Skip to content
OpenAdvisories
High ELSA-2019-4550 2 CVEs

Important: docker-engine security update (Oracle Linux 7)

Published Feb 15, 2019 · Updated Feb 15, 2019

Ecosystem: Oracle Linux

Summary

[17.06.2.ol-1.0.6]
- update the version string of runc to show the CVE fixed

[17.06.2.ol-1.0.4]
- build using Go 1.10.8
- apply fix for runc CVE-2019-5736

[17.06.2.ol-1.0.3]
- spec: do not replace config files (Jacob Wen) [Orabug: 28235986]

Fixed packages 1

ReleasePackageFixed in
Oracle Linux · 7 docker-engine 0:17.06.2.ol-1.0.6.el7

Vulnerabilities 2

  • Unscored —
    CVE-2019-5736 Public exploit EPSS 98%

    runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc …

    docker.io runc runc runc Debian Ubuntu Alpine
  • Unscored —
    CVE-2019-6486

    Denial of service affecting P-521 and P-384 curves in crypto/elliptic

    Go before 1.10.8 and 1.11.x before 1.11.5 mishandles P-521 and P-384 elliptic curves, which allows attackers to cause a denial of service (CPU consumption) or possibly conduct ECDH private key recovery attacks.

    golang go stdlib golang-1.8 Ubuntu Azure Linux Alpine Go