CVE-2021-21272

Name of the Vulnerable Software and Affected Versions: ORAS versions 0.4.0 through 0.9.0

Description: The issue is related to a "zip-slip" vulnerability in the directory support feature of ORAS, which allows downloaded gzipped tarballs to be automatically extracted to a user-specified directory. This directory can contain symbolic links and hard links, allowing a well-crafted tarball to link, write, or overwrite specific files on the host filesystem outside of the user-specified directory with the same permissions as the user who runs oras pull. The affected users are oras CLI users who run oras pull and Go programs that invoke github.com/deislabs/oras/pkg/content.FileStore.

Recommendations: For oras CLI users, there is no workaround other than pulling from a trusted artifact provider. For oras package users, the workaround is to not use github.com/deislabs/oras/pkg/content.FileStore, and use other content stores instead, or pull from a trusted artifact provider. Users should upgrade their oras CLI and packages to version 0.9.0 to resolve the issue.