Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 61

Export CSV
CVE-2019-5736

runc: Execution of malicious containers allows for container escape and access to host filesystem

runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a command as root within one of these types of containers: (1) a new container with an attacker-controlled image, or (2) an existing container, to which the attacker previously had write access, that can be attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/self/exe.

CVSS 3.1 · 8.6 High EPSS 98.5% KEV · Not listed
Vendors
Apache Canonical D2iq and 10 more
Products
Mesos Ubuntu Linux Dc\/os and 17 more
CVE-2019-3817

libcomps: use after free when merging two objmrtrees

A use-after-free flaw has been discovered in libcomps before version 0.1.10 in the way ObjMRTrees are merged. An attacker, who is able to make an application read a crafted comps XML file, may be able to crash the application or execute malicious code.

CVSS 3.0 · 7.5 High EPSS 1.7% KEV · Not listed
Vendors
Redhat Rpm
Products
Enterprise Linux Rhel Extras Other Libcomps
CVE-2019-19921

runc: volume mount race condition with shared mounts leads to information leak/integrity manipulation

runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. (This vulnerability does not affect Docker due to an implementation detail that happens to block the attack.)

CVSS 3.1 · 7.0 High EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Linuxfoundation and 2 more
Products
Ubuntu Linux Debian Linux Runc and 5 more
CVE-2019-18466

podman: resolving symlink in host filesystem leads to unexpected results of copy operation

An issue was discovered in Podman in libpod before 1.6.0. It resolves a symlink in the host context during a copy operation from the container to the host, because an undesired glob operation occurs. An attacker could create a container image containing particular symlinks that, when copied by a victim user to the host filesystem, may overwrite existing files with others from the host.

CVSS 3.1 · 5.5 Medium EPSS 1.4% KEV · Not listed
Vendors
Libpod Project Redhat
Products
Libpod Enterprise Linux Rhel Extras Other
CVE-2019-16884

runc: AppArmor/SELinux bypass with malicious image that specifies a volume at /proc

runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /proc directory.

CVSS 3.1 · 7.5 High EPSS 4.4% KEV · Not listed
Vendors
Canonical Docker Fedoraproject and 3 more
Products
Ubuntu Linux Docker Fedora and 9 more
CVE-2019-14818

dpdk: possible memory leak leads to denial of service

A flaw was found in all dpdk version 17.x.x before 17.11.8, 16.x.x before 16.11.10, 18.x.x before 18.11.4 and 19.x.x before 19.08.1 where a malicious master, or a container with access to vhost_user socket, can send specially crafted VRING_SET_NUM messages, resulting in a memory leak including file descriptors. This flaw could lead to a denial of service condition.

CVSS 3.1 · 7.5 High EPSS 2.8% KEV · Not listed
Vendors
Dpdk Fedoraproject Redhat
Products
Data Plane Development Kit Fedora Enterprise Linux and 4 more
CVE-2019-13139

docker: command injection due to a missing validation of the git ref command

In Docker before 18.09.4, an attacker who is capable of supplying or manipulating the build path for the "docker build" command would be able to gain command execution. An issue exists in the way "docker build" processes remote git URLs, and results in command injection into the underlying "git clone" command, leading to code execution in the context of the user executing the "docker build" command. This occurs because git ref can be misinterpreted as a flag.

CVSS 3.0 · 8.4 High EPSS 2.0% KEV · Not listed
Vendors
Docker Redhat
Products
Docker Rhel Extras Other
CVE-2019-10152

podman: Improper symlink resolution allows access to host files when executing `podman cp` on running containers

A path traversal vulnerability has been discovered in podman before version 1.4.0 in the way it handles symlinks inside containers. An attacker who has compromised an existing container can cause arbitrary files on the host filesystem to be read/written when an administrator tries to copy a file from/to the container.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Libpod Project Opensuse Redhat
Products
Libpod Leap Rhel Extras Other
CVE-2018-7750

python-paramiko: Authentication bypass in transport.py

transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.x before 2.2.3, 2.3.x before 2.3.2, and 2.4.x before 2.4.1 does not properly check whether authentication is completed before processing other requests, as demonstrated by channel-open. A customized SSH client can simply skip the authentication step.

CVSS 3.1 · 9.8 Critical EPSS 27.1% KEV · Not listed
Vendors
Debian Paramiko Redhat
Products
Debian Linux Paramiko Ansible Engine and 15 more
CVE-2018-20699

docker: Memory exhaustion via large integer used with --cpuset-mems or --cpuset-cpus

Docker Engine before 18.09 allows attackers to cause a denial of service (dockerd memory consumption) via a large integer in a --cpuset-mems or --cpuset-cpus value, related to daemon/daemon_unix.go, pkg/parsers/parsers.go, and pkg/sysinfo/sysinfo.go.

