https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 20:03:57 +0000 https://cve.radiocsirt.org/vuln/alsa-2022:7469 <p><strong>Affected:</strong> AlmaLinux:8: aardvark-dns, AlmaLinux:8: buildah, AlmaLinux:8: buildah-tests, AlmaLinux:8: cockpit-podman, AlmaLinux:8: conmon, AlmaLinux:8: container-selinux, AlmaLinux:8: containernetworking-plugins, AlmaLinux:8: containers-common, AlmaLinux:8: crit, AlmaLinux:8: criu and 24 more</p> <p>The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.</p> <p>Security Fix(es):</p> <p>* cri-o: memory exhaustion on the node when access to the kube api (CVE-2022-1708) * golang: crash in a golang.org/x/crypto/ssh server (CVE-2022-27191) * runc: incorrect handling of inheritable capabilities (CVE-2022-29162)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p>Additional Changes:</p> <p>For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.</p> <p><strong>Affected:</strong> AlmaLinux:8: aardvark-dns, AlmaLinux:8: buildah, AlmaLinux:8: buildah-tests, AlmaLinux:8: cockpit-podman, AlmaLinux:8: conmon, AlmaLinux:8: container-selinux, AlmaLinux:8: containernetworking-plugins, AlmaLinux:8: containers-common, AlmaLinux:8: crit, AlmaLinux:8: criu and 24 more</p> <p>The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.</p> <p>Security Fix(es):</p> <p>* cri-o: memory exhaustion on the node when access to the kube api (CVE-2022-1708) * golang: crash in a golang.org/x/crypto/ssh server (CVE-2022-27191) * runc: incorrect handling of inheritable capabilities (CVE-2022-29162)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p>Additional Changes:</p> <p>For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.</p> https://cve.radiocsirt.org/vuln/alsa-2022:7469 https://cve.radiocsirt.org/vuln/bdu:2022-05793 bdu:2022-05793 https://cve.radiocsirt.org/vuln/bdu:2022-05793 https://cve.radiocsirt.org/vuln/bell-cve-2022-29162 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Withdrawn by the publisher.</strong></p> https://cve.radiocsirt.org/vuln/bell-cve-2022-29162 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0119 certfr-2024-avi-0119 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0119 https://cve.radiocsirt.org/vuln/cleanstart-2026-cq48087 <p><strong>Affected:</strong> CleanStart: runc</p> <p>Security vulnerability affects the runc package. This issue is resolved in later releases. See references for vulnerability details.</p> <p><strong>Affected:</strong> CleanStart: runc</p> <p>Security vulnerability affects the runc package. This issue is resolved in later releases. See references for vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-cq48087 https://cve.radiocsirt.org/vuln/euvd-2026-234129 EUVD-2026-234129 https://cve.radiocsirt.org/vuln/euvd-2026-234129 https://cve.radiocsirt.org/vuln/fkie_cve-2022-29162 <p>runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. A bug was found in runc prior to version 1.1.2 where `runc exec --cap` created processes with non-empty inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with inheritable file capabilities to elevate those capabilities to the permitted set during execve(2). This bug did not affect the container security sandbox as the inheritable set never contained more capabilities than were included in the container&#39;s bounding set. This bug has been fixed in runc 1.1.2. This fix changes `runc exec --cap` behavior such that the additional capabilities granted to the process being executed (as specified via `--cap` arguments) do not include inheritable capabilities. In addition, `runc spec` is changed to not set any inheritable capabilities in the created example OCI spec (`config.json`) file.</p> <p>runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. A bug was found in runc prior to version 1.1.2 where `runc exec --cap` created processes with non-empty inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with inheritable file capabilities to elevate those capabilities to the permitted set during execve(2). This bug did not affect the container security sandbox as the inheritable set never contained more capabilities than were included in the container&#39;s bounding set. This bug has been fixed in runc 1.1.2. This fix changes `runc exec --cap` behavior such that the additional capabilities granted to the process being executed (as specified via `--cap` arguments) do not include inheritable capabilities. In addition, `runc spec` is changed to not set any inheritable capabilities in the created example OCI spec (`config.json`) file.