A flaw was found in crun where containers were incorrectly started with non-empty default permissions. A vulnerability was found in Moby (Docker Engine) where containers were started incorrectly with non-empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade aardvark-dnsUpgrade toolbox-testsUpgrade criuUpgrade critUpgrade fuse-overlayfsUpgrade podman-remoteUpgrade podman-dockerUpgrade podman-catatonitUpgrade buildahUpgrade slirp4netnsUpgrade podman-testsUpgrade udicaUpgrade buildah-testsUpgrade runcUpgrade netavarkUpgrade podmanUpgrade podman-gvproxyUpgrade cockpit-podmanUpgrade libslirpUpgrade python3-podmanUpgrade containers-commonUpgrade conmonUpgrade oci-seccomp-bpf-hookUpgrade containernetworking-pluginsUpgrade criu-libsUpgrade skopeoUpgrade crunUpgrade python3-criuUpgrade container-selinuxUpgrade toolboxUpgrade skopeo-testsUpgrade podman-pluginsUpgrade libslirp-develUpgrade criu-devel | May 13, 2022 | Apr 4, 2022 |
| Alpine Linux | — | Upgrade crun | Aug 22, 2024 | Apr 4, 2022 |
| Centos_linux | — | Upgrade podman-testsUpgrade libslirp-debugsourceUpgrade podman-catatonit-debuginfoUpgrade podman-remote-debuginfoUpgrade slirp4netns-debuginfoUpgrade runc-debuginfoUpgrade toolboxUpgrade slirp4netnsUpgrade buildah-debugsourceUpgrade slirp4netns-debugsourceUpgrade skopeo-testsUpgrade toolbox-debugsourceUpgrade containernetworking-plugins-debugsourceUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade criu-develUpgrade fuse-overlayfs-debuginfoUpgrade netavarkUpgrade podmanUpgrade podman-debugsourceUpgrade crun-debuginfoUpgrade podman-gvproxyUpgrade podman-pluginsUpgrade skopeo-debuginfoUpgrade conmonUpgrade crunUpgrade libslirpUpgrade python3-podmanUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade skopeoUpgrade containernetworking-plugins-debuginfoUpgrade podman-dockerUpgrade criu-libs-debuginfoUpgrade udicaUpgrade libslirp-debuginfoUpgrade runcUpgrade aardvark-dnsUpgrade criuUpgrade runc-debugsourceUpgrade conmon-debuginfoUpgrade buildah-testsUpgrade podman-debuginfoUpgrade criu-debugsourceUpgrade criu-debuginfoUpgrade criu-libsUpgrade libslirp-develUpgrade crun-debugsourceUpgrade oci-seccomp-bpf-hookUpgrade cockpit-podmanUpgrade fuse-overlayfs-debugsourceUpgrade podman-catatonitUpgrade python3-criuUpgrade podman-gvproxy-debuginfoUpgrade skopeo-debugsourceUpgrade buildahUpgrade toolbox-debuginfoUpgrade conmon-debugsourceUpgrade buildah-debuginfoUpgrade buildah-tests-debuginfoUpgrade toolbox-testsUpgrade containers-commonUpgrade podman-plugins-debuginfoUpgrade critUpgrade container-selinuxUpgrade fuse-overlayfsUpgrade podman-remoteUpgrade containernetworking-plugins | May 13, 2022 | Apr 4, 2022 |
| Debian | — | Upgrade crun | Jul 30, 2024 | Apr 4, 2022 |
| Oracle_linux | — | Upgrade crunUpgrade slirp4netnsUpgrade critUpgrade podman-testsUpgrade udicaUpgrade podman-pluginsUpgrade python3-criuUpgrade skopeo-testsUpgrade libslirp-develUpgrade containernetworking-pluginsUpgrade runcUpgrade container-selinuxUpgrade podman-remoteUpgrade podman-gvproxyUpgrade criu-develUpgrade conmonUpgrade criu-libsUpgrade netavarkUpgrade aardvark-dnsUpgrade podman-catatonitUpgrade oci-seccomp-bpf-hookUpgrade skopeoUpgrade podmanUpgrade libslirpUpgrade buildah-testsUpgrade fuse-overlayfsUpgrade python3-podmanUpgrade buildahUpgrade podman-dockerUpgrade containers-commonUpgrade criuUpgrade cockpit-podman | May 18, 2022 | Mar 30, 2022 |
