Suse	singularity	rpm	package hub 15 sp2	`3.7.3-bp152.2.19.3`	Not reported	OPENSUSE-SU-2021:0810-1	Not reported
Opensuse	umoci	rpm	leap 15.2	`0.4.6-lp152.2.3.1`	Not reported	OPENSUSE-SU-2021:0548-1	Not reported
Opensuse	umoci	rpm	leap 15.2	`0.4.7-lp152.2.6.1`	Not reported	OPENSUSE-SU-2021:0846-1	Not reported
Suse	umoci	rpm	linux enterprise module for containers 15 sp2	`0.4.6-3.9.1`	Not reported	SUSE-SU-2021:1116-1	Not reported
Suse	umoci	rpm	linux enterprise high performance computing 15 sp1-espos	`0.4.6-3.9.1`	Not reported	SUSE-SU-2021:1116-1	Not reported
Suse	umoci	rpm	linux enterprise high performance computing 15 sp1-ltss	`0.4.6-3.9.1`	Not reported	SUSE-SU-2021:1116-1	Not reported
Suse	umoci	rpm	linux enterprise server 15 sp1-bcl	`0.4.6-3.9.1`	Not reported	SUSE-SU-2021:1116-1	Not reported
Suse	umoci	rpm	linux enterprise server 15 sp1-ltss	`0.4.6-3.9.1`	Not reported	SUSE-SU-2021:1116-1	Not reported
Suse	umoci	rpm	linux enterprise server for sap applications 15 sp1	`0.4.6-3.9.1`	Not reported	SUSE-SU-2021:1116-1	Not reported
Suse	umoci	rpm	manager proxy 4.0	`0.4.6-3.9.1`	Not reported	SUSE-SU-2021:1116-1	Not reported
Suse	umoci	rpm	manager retail branch server 4.0	`0.4.6-3.9.1`	Not reported	SUSE-SU-2021:1116-1	Not reported
Suse	umoci	rpm	manager server 4.0	`0.4.6-3.9.1`	Not reported	SUSE-SU-2021:1116-1	Not reported
Suse	umoci	rpm	enterprise storage 6	`0.4.6-3.9.1`	Not reported	SUSE-SU-2021:1116-1	Not reported
Suse	umoci	rpm	linux enterprise module for basesystem 15 sp3	`0.4.7-3.12.1`	Not reported	SUSE-SU-2021:1863-2	Not reported
Opensuse	umoci	rpm	leap 15.3	`0.4.7-3.12.1`	Not reported	OPENSUSE-SU-2021:1863-1	Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[golang-github-opensuse-umoci-dev]Fixed
Source package: [umoci]
Details (4)
- 0.4.7+ds-3 · all · bookworm
  Fixed · Fixed: 0.4.7+ds-1
  dsa · umoci · debian · bookworm; dsa · umoci · debian · 12
- 0.4.7+ds-3 · all · bookworm
  Fixed · Fixed: 0.4.7+ds-1
  dsa · umoci · debian · bookworm; dsa · umoci · debian · 12
- 0.4.7+ds-4~bpo12+1 · all · bookworm-backports
  Fixed · Fixed: 0.4.7+ds-1
  dsa · umoci · debian · bookworm; dsa · umoci · debian · 12
- 0.4.7+ds-4~bpo12+1 · all · bookworm-backports
  Fixed · Fixed: 0.4.7+ds-1
  dsa · umoci · debian · bookworm; dsa · umoci · debian · 12
[umoci]Fixed
Details (4)
- 0.4.7+ds-3+b7 · amd64 · bookworm
  Fixed · Fixed: 0.4.7+ds-1
  dsa · umoci · debian · bookworm; dsa · umoci · debian · 12
- 0.4.7+ds-3+b7 · arm64 · bookworm
  Fixed · Fixed: 0.4.7+ds-1
  dsa · umoci · debian · bookworm; dsa · umoci · debian · 12
- 0.4.7+ds-4~bpo12+1 · amd64 · bookworm-backports
  Fixed · Fixed: 0.4.7+ds-1
  dsa · umoci · debian · bookworm; dsa · umoci · debian · 12
- 0.4.7+ds-4~bpo12+1 · arm64 · bookworm-backports
  Fixed · Fixed: 0.4.7+ds-1
  dsa · umoci · debian · bookworm; dsa · umoci · debian · 12

[Debian 13 (Trixie)]

[golang-github-opensuse-umoci-dev]Fixed
Source package: [umoci]
Details (4)
- 0.4.7+ds-4 · all · trixie
  Fixed · Fixed: 0.4.7+ds-1
  dsa · umoci · debian · 13
- 0.4.7+ds-4 · all · trixie
  Fixed · Fixed: 0.4.7+ds-1
  dsa · umoci · debian · 13
- 0.6.0+ds-1~bpo13+1 · all · trixie-backports
  Fixed · Fixed: 0.4.7+ds-1
  dsa · umoci · debian · 13
- 0.6.0+ds-1~bpo13+1 · all · trixie-backports
  Fixed · Fixed: 0.4.7+ds-1
  dsa · umoci · debian · 13
[umoci]Fixed
Details (4)
- 0.4.7+ds-4+b10 · amd64 · trixie
  Fixed · Fixed: 0.4.7+ds-1
  dsa · umoci · debian · 13
- 0.4.7+ds-4+b10 · arm64 · trixie
  Fixed · Fixed: 0.4.7+ds-1
  dsa · umoci · debian · 13
- 0.6.0+ds-1~bpo13+1 · amd64 · trixie-backports
  Fixed · Fixed: 0.4.7+ds-1
  dsa · umoci · debian · 13
- 0.6.0+ds-1~bpo13+1 · arm64 · trixie-backports
  Fixed · Fixed: 0.4.7+ds-1
  dsa · umoci · debian · 13

[openSUSE Tumbleweed]

[umoci]Fixed
Source package: [umoci]
Details (1)
- 0.6.0-1.7 · x86_64 · tumbleweed
  Fixed · Fixed: 0.4.7-2.3
  dsa · umoci · opensuse · tumbleweed

Observed: Oct 23, 2026, 5:55:58 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]