CVSS 3.0 · 4.9 Medium EPSS 2.2% KEV · Not listed
Vendors
Docker Redhat
Products
Engine Enterprise Linux Server Rhel Extras Other
CVE-2018-1059

dpdk: Information exposure in unchecked guest physical to host virtual address translations

The DPDK vhost-user interface does not check to verify that all the requested guest physical range is mapped and contiguous when performing Guest Physical Addresses to Host Virtual Addresses translations. This may lead to a malicious guest exposing vhost-user backend process memory. All versions before 18.02.1 are vulnerable.

CVSS 3.0 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Dpdk Redhat
Products
Ubuntu Linux Data Plane Development Kit Ceph Storage and 8 more
CVE-2018-16886

etcd: Improper Authentication in auth/store.go:AuthInfoFromTLS() via gRPC-gateway

etcd versions 3.2.x before 3.2.26 and 3.3.x before 3.3.11 are vulnerable to an improper authentication issue when role-based access control (RBAC) is used and client-cert-auth is enabled. If an etcd client server TLS certificate contains a Common Name (CN) which matches a valid RBAC username, a remote attacker may authenticate as that user with any valid (trusted) client certificate in a REST API request to the gRPC-gateway.

CVSS 3.1 · 8.1 High EPSS 4.1% KEV · Not listed
Vendors
Etcd Fedoraproject Redhat
Products
Etcd Fedora Enterprise Linux Desktop and 3 more
CVE-2018-15664

docker: symlink-exchange race attacks in docker cp

In Docker through 18.06.1-ce-rc2, the API endpoints behind the 'docker cp' command are vulnerable to a symlink-exchange attack with Directory Traversal, giving attackers arbitrary read-write access to the host filesystem with root privileges, because daemon/archive.go does not do archive operations on a frozen filesystem (or from within a chroot).

CVSS 3.0 · 7.5 High EPSS 3.4% KEV · Not listed
Vendors
Docker Redhat
Products
Docker Rhel Extras Other
CVE-2018-10933

libssh: Authentication Bypass due to improper message callbacks implementation

A vulnerability was found in libssh's server-side state machine before versions 0.7.6 and 0.8.4. A malicious client could create channels without first performing authentication, resulting in unauthorized access.

CVSS 3.0 · 9.1 Critical EPSS 91.8% KEV · Not listed
Vendors
Canonical Debian Libssh and 3 more
Products
Ubuntu Linux Debian Linux Libssh and 7 more
CVE-2018-10892

docker: container breakout without selinux in enforcing mode

The default OCI linux spec in oci/defaults{_linux}.go in Docker/Moby from 1.11 to current does not block /proc/acpi pathnames. The flaw allows an attacker to modify host's hardware like enabling/disabling bluetooth or turning up/down keyboard brightness.

CVSS 3.1 · 5.3 Medium EPSS 1.1% KEV · Not listed
Vendors
Docker Mobyproject Opensuse and 1 more
Products
Docker Moby Leap and 4 more
CVE-2018-10856

podman: Containers run as non-root users do not drop capabilities

It has been discovered that podman before version 0.6.1 does not drop capabilities when executing a container as a non-root user. This results in unnecessary privileges being granted to the container.

CVSS 3.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Libpod Project Redhat
Products
Libpod Rhel Extras Other
CVE-2018-1000656

python-flask: Denial of Service via crafted JSON file

The Pallets Project flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. This attack appear to be exploitable via Attacker provides JSON data in incorrect encoding. This vulnerability appears to have been fixed in 0.12.3. NOTE: this may overlap CVE-2019-1010083.

CVSS 3.1 · 7.5 High EPSS 3.9% KEV · Not listed
Vendors
Netapp Palletsprojects Redhat
Products
Active Iq Hyper Converged Infrastructure Ontap Select Deploy Utility and 2 more
CVE-2014-9356

docker: Path traversal during processing of absolute symlinks

Path traversal vulnerability in Docker before 1.3.3 allows remote attackers to write to arbitrary files and bypass a container protection mechanism via a full pathname in a symlink in an (1) image or (2) build in a Dockerfile.

CVSS 3.1 · 8.6 High EPSS 4.9% KEV · Not listed
Vendors
Docker Redhat
Products
Docker Rhel Extras Other