CVE-2019-18837

2019-11-1320:01:16

trellix

www.cve.org

8.4 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

61.3%

JSON

An issue was discovered in crun before 0.10.5. With a crafted image, it doesn’t correctly check whether a target is a symlink, resulting in access to files outside of the container. This occurs in libcrun/linux.c and libcrun/chroot_realpath.c.

CNA Affected

[
  {
    "product": "crun",
    "vendor": "crun",
    "versions": [
      {
        "status": "affected",
        "version": "before 0.10.5"
      }
    ]
  }
]