250 matches found
CVE-2026-5555-Container-Escape-via-proc-self-fd-Symlink-in-Shared-Volume
CVE-2026-5555 – /proc/self/fd 심볼릭 링크를 통한 컨테이너 탈출 개요 rshared 전파propagation로 마운트된 공유 볼륨은 악성 컨테이너가 /proc/self/fd를 통해 호스트 파일을 가리키는 심볼릭 링크를 생성할 수 있게 합니다. 볼륨에 쓰는 호스트 프로세스는 심볼릭 링크를 따라가며 중요한 호스트 파일을 덮어쓰고 컨테이너를 탈출할 수 있습니다. 취약점 세부 정보 유형: 컨테이너 탈출 / 심볼릭 링크 공격 영향: 호스트 파일 덮어쓰기, 호스트에서 루트 권한 상승. 근본 원인: 컨테이너 런타임이...
CVE-2026-45699
Netatalk is a Free and Open Source file server suite for Unix-like operating systems. In versions 3.1.19 through 4.4.2, a stack-based buffer overflow exists in the copydir function of Netatalk's afpd daemon due to an integer underflow in the calculation of the remaining buffer size used for path...
CVE-2026-50568
Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version 1.25.0, SanitizeFilePath in pkg/utils/utils.go validated that a path stayed under a safe directory by calling strings.HasPrefixpath,...
PT-2026-48513
Name of the Vulnerable Software and Affected Versions Fission versions prior to 1.25.0 Description Fission is a Kubernetes-native serverless framework. The SanitizeFilePath function in pkg/utils/utils.go performs a lexical check using strings.HasPrefixpath, safedir to ensure a path remains within...
Fission 安全漏洞
Fission is an open-source function deployment framework based on Kubernetes. Versions of Fission prior to 1.25.0 contain security vulnerabilities. These vulnerabilities stem from the SanitizeFilePath function, which uses string prefix checks instead of directory boundary checks. As a result,...
Fission builder accepts arbitrary buildcmd strings from Environment.spec.builder.command, allowing the builder pod to invoke arbitrary executables
Summary Before the round-1 security sweep, pkg/builder/builder.go passed Environment.spec.builder.command directly into exec.Command... after a strings.Fields split, with no validation of the executable path or its arguments. A user who could create or update Environment CRDs in a namespace...
PT-2026-42605
Summary Before the round-1 security sweep, pkg/builder/builder.go passed Environment.spec.builder.command directly into exec.Command... after a strings.Fields split, with no validation of the executable path or its arguments. A user who could create or update Environment CRDs in a namespace...
EUVD-2022-33559
Malicious code in bioql PyPI...
EUVD-2022-29418
Malicious code in bioql PyPI...
EUVD-2022-31334
Malicious code in bioql PyPI...
EUVD-2022-33532
Malicious code in bioql PyPI...
EUVD-2022-33560
Malicious code in bioql PyPI...
EUVD-2022-33548
Malicious code in bioql PyPI...
EUVD-2022-33533
Malicious code in bioql PyPI...
EUVD-2022-33530
Malicious code in bioql PyPI...
EUVD-2022-33545
Malicious code in bioql PyPI...
EUVD-2022-29365
Malicious code in bioql PyPI...
EUVD-2022-33544
Malicious code in bioql PyPI...
runc 安全漏洞
runc is an Open Container Initiative open source CLI Command Line Interface tool for generating and running containers according to the OCI specification. A security vulnerability exists in runc version 1.1.13 and earlier and version 1.2.0-rc2 and earlier, which stems from a contention condition ...
runc: volume mount race condition (regression of CVE-2019-19921)
A flaw was found in runc. An attacker who controls the container image for two containers that share a volume can race volume mounts during container initialization by adding a symlink to the rootfs that points to a directory on the volume...