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2022-29162 https://cve.radiocsirt.org/vuln/ghsa-f3fp-gc8g-vw66 <p><strong>Affected:</strong> Go: github.com/opencontainers/runc</p> <p>### Impact</p> <p>A bug was found in runc where `runc exec --cap` executed processes with non-empty inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with inheritable file capabilities to elevate those capabilities to the permitted set during execve(2).</p> <p>This bug did not affect the container security sandbox as the inheritable set never contained more capabilities than were included in the container&#39;s bounding set.</p> <p>### Patches This bug has been fixed in runc 1.1.2. Users should update to this version as soon as possible.</p> <p>This fix changes `runc exec --cap` behavior such that the additional capabilities granted to the process being executed (as specified via `--cap` arguments) do not include inheritable capabilities.</p> <p>In addition, `runc spec` is changed to not set any inheritable capabilities in the created example OCI spec (`config.json`) file.</p> <p>### Credits The opencontainers project would like to thank [Andrew G. Morgan](https://github.com/AndrewGMorgan) for responsibly disclosing this issue in accordance with the [opencontainers org security policy](https://github.com/opencontainers/.github/blob/master/SECURITY.md).</p> <p>### For more information If you have any questions or comments about this advisory:</p> <p>* [Open an issue](https://github.com/opencontainers/runc/issues/new) * Email us at [security@opencontainers.org](mailto:security@opencontainers.org) if you think you’ve found a security bug</p> <p><strong>Affected:</strong> Go: github.com/opencontainers/runc</p> <p>### Impact</p> <p>A bug was found in runc where `runc exec --cap` executed processes with non-empty inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with inheritable file capabilities to elevate those capabilities to the permitted set during execve(2).</p> <p>This bug did not affect the container security sandbox as the inheritable set never contained more capabilities than were included in the container&#39;s bounding set.</p> <p>### Patches This bug has been fixed in runc 1.1.2. Users should update to this version as soon as possible.</p> <p>This fix changes `runc exec --cap` behavior such that the additional capabilities granted to the process being executed (as specified via `--cap` arguments) do not include inheritable capabilities.</p> <p>In addition, `runc spec` is changed to not set any inheritable capabilities in the created example OCI spec (`config.json`) file.</p> <p>### Credits The opencontainers project would like to thank [Andrew G. Morgan](https://github.com/AndrewGMorgan) for responsibly disclosing this issue in accordance with the [opencontainers org security policy](https://github.com/opencontainers/.github/blob/master/SECURITY.md).</p> <p>### For more information If you have any questions or comments about this advisory:</p> <p>* [Open an issue](https://github.com/opencontainers/runc/issues/new) * Email us at [security@opencontainers.org](mailto:security@opencontainers.org) if you think you’ve found a security bug</p> https://cve.radiocsirt.org/vuln/ghsa-f3fp-gc8g-vw66 https://cve.radiocsirt.org/vuln/gsd-2022-29162 gsd-2022-29162 https://cve.radiocsirt.org/vuln/gsd-2022-29162 https://cve.radiocsirt.org/vuln/icsa-24-046-11 <p>A carefully crafted If: request header can cause a memory read, or write of a single zero byte, in a pool (heap) memory location beyond the header value sent. This could cause the process to crash.</p> <p>This issue affects Apache HTTP Server 2.4.54 and earlier. A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int(&#34;text&#34;), a system could take 50ms to parse an int string with 100,000 digits and 5s for 1,000,000 digits (float, decimal, int.from_bytes(), and int() for binary bases 2, 4, 8, 16, and 32 are not affected). The highest threat from this vulnerability is to system availability. A flaw was found in libdnf&#39;s signature verification functionality in versions before 0.60.1. This flaw allows an attacker to achieve code execution if they can alter the header information of an RPM package and then trick a user or system into installing it. The highest risk of this vulnerability is to confidentiality, integrity, as well as system availability. An out-of-bounds memory access flaw was found in the ATI VGA device emulation of QEMU. This flaw occurs in the ati_2d_blt() routine while handling MMIO write operations when the guest provides invalid values for the destination display parameters. