A flaw was found in buildah where containers were incorrectly started with non-empty default permissions. A bug was found in Moby (Docker Engine) where containers were incorrectly started with non-empty inheritable Linux process capabilities, enabling an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs. This has the potential to impact confidentiality and integrity.
CVSS Details
- CVSS 3.1 Base Score: 6.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade aardvark-dnsUpgrade python-podman-apiUpgrade podman-gvproxyUpgrade buildah-testsUpgrade buildahUpgrade container-selinuxUpgrade critUpgrade python3-criuUpgrade slirp4netnsUpgrade cockpit-podmanUpgrade udicaUpgrade podman-dockerUpgrade toolbox-testsUpgrade libslirpUpgrade podman-testsUpgrade skopeo-testsUpgrade containers-commonUpgrade netavarkUpgrade toolboxUpgrade python3-podmanUpgrade containernetworking-pluginsUpgrade oci-seccomp-bpf-hookUpgrade skopeoUpgrade podman-pluginsUpgrade podman-remoteUpgrade criu-libsUpgrade crunUpgrade podmanUpgrade conmonUpgrade runcUpgrade libslirp-develUpgrade podman-catatonitUpgrade criu-develUpgrade fuse-overlayfsUpgrade criu | May 4, 2022 | Apr 4, 2022 |
| Alpine Linux | — | Upgrade buildah | Oct 1, 2024 | Apr 4, 2022 |
| Centos_linux | — | Upgrade python3-criuUpgrade buildah-tests-debuginfoUpgrade criu-debugsourceUpgrade criu-debuginfoUpgrade runcUpgrade containernetworking-pluginsUpgrade udicaUpgrade buildah-debuginfoUpgrade podman-remoteUpgrade runc-debugsourceUpgrade libslirp-develUpgrade podman-remote-debuginfoUpgrade buildah-testsUpgrade toolbox-debuginfoUpgrade runc-debuginfoUpgrade aardvark-dnsUpgrade skopeoUpgrade buildahUpgrade containers-commonUpgrade podmanUpgrade fuse-overlayfs-debugsourceUpgrade podman-catatonitUpgrade criu-libsUpgrade libslirp-debuginfoUpgrade container-selinuxUpgrade libslirp-debugsourceUpgrade crun-debugsourceUpgrade toolbox-debugsourceUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade podman-debugsourceUpgrade podman-debuginfoUpgrade slirp4netns-debuginfoUpgrade podman-plugins-debuginfoUpgrade critUpgrade criu-libs-debuginfoUpgrade criuUpgrade oci-seccomp-bpf-hookUpgrade podman-gvproxy-debuginfoUpgrade cockpit-podmanUpgrade toolboxUpgrade fuse-overlayfsUpgrade podman-testsUpgrade conmonUpgrade skopeo-testsUpgrade buildah-debugsourceUpgrade conmon-debugsourceUpgrade slirp4netnsUpgrade crunUpgrade python3-podmanUpgrade toolbox-testsUpgrade crun-debuginfoUpgrade slirp4netns-debugsourceUpgrade netavarkUpgrade podman-pluginsUpgrade containernetworking-plugins-debugsourceUpgrade conmon-debuginfoUpgrade libslirpUpgrade criu-develUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade python-podman-apiUpgrade containernetworking-plugins-debuginfoUpgrade podman-catatonit-debuginfoUpgrade podman-dockerUpgrade skopeo-debugsourceUpgrade skopeo-debuginfoUpgrade podman-gvproxyUpgrade fuse-overlayfs-debuginfo | Apr 27, 2022 | Apr 4, 2022 |
| Debian | — | Upgrade golang-github-containers-buildah | Jul 30, 2024 | Apr 4, 2022 |
| Oracle_linux | — | Upgrade oci-seccomp-bpf-hookUpgrade container-selinuxUpgrade buildahUpgrade critUpgrade slirp4netnsUpgrade skopeo-testsUpgrade criu-libsUpgrade aardvark-dnsUpgrade buildah-testsUpgrade podman-gvproxyUpgrade cockpit-podmanUpgrade criu-develUpgrade podman-testsUpgrade podman-dockerUpgrade libslirp-develUpgrade python3-criuUpgrade libslirpUpgrade python-podman-apiUpgrade udicaUpgrade runcUpgrade podman-remoteUpgrade podman-catatonitUpgrade skopeoUpgrade netavarkUpgrade containers-commonUpgrade criuUpgrade conmonUpgrade podmanUpgrade podman-pluginsUpgrade python3-podmanUpgrade crunUpgrade containernetworking-pluginsUpgrade fuse-overlayfs | Apr 29, 2022 | Mar 30, 2022 |
