Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 61

Export CSV
CVE-2024-21626

runc container breakout through process.cwd trickery and leaked fds

runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc 1.1.11 and earlier, due to an internal file descriptor leak, an attacker could cause a newly-spawned container process (from runc exec) to have a working directory in the host filesystem namespace, allowing for a container escape by giving access to the host filesystem ("attack 2"). The same attack could be used by a malicious image to allow a container process to gain access to the host filesystem through runc run ("attack 1"). Variants of attacks 1 and 2 could be also be used to overwrite semi-arbitrary host binaries, allowing for complete container escapes ("attack 3a" and "attack 3b"). runc 1.1.12 includes patches for this issue.

CVSS 3.1 · 8.6 High EPSS 18.9% KEV · Not listed
Vendors
Fedoraproject Linuxfoundation Redhat
Products
Fedora Runc Enterprise Linux and 7 more
CVE-2017-7550

ansible: jenkins_plugin module exposes passwords in remote host logs

A flaw was found in the way Ansible (2.3.x before 2.3.3, and 2.4.x before 2.4.1) passed certain parameters to the jenkins_plugin module. Remote attackers could use this flaw to expose sensitive information from a remote host's logs. This flaw was fixed by not allowing passwords to be specified in the "params" argument, and noting this in the module documentation.

CVSS 3.1 · 9.8 Critical EPSS 3.5% KEV · Not listed
Vendors
Redhat
Products
Ansible Enterprise Linux Server Rhel Extras Other
CVE-2017-11468

docker-distribution: Does not properly restrict the amount of content accepted from a user

Docker Registry before 2.6.2 in Docker Distribution does not properly restrict the amount of content accepted from a user, which allows remote attackers to cause a denial of service (memory consumption) via the manifest endpoint.

CVSS 3.1 · 7.5 High EPSS 3.2% KEV · Not listed
Vendors
Docker Redhat
Products
Docker Registry Enterprise Linux Server Rhel Extras Other
CVE-2016-9962

docker: insecure opening of file-descriptor allows privilege escalation

RunC allowed additional container processes via 'runc exec' to be ptraced by the pid 1 of the container. This allows the main processes of the container, if running as root, to gain access to file-descriptors of these new processes during the initialization and can lead to container escapes or modification of runC state before the process is fully placed inside the container.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Docker Redhat
Products
Docker Rhel Extras Other
CVE-2014-9358

docker: Path traversal and spoofing opportunities presented through image identifiers

Docker before 1.3.3 does not properly validate image IDs, which allows remote attackers to conduct path traversal attacks and spoof repositories via a crafted image in a (1) "docker load" operation or (2) "registry communications."

CVSS 2.0 · 6.4 Medium EPSS 2.5% KEV · Not listed
Vendors
Docker Redhat
Products
Docker Rhel Extras Other
CVE-2015-1843

docker: regression of CVE-2014-5277

The Red Hat docker package before 1.5.0-28, when using the --add-registry option, falls back to HTTP when the HTTPS connection to the registry fails, which allows man-in-the-middle attackers to conduct downgrade attacks and obtain authentication and image data by leveraging a network position between the client and the registry to block HTTPS traffic. NOTE: this vulnerability exists because of a CVE-2014-5277 regression.

CVSS 2.0 · 4.3 Medium EPSS 1.6% KEV · Not listed
Vendors
Redhat
Products
Docker Rhel Extras Other
CVE-2014-6407

docker: symbolic and hardlink issues leading to privilege escalation

Docker before 1.3.2 allows remote attackers to write to arbitrary files and execute arbitrary code via a (1) symlink or (2) hard link attack in an image archive in a (a) pull or (b) load operation.

CVSS 2.0 · 7.5 High EPSS 4.9% KEV · Not listed
Vendors
Docker Redhat
Products
Docker Rhel Extras Other
CVE-2014-9357

docker: Escalation of privileges during decompression of LZMA archives

Docker 1.3.2 allows remote attackers to execute arbitrary code with root privileges via a crafted (1) image or (2) build in a Dockerfile in an LZMA (.xz) archive, related to the chroot for archive extraction.

CVSS 2.0 · 10.0 Critical EPSS 6.2% KEV · Not listed
Vendors
Docker Redhat
Products
Docker Rhel Extras Other
CVE-2015-3630

docker: Read/write proc paths allow host modification & information disclosure

Docker Engine before 1.6.1 uses weak permissions for (1) /proc/asound, (2) /proc/timer_stats, (3) /proc/latency_stats, and (4) /proc/fs, which allows local users to modify the host, obtain sensitive information, and perform protocol downgrade attacks via a crafted image.

CVSS 2.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Docker Redhat
Products
Docker Rhel Extras Other
CVE-2015-3631

docker: volume mounts allow LSM profile escalation

Docker Engine before 1.6.1 allows local users to set arbitrary Linux Security Modules (LSM) and docker_t policies via an image that allows volumes to override files in /proc.

