A flaw was found in buildah where containers were incorrectly started with non-empty default permissions. A bug was found in Moby (Docker Engine) where containers were incorrectly started with non-empty inheritable Linux process capabilities, enabling an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs. This has the potential to impact confidentiality and integrity.
CVSS Details
- CVSS 3.1 Base Score: 6.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python3-criuUpgrade buildah-testsUpgrade libslirpUpgrade toolbox-testsUpgrade udicaUpgrade cockpit-podmanUpgrade python-podman-apiUpgrade podman-gvproxyUpgrade podman-testsUpgrade slirp4netnsUpgrade container-selinuxUpgrade critUpgrade buildahUpgrade podman-dockerUpgrade aardvark-dnsUpgrade skopeo-testsUpgrade fuse-overlayfsUpgrade podman-pluginsUpgrade containers-commonUpgrade criu-libsUpgrade podmanUpgrade runcUpgrade libslirp-develUpgrade criuUpgrade netavarkUpgrade skopeoUpgrade containernetworking-pluginsUpgrade criu-develUpgrade podman-remoteUpgrade crunUpgrade oci-seccomp-bpf-hookUpgrade podman-catatonitUpgrade toolboxUpgrade conmonUpgrade python3-podman | May 4, 2022 | Apr 4, 2022 |
| Alpine Linux | — | Upgrade buildah | Oct 1, 2024 | Apr 4, 2022 |
| Centos_linux | — | Upgrade podman-gvproxyUpgrade toolbox-testsUpgrade crunUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade libslirpUpgrade slirp4netns-debugsourceUpgrade skopeo-testsUpgrade slirp4netnsUpgrade buildah-debugsourceUpgrade podman-catatonit-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade skopeo-debugsourceUpgrade fuse-overlayfs-debuginfoUpgrade podman-pluginsUpgrade python-podman-apiUpgrade containernetworking-plugins-debugsourceUpgrade conmon-debuginfoUpgrade netavarkUpgrade toolboxUpgrade python3-podmanUpgrade cockpit-podmanUpgrade skopeo-debuginfoUpgrade fuse-overlayfsUpgrade conmon-debugsourceUpgrade podman-dockerUpgrade criu-develUpgrade podman-testsUpgrade crun-debuginfoUpgrade conmonUpgrade criu-libsUpgrade toolbox-debuginfoUpgrade podman-remote-debuginfoUpgrade libslirp-develUpgrade podman-plugins-debuginfoUpgrade crun-debugsourceUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade podman-catatonitUpgrade buildah-testsUpgrade podman-debugsourceUpgrade udicaUpgrade podman-gvproxy-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade criu-libs-debuginfoUpgrade critUpgrade containernetworking-pluginsUpgrade skopeoUpgrade runc-debugsourceUpgrade podman-remoteUpgrade fuse-overlayfs-debugsourceUpgrade criu-debugsourceUpgrade libslirp-debuginfoUpgrade container-selinuxUpgrade toolbox-debugsourceUpgrade podmanUpgrade runcUpgrade criu-debuginfoUpgrade buildah-tests-debuginfoUpgrade libslirp-debugsourceUpgrade runc-debuginfoUpgrade criuUpgrade slirp4netns-debuginfoUpgrade containers-commonUpgrade buildah-debuginfoUpgrade buildahUpgrade aardvark-dnsUpgrade python3-criuUpgrade podman-debuginfo | Apr 27, 2022 | Apr 4, 2022 |
| Debian | — | Upgrade golang-github-containers-buildah | Jul 30, 2024 | Apr 4, 2022 |
| Oracle_linux | — | Upgrade skopeoUpgrade udicaUpgrade fuse-overlayfsUpgrade crunUpgrade runcUpgrade netavarkUpgrade podman-remoteUpgrade containers-commonUpgrade containernetworking-pluginsUpgrade podman-catatonitUpgrade podman-pluginsUpgrade python3-podmanUpgrade conmonUpgrade podmanUpgrade criuUpgrade criu-libsUpgrade container-selinuxUpgrade buildahUpgrade oci-seccomp-bpf-hookUpgrade critUpgrade slirp4netnsUpgrade python3-criuUpgrade aardvark-dnsUpgrade libslirpUpgrade skopeo-testsUpgrade python-podman-apiUpgrade podman-testsUpgrade podman-gvproxyUpgrade buildah-testsUpgrade criu-develUpgrade cockpit-podmanUpgrade podman-dockerUpgrade libslirp-devel | Apr 29, 2022 | Mar 30, 2022 |
