Lucene search

CVE-2019-5736

🗓️ 11 Feb 2019 19:00:29Reported by [email protected]Type

runc 1.0-rc6 allows attackers to execute commands as root in Docker before 18.09.

5 of 5AI Insights are available for you today

Leverage the power of AI to quickly understand vulnerabilities, impacts, and exploitability

Reporter	Title	Published	Views	Family All 199
0day.today	runc < 1.0-rc6 (Docker < 18.09.2) - Container Breakout (2)	15 Feb 201900:00	–	zdt
0day.today	runC < 1.0-rc6 (Docker < 18.09.2) - Host Command Execution Exploit	12 Feb 201900:00	–	zdt
Tenable Nessus	EulerOS 2.0 SP2 : docker-engine (EulerOS-SA-2019-1061)	22 Feb 201900:00	–	nessus
Tenable Nessus	Fedora 28 : moby-engine (2019-829524f28f)	19 Feb 201900:00	–	nessus
Tenable Nessus	openSUSE Security Update : docker-runc (openSUSE-2019-201)	19 Feb 201900:00	–	nessus
Tenable Nessus	Fedora 28 : 2:runc (2019-963ea958f9)	21 Feb 201900:00	–	nessus
Tenable Nessus	Fedora 29 : 2:docker-latest (2019-4dc1e39b34)	25 Feb 201900:00	–	nessus
Tenable Nessus	openSUSE Security Update : lxc (openSUSE-2019-2245)	4 Oct 201900:00	–	nessus
Tenable Nessus	EulerOS 2.0 SP5 : docker-engine (EulerOS-SA-2019-1074)	8 Mar 201900:00	–	nessus
Tenable Nessus	Amazon Linux AMI : docker (ALAS-2019-1156)	12 Feb 201900:00	–	nessus

Nvd

Node

docker dockerRange<18.09.2

Node

linuxfoundation runcRange≤0.1.1

linuxfoundation runcMatch1.0.0rc1

linuxfoundation runcMatch1.0.0rc2

linuxfoundation runcMatch1.0.0rc3

linuxfoundation runcMatch1.0.0rc4

linuxfoundation runcMatch1.0.0rc5

linuxfoundation runcMatch1.0.0rc6

Node

redhat container_development_kitMatch3.7

redhat openshiftMatch3.4

redhat openshiftMatch3.5

redhat openshiftMatch3.6

redhat openshiftMatch3.7

redhat enterprise_linuxMatch8.0

redhat enterprise_linux_serverMatch7.0

Node

google kubernetes_engineMatch-

Node

linuxcontainers lxcRange<3.2.0

Node

hp onesphereMatch-

Node

netapp hci_management_nodeMatch-

netapp solidfireMatch-

Node

apache mesosRange1.4.0–1.4.3

apache mesosRange1.5.0–1.5.3

apache mesosRange1.6.0–1.6.2

apache mesosRange1.7.0–1.7.2

Node

opensuse backports_sleMatch15.0-

opensuse backports_sleMatch15.0sp1

opensuse leapMatch15.0

opensuse leapMatch15.1

opensuse leapMatch42.3

Node

d2iq kubernetes_engineRange<2.2.0-1.13.3

d2iq dc/osRange<1.10.10

d2iq dc/osRange1.10.11–1.11.9

d2iq dc/osRange1.11.10–1.12.1

Node

fedoraproject fedoraMatch29

fedoraproject fedoraMatch30

Node

canonical ubuntu_linuxMatch16.04lts

canonical ubuntu_linuxMatch18.04lts

canonical ubuntu_linuxMatch18.10

canonical ubuntu_linuxMatch19.04

Node

microfocus service_management_automationMatch2018.02

microfocus service_management_automationMatch2018.05

microfocus service_management_automationMatch2018.08

microfocus service_management_automationMatch2018.11

Source	Link
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EGZKRCKI3Y7FMADO2MENMT4TU24QGHFR/
github	www.github.com/q3k/cve-2019-5736-poc
access	www.access.redhat.com/errata/RHSA-2019:0408
access	www.access.redhat.com/security/cve/cve-2019-5736
lists	www.lists.opensuse.org/opensuse-security-announce/2019-05/msg00073.html
github	www.github.com/Frichetten/CVE-2019-5736-PoC
lists	www.lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V6A4OSFM5GGOWW4ECELV5OHX2XRAUSPH/
openwall	www.openwall.com/lists/oss-security/2019/10/24/1
brauner	www.brauner.github.io/2019/02/12/privileged-containers.html
lists	www.lists.apache.org/thread.html/rc494623986d76593873ce5a40dd69cb3629400d10750d5d7e96b8587%40%3Cdev.dlab.apache.org%3E

Transform Your Security Services

Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.

Book a live demo

11 Feb 2019 19:29Current

8.7High risk

Vulners AI Score8.7

CVSS29.3

CVSS38.6

EPSS0.52476

CWE-78