Most recent entries from all

ALSA-2020:1650 — Moderate: container-tools:rhel8 security, bug fix, and enhancement update

Affected: AlmaLinux:8: crit, AlmaLinux:8: criu, AlmaLinux:8: python-podman-api, AlmaLinux:8: python3-criu, AlmaLinux:8: slirp4netns, AlmaLinux:8: toolbox, AlmaLinux:8: udica

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

* runc: volume mount race condition with shared mounts leads to information leak/integrity manipulation (CVE-2019-19921)

* containers/image: Container images read entire image manifest into memory (CVE-2020-1702)

* podman: incorrectly allows existing files in volumes to be overwritten by a container when it is created (CVE-2020-1726)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Withdrawn: BELL-CVE-2019-19921 — CVE-2019-19921 does not affect BellSoft software

Withdrawn by the publisher.

certfr-2025-avi-0590 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan…

certfr-2025-avi-0590

CLEANSTART-2025-NR50910 — runc through 1

Affected: CleanStart: containerd

Security vulnerability affects the containerd package. runc through 1.

EUVD-2026-59626

fkie_cve-2019-19921

runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. (This vulnerability does not affect Docker due to an implementation detail that happens to block the attack.)

GHSA-fh74-hm69-rqjw — opencontainers runc contains procfs race condition with a shared volume mount

Affected: Go: github.com/opencontainers/runc

### Impact By crafting a malicious root filesystem (with `/proc` being a symlink to a directory which was inside a volume shared with another running container), an attacker in control of both containers can trick `runc` into not correctly configuring the container's security labels and not correctly masking paths inside `/proc` which contain potentially-sensitive information about the host (or even allow for direct attacks against the host).

In order to exploit this bug, an untrusted user must be able to spawn custom containers with custom mount configurations (such that a volume is shared between two containers). It should be noted that we consider this to be a fairly high level of access for an untrusted user -- and we do not recommend allowing completely untrusted users to have such degrees of access without further restrictions.

### Specific Go Package Affected github.com/opencontainers/runc/libcontainer

### Patches This vulnerability has been fixed in `1.0.0-rc10`. It should be noted that the current fix is effectively a hot-fix, and there are known ways for it to be worked around (such as making the entire root filesystem a shared volume controlled by another container). We recommend that users review their access policies to ensure that untrusted users do not have such high levels of controls over container mount configuration.

### Workarounds If you are not providing the ability for untrusted users to configure mountpoints for `runc` (or through a higher-level t…

gsd-2019-19921

openSUSE-SU-2020:0219-1 — Security update for docker-runc

Security update for docker-runc

RHSA-2020:0688 — Red Hat Security Advisory: OpenShift Container Platform 4.2.22 runc security update

runc: volume mount race condition with shared mounts leads to information leak/integrity manipulation

SUSE-SU-2020:0375-1 — Security update for docker-runc

Security update for docker-runc

UBUNTU-CVE-2019-19921

Affected: Ubuntu:Pro:16.04:LTS: runc, Ubuntu:18.04:LTS: runc, Ubuntu:20.04:LTS: runc

WID-SEC-W-2022-1089 — Red Hat OpenShift Container Platform: Mehrere Schwachstellen

Ein lokaler oder entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat OpenShift Container Platform ausnutzen, um seine Privilegien zu erhöhen, Code zur Ausführung zu bringen oder Dateien zu manipulieren