A flaw was found in buildah where containers were incorrectly started with non-empty default permissions. A bug was found in Moby (Docker Engine) where containers were incorrectly started with non-empty inheritable Linux process capabilities, enabling an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs. This has the potential to impact confidentiality and integrity.
CVSS Details
- CVSS 3.1 Base Score: 6.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade podman-catatonitUpgrade netavarkUpgrade podman-remoteUpgrade containernetworking-pluginsUpgrade runcUpgrade oci-seccomp-bpf-hookUpgrade criuUpgrade criu-develUpgrade conmonUpgrade containers-commonUpgrade python3-podmanUpgrade crunUpgrade criu-libsUpgrade podmanUpgrade toolboxUpgrade skopeo-testsUpgrade fuse-overlayfsUpgrade skopeoUpgrade libslirp-develUpgrade podman-pluginsUpgrade critUpgrade buildahUpgrade udicaUpgrade container-selinuxUpgrade python3-criuUpgrade slirp4netnsUpgrade podman-dockerUpgrade podman-testsUpgrade libslirpUpgrade python-podman-apiUpgrade aardvark-dnsUpgrade toolbox-testsUpgrade buildah-testsUpgrade podman-gvproxyUpgrade cockpit-podman | May 4, 2022 | Apr 4, 2022 |
| Alpine Linux | — | Upgrade buildah | Oct 1, 2024 | Apr 4, 2022 |
| Centos_linux | — | Upgrade conmon-debuginfoUpgrade slirp4netnsUpgrade conmon-debugsourceUpgrade skopeo-debugsourceUpgrade podman-pluginsUpgrade python3-podmanUpgrade skopeo-testsUpgrade fuse-overlayfs-debuginfoUpgrade podman-gvproxyUpgrade slirp4netns-debugsourceUpgrade python-podman-apiUpgrade containernetworking-plugins-debugsourceUpgrade buildah-debugsourceUpgrade skopeo-debuginfoUpgrade cockpit-podmanUpgrade toolbox-testsUpgrade conmonUpgrade netavarkUpgrade containernetworking-plugins-debuginfoUpgrade toolboxUpgrade fuse-overlayfsUpgrade podman-catatonit-debuginfoUpgrade podman-dockerUpgrade podman-testsUpgrade criu-develUpgrade crun-debuginfoUpgrade libslirpUpgrade crunUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade buildah-debuginfoUpgrade podmanUpgrade oci-seccomp-bpf-hookUpgrade criu-libs-debuginfoUpgrade crun-debugsourceUpgrade buildahUpgrade criuUpgrade aardvark-dnsUpgrade podman-debugsourceUpgrade containers-commonUpgrade buildah-tests-debuginfoUpgrade runc-debugsourceUpgrade toolbox-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade libslirp-debugsourceUpgrade libslirp-debuginfoUpgrade criu-libsUpgrade container-selinuxUpgrade toolbox-debugsourceUpgrade critUpgrade podman-plugins-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade skopeoUpgrade podman-remoteUpgrade criu-debugsourceUpgrade criu-debuginfoUpgrade containernetworking-pluginsUpgrade runcUpgrade python3-criuUpgrade runc-debuginfoUpgrade podman-remote-debuginfoUpgrade libslirp-develUpgrade buildah-testsUpgrade podman-debuginfoUpgrade udicaUpgrade slirp4netns-debuginfoUpgrade podman-catatonit | Apr 27, 2022 | Apr 4, 2022 |
| Debian | — | Upgrade golang-github-containers-buildah | Jul 30, 2024 | Apr 4, 2022 |
| Oracle_linux | — | Upgrade containers-commonUpgrade crunUpgrade containernetworking-pluginsUpgrade criuUpgrade python3-podmanUpgrade podman-remoteUpgrade udicaUpgrade conmonUpgrade podmanUpgrade podman-pluginsUpgrade fuse-overlayfsUpgrade podman-catatonitUpgrade netavarkUpgrade skopeoUpgrade runcUpgrade python-podman-apiUpgrade oci-seccomp-bpf-hookUpgrade buildahUpgrade aardvark-dnsUpgrade skopeo-testsUpgrade libslirpUpgrade criu-libsUpgrade container-selinuxUpgrade podman-testsUpgrade critUpgrade libslirp-develUpgrade slirp4netnsUpgrade podman-dockerUpgrade criu-develUpgrade buildah-testsUpgrade cockpit-podmanUpgrade python3-criuUpgrade podman-gvproxy | Apr 29, 2022 | Mar 30, 2022 |