| Redhat_linux | — | Upgrade skopeoUpgrade criu-debuginfoUpgrade toolboxUpgrade toolbox-debugsourceUpgrade python3-podmanUpgrade cockpit-podmanUpgrade udicaUpgrade toolbox-testsUpgrade conmonUpgrade netavarkUpgrade podmanUpgrade podman-debuginfoUpgrade criu-libs-debuginfoUpgrade buildah-testsUpgrade criuUpgrade fuse-overlayfsUpgrade runc-debugsourceUpgrade runcUpgrade podman-catatonitUpgrade slirp4netnsUpgrade buildah-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade containernetworking-pluginsUpgrade buildah-tests-debuginfoUpgrade podman-gvproxyUpgrade podman-testsUpgrade criu-debugsourceUpgrade buildahUpgrade skopeo-debuginfoUpgrade aardvark-dnsUpgrade conmon-debugsourceUpgrade critUpgrade podman-remoteUpgrade skopeo-debugsourceUpgrade podman-dockerUpgrade libslirp-debuginfoUpgrade podman-remote-debuginfoUpgrade criu-develUpgrade skopeo-testsUpgrade libslirpUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade criu-libsUpgrade toolbox-debuginfoUpgrade podman-pluginsUpgrade containernetworking-plugins-debugsourceUpgrade slirp4netns-debuginfoUpgrade buildah-debugsourceUpgrade libslirp-debugsourceUpgrade podman-gvproxy-debuginfoUpgrade crunUpgrade runc-debuginfoUpgrade containers-commonUpgrade container-selinuxUpgrade slirp4netns-debugsourceUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade conmon-debuginfoUpgrade podman-debugsourceUpgrade podman-plugins-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade oci-seccomp-bpf-hookUpgrade containernetworking-plugins-debuginfoUpgrade podman-catatonit-debuginfoUpgrade crun-debuginfoUpgrade libslirp-develUpgrade crun-debugsourceUpgrade python3-criu | May 13, 2022 | Apr 4, 2022 |
| Rocky_linux | — | Upgrade toolbox-debugsourceUpgrade skopeoUpgrade podman-gvproxyUpgrade podman-catatonitUpgrade buildah-tests-debuginfoUpgrade netavarkUpgrade libslirpUpgrade buildah-debuginfoUpgrade criu-debuginfoUpgrade aardvark-dnsUpgrade criu-libs-debuginfoUpgrade toolbox-testsUpgrade criu-debugsourceUpgrade fuse-overlayfsUpgrade conmonUpgrade slirp4netnsUpgrade toolboxUpgrade skopeo-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade conmon-debugsourceUpgrade runc-debugsourceUpgrade containernetworking-pluginsUpgrade buildah-testsUpgrade skopeo-debugsourceUpgrade criuUpgrade fuse-overlayfs-debugsourceUpgrade podmanUpgrade buildahUpgrade oci-seccomp-bpf-hookUpgrade libslirp-debugsourceUpgrade podman-gvproxy-debuginfoUpgrade skopeo-testsUpgrade crun-debuginfoUpgrade libslirp-develUpgrade containernetworking-plugins-debugsourceUpgrade podman-catatonit-debuginfoUpgrade crun-debugsourceUpgrade libslirp-debuginfoUpgrade criu-libsUpgrade containernetworking-plugins-debuginfoUpgrade podman-testsUpgrade critUpgrade runcUpgrade criu-develUpgrade podman-remote-debuginfoUpgrade conmon-debuginfoUpgrade buildah-debugsourceUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade podman-pluginsUpgrade podman-debuginfoUpgrade podman-plugins-debuginfoUpgrade slirp4netns-debuginfoUpgrade runc-debuginfoUpgrade podman-remoteUpgrade crunUpgrade toolbox-debuginfoUpgrade slirp4netns-debugsourceUpgrade containers-commonUpgrade python3-criuUpgrade podman-debugsourceUpgrade oci-seccomp-bpf-hook-debugsource | Mar 5, 2024 | Apr 4, 2022 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub