PublicDateAtUSN: 2021-08-27 15:15:00 UTC
Candidate: CVE-2021-40153
PublicDate: 2021-08-27 15:15:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40153
 https://bugs.launchpad.net/ubuntu/+source/squashfs-tools/+bug/1941790
 https://github.com/plougher/squashfs-tools/commit/79b5a555058eef4e1e7ff220c344d39f8cd09646 (4.5)
 https://github.com/plougher/squashfs-tools/issues/72
 https://github.com/plougher/squashfs-tools/commit/79b5a555058eef4e1e7ff220c344d39f8cd09646
 https://ubuntu.com/security/notices/USN-5057-1
 https://ubuntu.com/security/notices/USN-5078-2
Description:
 squashfs_opendir in unsquash-1.c in Squashfs-Tools 4.5 stores the filename
 in the directory entry; this is then used by unsquashfs to create the new
 file during the unsquash. The filename is not validated for traversal
 outside of the destination directory, and thus allows writing to locations
 outside of the destination.
Ubuntu-Description:
Notes:
Mitigation:
Bugs:
Priority: medium
Discovered-by: Etienne Stalmans
Assigned-to: amurray
CVSS:
 nvd: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H [8.1 HIGH]


Patches_squashfs-tools:
upstream_squashfs-tools: needs-triage
trusty_squashfs-tools: ignored (out of standard support)
trusty/esm_squashfs-tools: DNE
xenial_squashfs-tools: ignored (out of standard support)
esm-infra/xenial_squashfs-tools: released (1:4.3-3ubuntu2.16.04.3+esm1)
bionic_squashfs-tools: released (1:4.3-6ubuntu0.18.04.3)
focal_squashfs-tools: released (1:4.4-1ubuntu0.1)
hirsute_squashfs-tools: released (1:4.4-2ubuntu0.1)
impish_squashfs-tools: released (1:4.4-2ubuntu1)
jammy_squashfs-tools: released (1:4.4-2ubuntu1)
devel_squashfs-tools: released (1:4.4-2ubuntu1)