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service. A vulnerability was found in the fs/inode.c:inode_init_owner() function logic of the LInux kernel that allows local users to create…</p> <p>A carefully crafted If: request header can cause a memory read, or write of a single zero byte, in a pool (heap) memory location beyond the header value sent. This could cause the process to crash.</p> <p>This issue affects Apache HTTP Server 2.4.54 and earlier. A flaw was found in python. In algorithms with quadratic time complexity using non-binary bases, when using int(&#34;text&#34;), a system could take 50ms to parse an int string with 100,000 digits and 5s for 1,000,000 digits (float, decimal, int.from_bytes(), and int() for binary bases 2, 4, 8, 16, and 32 are not affected). The highest threat from this vulnerability is to system availability. A flaw was found in libdnf&#39;s signature verification functionality in versions before 0.60.1. This flaw allows an attacker to achieve code execution if they can alter the header information of an RPM package and then trick a user or system into installing it. The highest risk of this vulnerability is to confidentiality, integrity, as well as system availability. An out-of-bounds memory access flaw was found in the ATI VGA device emulation of QEMU. This flaw occurs in the ati_2d_blt() routine while handling MMIO write operations when the guest provides invalid values for the destination display parameters. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service. A vulnerability was found in the fs/inode.c:inode_init_owner() function logic of the LInux kernel that allows local users to create…</p> https://cve.radiocsirt.org/vuln/icsa-24-046-11 https://cve.radiocsirt.org/vuln/msrc_cve-2022-29162 msrc_CVE-2022-29162 https://cve.radiocsirt.org/vuln/msrc_cve-2022-29162 https://cve.radiocsirt.org/vuln/oesa-2022-1704 <p><strong>Affected:</strong> openEuler:20.03-LTS-SP1: runc, openEuler:20.03-LTS-SP3: runc, openEuler:22.03-LTS: runc</p> <p>runc is a CLI tool for spawning and running containers according to the OCI specification. Security Fix(es): runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. A bug was found in runc prior to version 1.1.2 where `runc exec --cap` created processes with non-empty inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with inheritable file capabilities to elevate those capabilities to the permitted set during execve(2). This bug did not affect the container security sandbox as the inheritable set never contained more capabilities than were included in the container&amp;apos;s bounding set. This bug has been fixed in runc 1.1.2. This fix changes `runc exec --cap` behavior such that the additional capabilities granted to the process being executed (as specified via `--cap` arguments) do not include inheritable capabilities. In addition, `runc spec` is changed to not set any inheritable capabilities in the created example OCI spec (`config.json`) file.(CVE-2022-29162)</p> <p><strong>Affected:</strong> openEuler:20.03-LTS-SP1: runc, openEuler:20.03-LTS-SP3: runc, openEuler:22.03-LTS: runc</p> <p>runc is a CLI tool for spawning and running containers according to the OCI specification. Security Fix(es): runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. A bug was found in runc prior to version 1.1.2 where `runc exec --cap` created processes with non-empty inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with inheritable file capabilities to elevate those capabilities to the permitted set during execve(2). This bug did not affect the container security sandbox as the inheritable set never contained more capabilities than were included in the container&amp;apos;s bounding set. This bug has been fixed in runc 1.1.2. This fix changes `runc exec --cap` behavior such that the additional capabilities granted to the process being executed (as specified via `--cap` arguments) do not include inheritable capabilities. In addition, `runc spec` is changed to not set any inheritable capabilities in the created example OCI spec (`config.json`) file.