Summary
[4:1.1.9-1]
- update to https://github.com/opencontainers/runc/releases/tag/v1.1.9
- Related: #2176063
[4:1.1.8-1]
- update to https://github.com/opencontainers/runc/releases/tag/v1.1.8
- Related: #2176063
[4:1.1.7-2]
- rebuild for following CVEs:
CVE-2021-43784 CVE-2022-41724 CVE-2023-28642
- Resolves: #2033659
- Resolves: #2179973
- Resolves: #2183103
[4:1.1.7-1]
- update to https://github.com/opencontainers/runc/releases/tag/v1.1.7
- Related: #2176063
[4:1.1.6-1]
- update to https://github.com/opencontainers/runc/releases/tag/v1.1.6
- Related: #2176063
[4:1.1.5-2]
- runc 1.1.5 resolves CVE-2023-25809 and CVE-2023-27561
- Resolves: #2176110
- Resolves: #2183098
[4:1.1.5-1]
- update to https://github.com/opencontainers/runc/releases/tag/v1.1.5
- Related: #2176063
[4:1.1.4-2]
- rebuild
- Resolves: #2102995
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | runc | 4:1.1.9-1.el9 |
Vulnerabilities 5
-
High 7.0
Opencontainers runc Incorrect Authorization vulnerability
runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom …
-
Medium 6.1
AppArmor bypass with symlinked /proc in runc
runc is a CLI tool for spawning and running containers according to the OCI specification. It was found that AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount configuration. This issue has been fixed in runc version…
-
Medium 6.0
Overflow in netlink bytemsg length field allows attacker to override netlink-based container configuration
runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc, netlink is used internally as a serialization system for specifying the relevant container configuration to the `C` portion of the code (responsible f…
-
Medium 5.0
rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc
runc is a CLI tool for spawning and running containers according to the OCI specification. In affected versions it was found that rootless runc makes `/sys/fs/cgroup` writable in following conditons: 1. when runc is executed inside the user namespace, and the…
-
Unscored —
Panic on large handshake records in crypto/tls
Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS handshake records which cause servers and clients, respectively, to panic when attempting to construct responses. This affects all TLS 1.3 clients, TLS 1.2 cli…