Directory Traversal

Open Container Initiative umoci is vulnerable to directory traversal. It allows attackers to overwrite arbitrary host paths via a crafted image that causes symlink traversal when "umoci unpack" or "umoci raw unpack" is used...

4 Steps to Container Lifecycle Security

Containers and Kubernetes have revolutionized developing, deploying, and scaling applications and infrastructure. Learn best practices for security across the container lifecycle, so you can guard your containers against attack...

CVE-2021-29136

Open Container Initiative umoci before 0.4.7 allows attackers to overwrite arbitrary host paths via a crafted image that causes symlink traversal when "umoci unpack" or "umoci raw unpack" is used...

CVE-2021-29136

Open Container Initiative umoci before 0.4.7 allows attackers to overwrite arbitrary host paths via a crafted image that causes symlink traversal when "umoci unpack" or "umoci raw unpack" is used...

Design/Logic Flaw

Open Container Initiative umoci before 0.4.7 allows attackers to overwrite arbitrary host paths via a crafted image that causes symlink traversal when "umoci unpack" or "umoci raw unpack" is used...

Extending your FedRAMP Program to Container Infrastructure with the Qualys Cloud Platform

Following the recent release of the FedRAMP Vulnerability Scanning Requirements for Containers, FedRAMP-authorized systems that make use of containers have one month from March 16, 2021 to submit a plan for compliance with the new requirements. Organizations with a need to certify their services...

Women in Security Part 6: Meet Nandini De, Director of Engineering

This post is part of our Women’s History Month series - follow along with us on Twitter @VMwareCarbonBlack To conclude Women’s History Month, we are thrilled to bring you the last spotlight of our Women in Security series. It’s been an honor to highlight the outstanding women in the VMware Securi...

containers/openjdk: /etc/passwd is given incorrect privileges

An insecure modification flaw in the /etc/passwd file was found in the openjdk-1.8 and openjdk-11 containers. This flaw allows an attacker with access to the container to modify /etc/passwd and escalate their privileges. The highest threat from this vulnerability is to confidentiality, integrity,...

VMware Carbon Black Ranks Among Top 10 of 100 Cybersecurity Companies by the University of San Diego

We are proud to announce that VMware Carbon Black has been ranked within the top 10 organizations on the University of San Diego Cybersecurity Team’s annual list of the Top 100 Cybersecurity Companies of 2020. The annual list of cybersecurity companies highlights the most influential players in a...

Unbreakable Enterprise kernel-container security update

5.4.17-2036.104.5.el7 - scsi: iscsi: Verify lengths on passthrough PDUs Chris Leech Orabug: 32603379 CVE-2021-27363 CVE-2021-27364 CVE-2021-27365 - scsi: iscsi: Ensure sysfs attributes are limited to PAGESIZE Chris Leech Orabug: 32603379 CVE-2021-27363 CVE-2021-27364 CVE-2021-27365 - scsi: iscsi:...

Securing Containers and Kubernetes-Orchestrated Environments

In a recent Black Hat webcast, “Securing Containers and Kubernetes-Orchestrated Environments,” sponsored by VMware Carbon Black, guest speakers Sheila A. Berta, Offensive Security Specialist, Dreamlab Technologies and Haim Helman, CTO, VMware Carbon Black App Security, VMware Security Business...

Amazon ECS Exec Now Works with Containers in AWS Fargate

Building in containers offers amazing benefits for development teams – speed, agility, flexibility, scalability, etc...

Important: Red Hat Security Advisory: Red Hat Ansible Tower 3.6.7-1 - Container security and bug fix update

Red Hat Ansible Tower 3.6.7-1 - RHEL7 Container Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the...

container-tools:1.0 security update

buildah 1.5-8.gite94b4f9.0.1 - Fixes troubles with oracle registry login Orabug: 29937283 1.5-8.gite94b4f9 - bump release to preserve upgrade path - Related: 1821193 1.5-4.gite94b4f9 - fix 'CVE-2020-10696 buildah: crafted input tar file may lead to local file overwriting during image build proces...

podman: container users permissions are not respected in privileged containers

A flaw was found in podman. File permissions for non-root users running in a privileged container are not correctly checked. This flaw can be abused by a low-privileged user inside the container to access any other file in the container, even if owned by the root user inside the container. It doe...

How to use Rancher in Kubernetes

Author Chuck Losh sets up a test deployment of Rancher to "reign in" his local test Docker-Desktop Kubernetes cluster, then sets up a private helm catalog to deploy Trend Micro Cloud One Container Security components...

CVE-2021-20188

A flaw was found in podman before 1.7.0. File permissions for non-root users running in a privileged container are not correctly checked. This flaw can be abused by a low-privileged user inside the container to access any other file in the container, even if owned by the root user inside the...

CVE-2021-20188

CVE-2021-20188 affects podman before 1.7.0. The flaw: file permissions for non-root users in privileged containers are not correctly checked, enabling a low-privilege container user to access other files within the same container (even if root-owned). It does not enable direct container escape; h...

Unbreakable Enterprise kernel-container security update

4.14.35-2025.405.3.el7 - Revert 'rds: Deregister all FRWR mr with freemr' aru kolappan Orabug: 32426280 4.14.35-2025.405.2.el7 - nfs: Fix security label length not being reset Jeffrey Mitchell Orabug: 32350995 4.14.35-2025.405.1.el7 - net/rds: Fix gfpt parameter Hans Westgaard Ry Orabug: 32372162...

Deploying The New VMware Carbon Black Container Security Solution

“VMware acquired Octarine, a privately held company in Sunnyvale, California on May 27, 2020. Octarine offers a cloud-native security platform for the complete lifecycle of applications running on Kubernetes, helping customers to protect their cloud-native apps from build to runtime. Acquiring...