Most recent entries from all

ALSA-2023:6380 — Moderate: runc security update

Affected: AlmaLinux:9: runc

The runC tool is a lightweight, portable implementation of the Open Container Format (OCF) that provides container runtime.

Security Fix(es):

* golang: crypto/tls: large handshake records may cause panics (CVE-2022-41724) * runc: Rootless runc makes `/sys/fs/cgroup` writable (CVE-2023-25809) * runc: volume mount race condition (regression of CVE-2019-19921) (CVE-2023-27561) * runc: AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount configuration (CVE-2023-28642) * runc: integer overflow in netlink bytemsg length field allows attacker to override netlink-based container configuration (CVE-2021-43784)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

bdu:2023-03863

Withdrawn: BELL-CVE-2023-27561 — CVE-2023-27561 does not affect BellSoft software

Withdrawn by the publisher.

certfr-2024-avi-0350 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre el…

certfr-2024-avi-0350

CLEANSTART-2026-IS70911 — Security fix for CVE-2023-27561 applied in: runc 1.1.4-r0

Affected: CleanStart: runc

Security vulnerability affects the runc package. This issue is resolved in later releases. See references for vulnerability details.

EUVD-2026-263791

fkie_cve-2023-27561

runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. NOTE: this issue exists because of a CVE-2019-19921 regression.

GHSA-vpvm-3wq2-2wvm — Opencontainers runc Incorrect Authorization vulnerability

Affected: Go: github.com/opencontainers/runc

runc 1.0.0-rc95 through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to `libcontainer/rootfs_linux.go`. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. NOTE: this issue exists because of a CVE-2019-19921 regression.

gsd-2023-27561

msrc_CVE-2023-27561 — runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges related to libcontainer/rootfs_linu…

msrc_CVE-2023-27561

openSUSE-SU-2024:12826-1 — runc-1.1.5-1.1 on GA media

runc-1.1.5-1.1 on GA media

RHSA-2023:1326 — Red Hat Security Advisory: OpenShift Container Platform 4.13.0 security update

go-yaml: Denial of Service in go-yaml goutils: RandomAlphaNumeric and CryptoRandomAlphaNumeric are not as random as they should be mongo-go-driver: specific cstrings input may not be properly validated golang: out-of-bounds read in golang.org/x/text/language leads to DoS prometheus/client_golang: Denial of service using InstrumentHandlerCounter helm: Denial of service through through repository index file helm: Denial of service through schema file golang: crash in a golang.org/x/crypto/ssh server vault: insufficient certificate revocation list checking golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests x/net/http2/h2c: request smuggling golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding golang: crypto/tls: large handshake records may cause panics golang: net/http, mime/multipart: denial of service from excessive resource consumption exporter-toolkit: authentication bypass via cache poisoning vault: Vault’s Microsoft SQL Database Storage Backend Vulnerable to SQL Injection Via Configuration File hashicorp/vault: Vault’s PKI Issuer Endpoint Did Not Correctly Authorize Access to Issuer Metadata hashicorp/vault: Cache-Timing Attacks During Seal and Unseal Operations helm: getHostByName Function Information Disclosure containerd: Supplementary groups are not set up properly runc: Rootless runc makes `/sys/fs/cgroup` writable runc: volume mount race condition (regression of CVE-2019-19921) runc: AppArmor can be bypassed when `/pro…

SUSE-SU-2023:1726-1 — Security update for runc

Security update for runc

UBUNTU-CVE-2023-27561

Affected: Ubuntu:Pro:16.04:LTS: runc, Ubuntu:18.04:LTS: runc, Ubuntu:20.04:LTS: runc, Ubuntu:22.04:LTS: runc

WID-SEC-W-2023-1183 — docker: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in docker ausnutzen, um Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand auszulösen, seine Privilegien zu erweitern und Daten zu manipulieren.