(CVE-2022-29162)</p> https://cve.radiocsirt.org/vuln/oesa-2022-1704 https://cve.radiocsirt.org/vuln/opensuse-su-2024:12074-1 <p>runc-1.1.2-1.1 on GA media</p> <p>runc-1.1.2-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2024:12074-1 https://cve.radiocsirt.org/vuln/rhsa-2022:5068 <p>golang.org/x/crypto: empty plaintext packet causes panic golang: net/http: improper sanitization of Transfer-Encoding header ignition: configs are accessible from unprivileged containers in VMs running on VMware products prometheus/client_golang: Denial of service using InstrumentHandlerCounter golang: math/big: uncontrolled memory consumption due to an unhandled overflow via Rat.SetString golang: cmd/go: misinterpretation of branch names can lead to incorrect access control golang: crypto/elliptic: IsOnCurve returns true for invalid field elements golang: encoding/pem: fix stack overflow in Decode golang: regexp: stack exhaustion via a deeply nested expression golang: crash in a golang.org/x/crypto/ssh server golang: crypto/elliptic: panic caused by oversized scalar runc: incorrect handling of inheritable capabilities</p> <p>golang.org/x/crypto: empty plaintext packet causes panic golang: net/http: improper sanitization of Transfer-Encoding header ignition: configs are accessible from unprivileged containers in VMs running on VMware products prometheus/client_golang: Denial of service using InstrumentHandlerCounter golang: math/big: uncontrolled memory consumption due to an unhandled overflow via Rat.SetString golang: cmd/go: misinterpretation of branch names can lead to incorrect access control golang: crypto/elliptic: IsOnCurve returns true for invalid field elements golang: encoding/pem: fix stack overflow in Decode golang: regexp: stack exhaustion via a deeply nested expression golang: crash in a golang.org/x/crypto/ssh server golang: crypto/elliptic: panic caused by oversized scalar runc: incorrect handling of inheritable capabilities</p> https://cve.radiocsirt.org/vuln/rhsa-2022:5068 https://cve.radiocsirt.org/vuln/suse-su-2022:2165-1 <p>Security update for containerd</p> <p>Security update for containerd</p> https://cve.radiocsirt.org/vuln/suse-su-2022:2165-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2022-29162 <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: runc</p> <p>runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. A bug was found in runc prior to version 1.1.2 where `runc exec --cap` created processes with non-empty inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with inheritable file capabilities to elevate those capabilities to the permitted set during execve(2). This bug did not affect the container security sandbox as the inheritable set never contained more capabilities than were included in the container&#39;s bounding set. This bug has been fixed in runc 1.1.2. This fix changes `runc exec --cap` behavior such that the additional capabilities granted to the process being executed (as specified via `--cap` arguments) do not include inheritable capabilities. In addition, `runc spec` is changed to not set any inheritable capabilities in the created example OCI spec (`config.json`) file.</p> <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: runc</p> <p>runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. A bug was found in runc prior to version 1.1.2 where `runc exec --cap` created processes with non-empty inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with inheritable file capabilities to elevate those capabilities to the permitted set during execve(2). This bug did not affect the container security sandbox as the inheritable set never contained more capabilities than were included in the container&#39;s bounding set. This bug has been fixed in runc 1.1.2. This fix changes `runc exec --cap` behavior such that the additional capabilities granted to the process being executed (as specified via `--cap` arguments) do not include inheritable capabilities. In addition, `runc spec` is changed to not set any inheritable capabilities in the created example OCI spec (`config.json`) file.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2022-29162 https://cve.radiocsirt.org/vuln/wid-sec-w-2022-2052 <p>Ein lokaler Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux ausnutzen, um einen Denial of Service Angriff durchzuführen, Sicherheitsvorkehrungen zu umgehen oder sonstige Auswirkungen zu verursachen.</p> <p>Ein lokaler Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux ausnutzen, um einen Denial of Service Angriff durchzuführen, Sicherheitsvorkehrungen zu umgehen oder sonstige Auswirkungen zu verursachen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2022-2052