| Redhat_linux | — | Upgrade fuse-overlayfs-debuginfoUpgrade podman-catatonitUpgrade conmonUpgrade podman-remote-debuginfoUpgrade libslirpUpgrade skopeo-testsUpgrade oci-seccomp-bpf-hookUpgrade slirp4netnsUpgrade skopeo-debugsourceUpgrade crun-debuginfoUpgrade udicaUpgrade podman-gvproxy-debuginfoUpgrade cockpit-podmanUpgrade criu-debugsourceUpgrade libslirp-debuginfoUpgrade runcUpgrade runc-debuginfoUpgrade podman-remoteUpgrade libslirp-debugsourceUpgrade buildah-tests-debuginfoUpgrade podman-catatonit-debuginfoUpgrade buildahUpgrade buildah-testsUpgrade toolbox-debuginfoUpgrade criu-libsUpgrade skopeo-debuginfoUpgrade runc-debugsourceUpgrade podman-plugins-debuginfoUpgrade podman-gvproxyUpgrade aardvark-dnsUpgrade podman-debuginfoUpgrade critUpgrade buildah-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade python3-criuUpgrade podman-debugsourceUpgrade toolbox-testsUpgrade python-podman-apiUpgrade podman-dockerUpgrade slirp4netns-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade container-selinuxUpgrade criu-libs-debuginfoUpgrade conmon-debuginfoUpgrade slirp4netns-debugsourceUpgrade libslirp-develUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade criu-debuginfoUpgrade criu-develUpgrade skopeoUpgrade crun-debugsourceUpgrade python3-podmanUpgrade containernetworking-plugins-debugsource | Apr 20, 2022 | Apr 4, 2022 |
| Rocky_linux | — | Upgrade criu-debuginfoUpgrade buildah-tests-debuginfoUpgrade runc-debugsourceUpgrade skopeo-testsUpgrade aardvark-dnsUpgrade fuse-overlayfs-debuginfoUpgrade critUpgrade libslirp-develUpgrade runc-debuginfoUpgrade podman-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade podman-remoteUpgrade criu-debugsourceUpgrade podman-catatonit-debuginfoUpgrade criu-libsUpgrade runcUpgrade toolbox-debuginfoUpgrade buildah-debugsourceUpgrade criu-develUpgrade buildah-debuginfoUpgrade crun-debugsourceUpgrade fuse-overlayfs-debugsourceUpgrade python3-criuUpgrade containernetworking-pluginsUpgrade criu-libs-debuginfoUpgrade podman-remote-debuginfoUpgrade podmanUpgrade podman-plugins-debuginfoUpgrade libslirp-debuginfoUpgrade containers-commonUpgrade oci-seccomp-bpf-hookUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade conmon-debugsourceUpgrade skopeoUpgrade slirp4netns-debuginfoUpgrade libslirpUpgrade containernetworking-plugins-debuginfoUpgrade slirp4netnsUpgrade podman-catatonitUpgrade podman-debugsourceUpgrade crunUpgrade skopeo-debuginfoUpgrade podman-pluginsUpgrade buildah-testsUpgrade toolboxUpgrade buildahUpgrade toolbox-testsUpgrade libslirp-debugsourceUpgrade crun-debuginfoUpgrade netavarkUpgrade fuse-overlayfsUpgrade criuUpgrade conmon-debuginfoUpgrade slirp4netns-debugsourceUpgrade podman-testsUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade podman-gvproxyUpgrade containernetworking-plugins-debugsourceUpgrade conmonUpgrade toolbox-debugsourceUpgrade skopeo-debugsource | Mar 5, 2024 | Apr 4, 2022 |
| Suse | — | Upgrade buildah | Oct 26, 2022 | Apr 4, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub