Skip to content
OpenAdvisories
High ELSA-2021-9329 1 CVE

Important: docker-engine docker-cli security update (Oracle Linux 7)

Published Jun 29, 2021 · Updated Jun 29, 2021

Ecosystem: Oracle Linux

Summary

docker-engine
[19.03.11-11]
- Addresses CVE-2021-30465 - updated runc minimum version to runc >= 3:1.0.0-1.rc95.

[19.03.11-10]
- Addresses runc CVE-2021-30465 - updated runc versions in cli/vendor.conf and docker-engine/vendor.conf to 1.0.0-rc95.

Fixed packages 2

ReleasePackageFixed in
Oracle Linux · 7 docker-cli 0:19.03.11.ol-11.el7
Oracle Linux · 7 docker-engine 0:19.03.11.ol-11.el7

Vulnerabilities 1

  • High 7.6
    CVE-2021-30465 EPSS 10%

    mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs

    runc before 1.0.0-rc95 allows a Container Filesystem Breakout via Directory Traversal. To exploit the vulnerability, an attacker must be able to create multiple containers with a fairly specific mount configuration. The problem occurs via a symlink-exchange a…

    buildah runc github.com/opencontainers/runc k3s Debian Ubuntu Azure Linux Alpine Go