CVSS 2.0 · 3.6 Low EPSS < 1% KEV · Not listed
Vendors
Docker Redhat
Products
Docker Rhel Extras Other
CVE-2016-0739

libssh: bits/bytes confusion resulting in truncated Difffie-Hellman secret length

libssh before 0.7.3 improperly truncates ephemeral secrets generated for the (1) diffie-hellman-group1 and (2) diffie-hellman-group14 key exchange methods to 128 bits, which makes it easier for man-in-the-middle attackers to decrypt or intercept SSH sessions via unspecified vectors, aka a "bits/bytes confusion bug."

CVSS 3.0 · 5.9 Medium EPSS 2.4% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 2 more
Products
Ubuntu Linux Debian Linux Fedora and 3 more
CVE-2016-3697

docker: privilege escalation via confusion of usernames and UIDs

libcontainer/user/user.go in runC before 0.1.0, as used in Docker before 1.11.2, improperly treats a numeric UID as a potential username, which allows local users to gain privileges via a numeric username in the password file in a container.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Docker Linuxfoundation Opensuse and 1 more
Products
Docker Runc Opensuse and 1 more
CVE-2016-8867

docker: Ambient capability usage in containers

Docker Engine 1.12.2 enabled ambient capabilities with misconfigured capability policies. This allowed malicious images to bypass user permissions to access files within the container filesystem or mounted volumes.

CVSS 3.1 · 7.5 High EPSS 2.8% KEV · Not listed
Vendors
Docker Redhat
Products
Docker Rhel Extras Other
CVE-2015-3629

docker: symlink traversal on container respawn allows local privilege escalation

Libcontainer 1.6.0, as used in Docker Engine, allows local users to escape containerization ("mount namespace breakout") and write to arbitrary file on the host system via a symlink attack in an image when respawning a container.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Docker Opensuse Redhat
Products
Libcontainer Opensuse Rhel Extras Other
CVE-2015-3627

docker: insecure opening of file-descriptor 1 leading to privilege escalation

Libcontainer and Docker Engine before 1.6.1 opens the file-descriptor passed to the pid-1 process before performing the chroot, which allows local users to gain privileges via a symlink attack in an image.

CVSS 2.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Docker Redhat
Products
Docker Libcontainer Rhel Extras Other
CVE-2014-3499

docker: systemd socket activation results in privilege escalation

Docker 1.0.0 uses world-readable and world-writable permissions on the management socket, which allows local users to gain privileges via unspecified vectors.

CVSS 2.0 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Docker Fedoraproject Redhat
Products
Docker Fedora Rhel Extras Other
CVE-2023-30861

Flask vulnerable to possible disclosure of permanent session cookie due to missing Vary: Cookie header

Flask is a lightweight WSGI web application framework. When all of the following conditions are met, a response containing data intended for one client may be cached and subsequently sent by the proxy to other clients. If the proxy also caches `Set-Cookie` headers, it may send one client's `session` cookie to other clients. The severity depends on the application's use of the session and the proxy's behavior regarding cookies. The risk depends on all these conditions being met. 1. The application must be hosted behind a caching proxy that does not strip cookies or ignore responses with cookies. 2. The application sets `session.permanent = True` 3. The application does not access or modify the session at any point during a request. 4. `SESSION_REFRESH_EACH_REQUEST` enabled (the default). 5. The application does not set a `Cache-Control` header to indicate that a page is private or should not be cached. This happens because vulnerable versions of Flask only set the `Vary: Cookie` header when the session is accessed or modified, not when it is refreshed (re-sent to update the expiration) without being accessed or modified. This issue has been fixed in versions 2.3.2 and 2.2.5.

CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed
Vendors
Palletsprojects Redhat
Products
Flask Openshift Ironic Openstack and 2 more
CVE-2019-9514

Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service

Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both.

CVSS 3.1 · 7.5 High EPSS 82.8% KEV · Not listed
Vendors
Apache Apple Canonical and 10 more
Products
Traffic Server Mac Os X Swiftnio and 41 more
CVE-2022-2739

podman: Security regression of CVE-2020-14370 due to source code management issue

The version of podman as released for Red Hat Enterprise Linux 7 Extras via RHSA-2022:2190 advisory included an incorrect version of podman missing the fix for CVE-2020-14370, which was previously fixed via RHSA-2020:5056. This issue could possibly allow an attacker to gain access to sensitive information stored in environment variables.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Podman Project Redhat
Products
Podman Enterprise Linux Server Enterprise Linux Workstation and 1 more
CVE-2022-2738

podman: Security regression of CVE-2020-8945 due to source code management issue

The version of podman as released for Red Hat Enterprise Linux 7 Extras via RHSA-2022:2190 advisory included an incorrect version of podman missing the fix for CVE-2020-8945, which was previously fixed via RHSA-2020:2117. This issue could possibly be used to crash or cause potential code execution in Go applications that use the Go GPGME wrapper library, under certain conditions, during GPG signature verification.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Podman Project Redhat
Products
Podman Enterprise Linux Server Enterprise Linux Workstation and 1 more