UBUNTU-CVE-2022-27649

A flaw was found in Podman, where containers were started incorrectly with non-empty default permissions. A vulnerability was found in Moby Docker Engine, where containers were started incorrectly with non-empty inheritable Linux process capabilities. This flaw allows an attacker with access to...

CVE-2022-27650

CVE-2022-27650 describes a flaw where crun (and related components used by container runtimes like Moby/Docker Engine) can cause containers to start with non-empty default inheritable capabilities. The issue enables an attacker who has access to programs with inheritable file capabilities to elev...

CVE-2022-27651

A flaw was found in buildah where containers were incorrectly started with non-empty default permissions. A bug was found in Moby Docker Engine where containers were incorrectly started with non-empty inheritable Linux process capabilities, enabling an attacker with access to programs with...

CVE-2022-27652

A flaw was found in cri-o, where containers were incorrectly started with non-empty default permissions. A vulnerability was found in Moby Docker Engine where containers started incorrectly with non-empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs...

CVE-2022-24769

A flaw was found in Moby Docker Engine, where containers were started incorrectly with non-empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve2 runs...

Moby 权限许可和访问控制问题漏洞

Moby is an open source project designed to drive containerization of software and help the ecosystem mainstream container technology. A privilege licensing and access control issue vulnerability exists in versions prior to Moby 20.10.14 that stems from a container incorrectly starting with a...

cri-o: pod with access to 'hostIPC' and 'hostNetwork' kernel namespace allows sysctl from the list of safe sysctls to be applied to the host

An incorrect sysctls validation vulnerability was found in CRI-O. The sysctls from the list of "safe" sysctls specified for the cluster 0 will be applied to the host if an attacker can create a pod with a hostIPC and hostNetwork kernel namespace...

Unbreakable Enterprise kernel-container security update

5.4.17-2136.304.4.4 - arm64: Use the clearbhb instruction in mitigations James Morse Orabug: 33921646 - arm64: add IDAA64ISAR2EL1 sys register Joey Gouly Orabug: 33921646 - KVM: arm64: Allow SMCCCARCHWORKAROUND3 to be discovered and migrated James Morse Orabug: 33921646 - arm64: Mitigate spectre...

CVE-2021-3602

An information disclosure flaw was found in Buildah, when building containers using chroot isolation. Running processes in container builds e.g. Dockerfile RUN commands can access environment variables from parent and grandparent processes. When run in a container in a CI/CD environment,...

Unbreakable Enterprise kernel-container security update

4.14.35-2047.511.5.2.el7 - cgroup-v1: Require capabilities to set releaseagent Eric W. Biederman Orabug: 33876756 CVE-2022-0492 - scsi: libiscsi: Hold backlock when calling iscsicompletetask Gulam Mohamed Orabug: 33876755 4.14.35-2047.511.5.1 - arm64, mm, efi: Account for GICv3 LPI tables in stat...

7 Container Security Best Practices For Better Apps

Explore how to implement 7 container security best practices within a CI/CD pipeline built with tools from Amazon Web Services AWS...

How to Discover Log4Shell Vulnerabilities in Running Containers & Images

If you run Java applications in containers, then it is critical that you check for Log4Shell vulnerabilities, given the high severity of this potential exploit. Qualys Container Security offers multiple methods to help you detect Log4Shell in your container environment. The Container Security...

SUSE SLES15 Security Update : runc (SUSE-SU-2021:4171-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by a vulnerability as referenced in the SUSE- SU-2021:4171-1 advisory. Update to runc v1.0.3. CVE-2021-43784: Fixed a potential vulnerability related to the internal usage of netlink, which is believed to not be exploitabl...

Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware

Log4Shell Honeypot Enhanced dockerized honeypot for CVE-2021...

Kubernetes Guardrails: Bringing DevOps and Security Together on Cloud

Cloud and container technologies are being increasingly embraced by organizations around the globe because of the efficiency, superior visibility, and control they provide to DevOps and IT teams. While DevOps teams see the benefits of cloud and container solutions, these tools create a learning...

CVE-2021-43784

runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc, netlink is used internally as a serialization system for specifying the relevant container configuration to the C portion of the code responsible for the based namespace setup of container...

CVE-2021-43784

CVE-2021-43784 affects runc prior to 1.0.3, where a 16‑bit length field overflow in netlink bytemsg allowed an attacker who can influence container configuration to have the parsed payload override netlink-based container configuration and disable namespaces. Impact: potential namespace bypass by...

Security update for singularity (moderate)

openSUSE Security Update: Security update for singularity Announcement ID: openSUSE-SU-2021:1525-1 Rating: moderate References: 1193273 Cross-References: CVE-2021-41190 CVSS scores: CVE-2021-41190 NVD : 3 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:N/I:L/A:N Affected Products: openSUSE Backports SLE-15-SP...

Unbreakable Enterprise kernel-container security update

5.4.17-2136.301.1.2.el7 - Revert 'net/rds: Allocate pages on HCA NUMA nodeid' Gerd Rausch Orabug: 33561324 - Revert 'net/rds: Allocate rdsibincoming,fragslab on HCA NUMA nodeid' Gerd Rausch Orabug: 33561324 - Revert 'net/rds: Use the same vector for send & receive' Gerd Rausch Orabug: 33561324 -...

QSC Day 2 Recap: Innovation Makes for Better Defense, Improves Resilience

If 2020 was the year of disruption, then 2021 was characterized by high-profile—and low-profile—cyberattacks against the likes of JBS Supply, Colonial Pipeline, and Kaseya. Three years that underscored the need for organizations not only to defend themselves but to become resilient to weather and...