CVE-2019-3558

Python Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook...

CVE-2019-3559

Java Facebook Thrift servers would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects Facebook Thri...

CVE-2019-3552

C++ Facebook Thrift servers using cpp2 would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects...

CVE-2019-3552

C++ Facebook Thrift servers using cpp2 would not error upon receiving messages with containers of fields of unknown type. As a result, malicious clients could send short messages which would take a long time for the server to parse, potentially leading to denial of service. This issue affects...

[SECURITY] Fedora 30 Update: bubblewrap-0.3.3-2.fc30

Bubblewrap /usr/bin/bwrap is a core execution engine for unprivileged containers that works as a setuid binary on kernels without user namespaces...

Denial Of Service (DoS)

OpenStack Object Storage swift provides object storage in virtual containers, which allows users to store and retrieve files arbitrary data. The service's distributed architecture supports horizontal scaling; redundancy as failure-proofing is provided through software-based data replication...

Important kernel security update: New kernel 2.6.32-042stab137.1 for Virtuozzo Containers for Linux 4.7, Server Bare Metal 5.0

This update provides a new kernel 2.6.32-042stab137.1 for Virtuozzo Containers for Linux 4.7 and Server Bare Metal 5.0 based on the RHEL 6.10 kernel 2.6.32-754.12.1.el6. The new kernel introduces security and stability fixes. Vulnerability id: CVE-2018-13405 A vulnerability was found in the...

openSUSE Security Update : lxc / lxcfs (openSUSE-2019-1275)

This update for lxc, lxcfs to version 3.1.0 fixes the following issues : Security issues fixed : - CVE-2019-5736: Fixed a container breakout vulnerability boo1122185. - CVE-2018-6556: Enable setuid bit on lxc-user-nic boo988348. Non-security issues fixed : - Update to LXC 3.1.0. The changelog is...

Product update: Virtuozzo 7.0 Update 10 (7.0.10-315)

The Update 10 for Virtuozzo 7.0 provides a new feature as well as stability and usability bug fixes. It also introduces a new kernel 3.10.0-957.10.1.vz7.85.17, which is a rebase to the RHEL 7.6 kernel 3.10.0-957.10.1.el7. Vulnerability id: PSBM-91794 Node could crash due to a bug in overlayfs...

UPDATE: Sysdig Falco v0.14.0

PenTestIT RSS Feed Recently, an updated version - Sysdig Falco v0.14.0 - was released. It has been some time since I last blogged about this open source behavorial activity monitor which has container support. What is Sysdig Falco? Sysdig Falco is an open source, behavioral activity monitor...

Beauty Out of Chaos: Elevating Cybersecurity to an Art Form – Part 1

How many of you can remember what it was like managing IT security 10 years ago? How about two decades? The truth is that the landscape was so utterly different back then that any comparisons with today are a little unfair. Yet they’re useful in one key regard: to teach us just how complex and...

Kernel update: New kernel 2.6.32-042stab136.1 for Virtuozzo Containers for Linux 4.7, Server Bare Metal 5.0

This update provides a new kernel 2.6.32-042stab136.1 for Virtuozzo Containers for Linux 4.7 and Server Bare Metal 5.0 based on the RHEL 6.10 kernel 2.6.32-754.11.1.el6. The new kernel introduces stability fixes. Vulnerability id: PSBM-90794 Under certain circumstances, pcompact could crash the...

The vulnerability of the runc command, a tool for starting isolated containers, is related to errors in processing file descriptors. This vulnerability allows an attacker to execute arbitrary code.

The vulnerability of the runc command, used to execute isolated containers, is related to errors in processing file descriptors. Exploiting this vulnerability allows an attacker to execute arbitrary code...

[SECURITY] Fedora 29 Update: docker-latest-1.13.1-42.git1185cfd.fc29

Docker is an open-source engine that automates the deployment of any application as a lightweight, portable, self-sufficient container that will run virtually anywhere. Docker containers can encapsulate any payload, and will run consistently on and between virtually any server. The same container...

[SECURITY] Fedora 29 Update: moby-engine-18.06.0-2.ce.git0ffa825.fc29

Docker is an open source project to build, ship and run any application as a lightweight container. Docker containers are both hardware-agnostic and platform-agnostic. This me ans they can run anywhere, from your laptop to the largest EC2 compute instance and everything in between - and they don'...

MGASA-2019-0087 Updated lxc packages fix security vulnerability

LXC allows attackers to overwrite the host LXC binary and consequently obtain host root access by leveraging the ability to execute a command as root within one of these types of containers: a new container with an attacker-controlled image, or an existing container, to which the attacker...

Updated lxc packages fix security vulnerability

LXC allows attackers to overwrite the host LXC binary and consequently obtain host root access by leveraging the ability to execute a command as root within one of these types of containers: a new container with an attacker-controlled image, or an existing container, to which the attacker...

[SECURITY] Fedora 29 Update: runc-1.0.0-68.dev.git6635b4f.fc29

The runc command can be used to start containers which are packaged in accordance with the Open Container Initiative's specifications, and to manage containers running under runc...

Kernel update: Virtuozzo ReadyKernel patch 72.1 for all supported Virtuozzo kernels and that of Virtuozzo Infrastructure Platform 2.5

The cumulative Virtuozzo ReadyKernel patch was updated with a stability fix. The patch applies to all supported Virtuozzo kernels and that of Virtuozzo Infrastructure Platform 2.5. Vulnerability id: PSBM-91689 It was discovered that the previous ReadyKernel patch v72.0 does not allow Docker 18.09...

RunC Container Breakout Vulnerability

Despite the huge advantages that containers offer in application portability, acceleration of CI/CD pipelines and agility of deployment environments, the biggest concern has always been about isolation. Since all the containers running on a host share the same underlying kernel, any malicious cod...