| Redhat_linux | — | Upgrade buildah-testsUpgrade buildah-debuginfoUpgrade runc-debugsourceUpgrade skopeo-debuginfoUpgrade libslirp-debugsourceUpgrade podman-debuginfoUpgrade slirp4netnsUpgrade podman-debugsourceUpgrade criu-debugsourceUpgrade cockpit-podmanUpgrade libslirp-debuginfoUpgrade container-selinuxUpgrade fuse-overlayfs-debugsourceUpgrade containernetworking-plugins-debuginfoUpgrade podman-dockerUpgrade slirp4netns-debuginfoUpgrade podman-gvproxyUpgrade runcUpgrade critUpgrade podman-gvproxy-debuginfoUpgrade toolbox-testsUpgrade aardvark-dnsUpgrade python3-criuUpgrade runc-debuginfoUpgrade crun-debuginfoUpgrade udicaUpgrade criu-libs-debuginfoUpgrade skopeo-debugsourceUpgrade criu-libsUpgrade python-podman-apiUpgrade toolbox-debuginfoUpgrade podman-remoteUpgrade podman-plugins-debuginfoUpgrade conmon-debuginfoUpgrade buildahUpgrade containers-commonUpgrade toolboxUpgrade crun-debugsourceUpgrade containernetworking-plugins-debugsourceUpgrade buildah-debugsourceUpgrade conmon-debugsourceUpgrade podmanUpgrade criuNo solution existsUpgrade podman-catatonitUpgrade libslirp-develUpgrade criu-debuginfoUpgrade toolbox-debugsourceUpgrade conmonUpgrade skopeoUpgrade containernetworking-pluginsUpgrade netavarkUpgrade libslirpUpgrade podman-pluginsUpgrade oci-seccomp-bpf-hookUpgrade podman-catatonit-debuginfoUpgrade podman-remote-debuginfoUpgrade skopeo-testsUpgrade slirp4netns-debugsourceUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade podman-testsUpgrade python3-podmanUpgrade buildah-tests-debuginfoUpgrade criu-develUpgrade fuse-overlayfs-debuginfoUpgrade fuse-overlayfsUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade crun | Apr 20, 2022 | Apr 4, 2022 |
| Rocky_linux | — | Upgrade podman-remoteUpgrade podman-debuginfoUpgrade libslirp-develUpgrade podman-catatonit-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade criu-debugsourceUpgrade criu-libsUpgrade containernetworking-pluginsUpgrade criu-libs-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade runc-debugsourceUpgrade buildah-debuginfoUpgrade crun-debugsourceUpgrade buildah-tests-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade criu-develUpgrade criu-debuginfoUpgrade skopeo-testsUpgrade conmon-debugsourceUpgrade containers-commonUpgrade libslirp-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade aardvark-dnsUpgrade runc-debuginfoUpgrade buildah-debugsourceUpgrade runcUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade podman-plugins-debuginfoUpgrade critUpgrade podman-remote-debuginfoUpgrade python3-criuUpgrade skopeoUpgrade podmanUpgrade toolbox-debuginfoUpgrade slirp4netns-debuginfoUpgrade toolboxUpgrade podman-debugsourceUpgrade crun-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade fuse-overlayfsUpgrade podman-testsUpgrade slirp4netns-debugsourceUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade conmon-debuginfoUpgrade netavarkUpgrade libslirp-debugsourceUpgrade criuUpgrade buildahUpgrade toolbox-testsUpgrade libslirpUpgrade slirp4netnsUpgrade skopeo-debugsourceUpgrade podman-catatonitUpgrade buildah-testsUpgrade skopeo-debuginfoUpgrade containernetworking-plugins-debugsourceUpgrade conmonUpgrade toolbox-debugsourceUpgrade podman-pluginsUpgrade crunUpgrade podman-gvproxy | Mar 5, 2024 | Apr 4, 2022 |
| Suse | — | Upgrade buildah | Oct 26, 2022 | Apr 4, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub