CVE-2021-29133

Lack of verification in haserl, a component of Alpine Linux Configuration Framework, before 0.9...

5.5 MediumFix available

Lack of verification in haserl, a component of Alpine Linux Configuration Framework, before 0.9.36 allows local users to read the contents of any file on the filesystem.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

1.08%Down 2.9 points since Apr 14, 2021

What each source reports

NVD Score used 5.5

Lack of verification in haserl, a component of Alpine Linux Configuration Framework, before 0.9.36 allows local users to read the contents of any file on the filesystem.

Record: CVE-2021-29133
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0: 2.1 LowAV:L/AC:L/Au:N/C:P/I:N/A:N
Updated: 2026-11-02

CVE List No score

Lack of verification in haserl, a component of Alpine Linux Configuration Framework, before 0.9.36 allows local users to read the contents of any file on the filesystem.

Record: CVE-2021-29133
Updated: 2026-11-02

EUVDEUVD-2021-15774 No score

Lack of verification in haserl, a component of Alpine Linux Configuration Framework, before 0.9.36 allows local users to read the contents of any file on the filesystem.

Record: EUVD-2021-15774
Updated: 2026-11-03

GitHub AdvisoriesGHSA-55p6-pg28-3hh3 5.5

Lack of verification in haserl, a component of Alpine Linux Configuration Framework, before 0.9...

Lack of verification in haserl, a component of Alpine Linux Configuration Framework, before 0.9.36 allows local users to read the contents of any file on the filesystem.

Record: GHSA-55p6-pg28-3hh3
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVALPINE-CVE-2021-29133 5.5

Lack of verification in haserl, a component of Alpine Linux Configuration Framework, before 0.9.36 allows local users to read the contents of any file on the filesystem.

Record: ALPINE-CVE-2021-29133
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSV 5.5

Lack of verification in haserl, a component of Alpine Linux Configuration Framework, before 0.9.36 allows local users to read the contents of any file on the filesystem.

Record: CVE-2021-29133
CVSS 3.1: 5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated: 2026-11-02

OSVopenSUSE-SU-2021:1279-1 No score

Security update for haserl

This update for haserl fixes the following issues:

Update to version 0.9.36:

Fixed: Its possible to issue a PUT request without a CONTENT-TYPE. Assume an octet-stream in that case. This is CVE-2021-29133 and boo#1187671
Change the Prefix for variables to be the REQUEST_METHOD (PUT/DELETE/GET/POST) THIS IS A BREAKING CHANGE
Mitigations vs running haserl to get access to files not available to the user.

Record: openSUSE-SU-2021:1279-1
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10840-1 No score

haserl-0.9.36-1.3 on GA media

These are all security issues fixed in the haserl-0.9.36-1.3 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:10840-1
Updated: 2026-11-02

Affected products

haserl project haserl

Affected packages

Affected packages
Package	Affected	Fixed
`haserl` Alpine:v3.10	before 0.9.36-r0	0.9.36-r0
`haserl` Alpine:v3.11	before 0.9.36-r0	0.9.36-r0
`haserl` Alpine:v3.12	before 0.9.36-r0	0.9.36-r0
`haserl` Alpine:v3.13	before 0.9.36-r0	0.9.36-r0
`haserl` Alpine:v3.14	before 0.9.36-r0	0.9.36-r0
`haserl` Alpine:v3.15	before 0.9.36-r0	0.9.36-r0
`haserl` Alpine:v3.16	before 0.9.36-r0	0.9.36-r0
`haserl` Alpine:v3.17	before 0.9.36-r0	0.9.36-r0
`haserl` Alpine:v3.18	before 0.9.36-r0	0.9.36-r0
`haserl` Alpine:v3.19	before 0.9.36-r0	0.9.36-r0

Show 11 moreShow less

Affected packages
Package	Affected	Fixed
`haserl` Alpine:v3.20	before 0.9.36-r0	0.9.36-r0
`haserl` Alpine:v3.21	before 0.9.36-r0	0.9.36-r0
`haserl` Alpine:v3.22	before 0.9.36-r0	0.9.36-r0
`haserl` Alpine:v3.23	before 0.9.36-r0	0.9.36-r0
`haserl` Alpine:v3.24	before 0.9.36-r0	0.9.36-r0
`haserl` SUSE:Package Hub 15 SP1	before 0.9.36-bp153.2.3.1	0.9.36-bp153.2.3.1
`haserl` SUSE:Package Hub 15 SP2	before 0.9.36-bp153.2.3.1	0.9.36-bp153.2.3.1
`haserl` SUSE:Package Hub 15 SP3	before 0.9.36-bp153.2.3.1	0.9.36-bp153.2.3.1
`haserl` openSUSE:Leap 15.2	before 0.9.36-bp153.2.3.1	0.9.36-bp153.2.3.1
`haserl` openSUSE:Leap 15.3	before 0.9.36-bp153.2.3.1	0.9.36-bp153.2.3.1
`haserl` openSUSE:Tumbleweed	before 0.9.36-1.3	0.9.36-1.3

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Metasploit	Haserl Arbitrary File Reader

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, Metasploit, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-29133 is a medium vulnerability (CVSS 5.5) in Haserl Project Haserl, published March 24, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.08%, the 65th percentile. Fixed in haserl 0.9.36-r0.

References

Show 4 moreShow less