CVE-2019-10144

2019-06-0319:29:01

Google

osv.dev

6.7 Medium

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

18.2%

JSON

rkt through version 1.30.0 does not isolate processes in containers that are run with rkt enter. Processes run with rkt enter are given all capabilities during stage 2 (the actual environment in which the applications run). Compromised containers could exploit this flaw to access host resources.

CPENameOperatorVersion
rkteq0.1.1
rkteq1.28.1
rkteq1.30.0
rkteq0.16.0
rkteq1.19.0
rkteq1.27.0
rkteq1.14.0
rkteq1.21.0
rkteq1.26.0
rkteq1.3.0

Name	Operator	Version
rkt	eq	0.1.1
rkt	eq	1.28.1
rkt	eq	1.30.0
rkt	eq	0.16.0
rkt	eq	1.19.0
rkt	eq	1.27.0
rkt	eq	1.14.0
rkt	eq	1.21.0
rkt	eq	1.26.0
rkt	eq	1.3.0

Rows per page:

1-10 of 641

References

bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10144

www.twistlock.com/labs-blog/breaking-out-of-coresos-rkt-3-new-cves/