packages:
  - module: github.com/containernetworking/cni
    package: github.com/containernetworking/cni/pkg/invoke
    symbols:
      - FindInPath
    derived_symbols:
      - DelegateAdd
      - DelegateCheck
      - DelegateDel
      - RawExec.FindInPath
    versions:
      - fixed: 0.8.1
    vulnerable_at: 0.8.0
description: |
    The FindInPath function is vulnerable to directory traversal attacks,
    potentially permitting attackers to execute arbitrary binaries.

    This function does not sanitize its plugin parameter, so parameter
    names containing "../" or other such elements may reference
    arbitrary locations on the filesystem.
cves:
  - CVE-2021-20206
ghsas:
  - GHSA-xjqr-g762-pxwp
links:
    pr: https://github.com/containernetworking/cni/pull/808
    context:
      - https://bugzilla.redhat.com/show_bug.cgi?id=1919391
      - https://snyk.io/vuln/SNYK-GOLANG-GITHUBCOMCONTAINERNETWORKINGCNIPKGINVOKE-1070549