| Redhat_linux | — | Upgrade crun-debugsourceUpgrade buildah-debugsourceUpgrade buildah-tests-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade toolbox-debugsourceUpgrade conmonUpgrade fuse-overlayfsUpgrade toolboxUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade netavarkUpgrade fuse-overlayfs-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade containernetworking-pluginsUpgrade slirp4netns-debugsourceUpgrade podman-remote-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade skopeo-testsUpgrade podman-testsUpgrade libslirpUpgrade podman-catatonit-debuginfoUpgrade podman-catatonitNo solution existsUpgrade crunUpgrade containers-commonUpgrade python3-podmanUpgrade criuUpgrade skopeoUpgrade libslirp-develUpgrade criu-develUpgrade conmon-debugsourceUpgrade podman-pluginsUpgrade criu-debuginfoUpgrade podmanUpgrade buildahUpgrade podman-gvproxy-debuginfoUpgrade crun-debuginfoUpgrade python3-criuUpgrade podman-debugsourceUpgrade criu-libsUpgrade slirp4netns-debuginfoUpgrade runcUpgrade conmon-debuginfoUpgrade runc-debugsourceUpgrade aardvark-dnsUpgrade libslirp-debuginfoUpgrade skopeo-debugsourceUpgrade runc-debuginfoUpgrade udicaUpgrade criu-debugsourceUpgrade buildah-debuginfoUpgrade criu-libs-debuginfoUpgrade python-podman-apiUpgrade podman-dockerUpgrade container-selinuxUpgrade containernetworking-plugins-debuginfoUpgrade slirp4netnsUpgrade podman-plugins-debuginfoUpgrade buildah-testsUpgrade critUpgrade podman-gvproxyUpgrade libslirp-debugsourceUpgrade podman-remoteUpgrade podman-debuginfoUpgrade cockpit-podmanUpgrade skopeo-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade toolbox-testsUpgrade toolbox-debuginfo | Apr 20, 2022 | Apr 4, 2022 |
| Rocky_linux | — | Upgrade oci-seccomp-bpf-hook-debugsourceUpgrade podman-debuginfoUpgrade skopeoUpgrade criu-libs-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade podman-remote-debuginfoUpgrade podman-plugins-debuginfoUpgrade toolbox-debuginfoUpgrade runcUpgrade runc-debuginfoUpgrade buildah-debugsourceUpgrade criu-develUpgrade critUpgrade aardvark-dnsUpgrade containernetworking-pluginsUpgrade libslirp-develUpgrade python3-criuUpgrade criu-libsUpgrade fuse-overlayfs-debuginfoUpgrade criu-debuginfoUpgrade crun-debugsourceUpgrade runc-debugsourceUpgrade podman-catatonit-debuginfoUpgrade podmanUpgrade conmon-debugsourceUpgrade criu-debugsourceUpgrade buildah-tests-debuginfoUpgrade containers-commonUpgrade fuse-overlayfs-debugsourceUpgrade podman-remoteUpgrade skopeo-testsUpgrade buildah-debuginfoUpgrade libslirp-debuginfoUpgrade conmon-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade libslirp-debugsourceUpgrade criuUpgrade crun-debuginfoUpgrade toolbox-testsUpgrade buildahUpgrade slirp4netns-debuginfoUpgrade libslirpUpgrade slirp4netns-debugsourceUpgrade podman-testsUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade fuse-overlayfsUpgrade netavarkUpgrade buildah-testsUpgrade skopeo-debuginfoUpgrade podman-pluginsUpgrade podman-catatonitUpgrade slirp4netnsUpgrade skopeo-debugsourceUpgrade toolbox-debugsourceUpgrade containernetworking-plugins-debugsourceUpgrade conmonUpgrade podman-gvproxyUpgrade toolboxUpgrade podman-debugsourceUpgrade crun | Mar 5, 2024 | Apr 4, 2022 |
| Suse | — | Upgrade buildah | Oct 26, 2022 | Apr 4, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub