Symlink Bypass

🗓️ 05 Apr 2023 13:38:40Reported by Veracode Vulnerability DatabaseType

veracode🔗 sca.analysiscenter.veracode.com👁 195 Views

Vulnerability in github.com/opencontainers/runc allows Symlink Bypass, bypassing AppArmor and SELinux

Reporter	Title	Published	Views	Family All 167
ALT Linux	Security fix for the ALT Linux 10 package runc version 1.1.5-alt1	20 Apr 202300:00	–	altlinux
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in CloudPak for Watson AIOPs	31 May 202317:22	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Kubernetes Service is affected by two containerd security vulnerabilities (CVE-2023-28642) (CVE-2023-27561)	12 Jun 202312:41	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in CloudPak for Watson AIOPs	31 May 202317:23	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Edge Application Manager 4.5.1 addresses multiple security vulnerabilities	31 May 202322:20	–	ibm
IBM Security Bulletins	Security Bulletin: IBM MQ Operator and Queue manager container images are vulnerable to multiple vulnerabilities from openssl-libs, libssh, libarchive, sqlite and go-toolset	1 Aug 202306:33	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Concert Software.	18 Aug 202504:31	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in Open Container Initiative runc	28 Jun 202422:49	–	ibm
IBM Security Bulletins	Security Bulletin: Denial of service, SQL injection, and other vulnerabilities might affect IBM Storage Defender – Resiliency Service	24 Feb 202523:37	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Data is vulnerable to several issues due to the go compiler	8 Aug 202414:17	–	ibm

Vulners

Node

linuxfoundation runcMatch1.0.0~rc92+dfsg1-5debian

AND

linuxfoundation runcMatch1.0.2+ds1-1debian

AND

debian debian_linuxMatch999

linuxfoundation runcMatch1.1.3-r0go

AND

linuxfoundation runcMatch1.0.2-r1go

AND

linuxfoundation runcMatch1.0.3-r0go

AND

linuxfoundation runcMatch1.1.3-r1go

AND

linuxfoundation runcMatch1.0.0_rc93-r0go

AND

linuxfoundation runcMatch1.0.0_rc10-r0go

AND

linuxfoundation runcMatch1.0.0_rc10-r1go

AND

linuxfoundation runcMatch1.0.0-r0go

AND

linuxfoundation runcMatch1.0.0_rc95-r1go

AND

linuxfoundation runcMatch1.0.1-r0go

AND

linuxfoundation runcMatch1.1.0-r1go

AND

linuxfoundation runcMatch1.0.2-r0go

AND

linuxfoundation runcMatch1.1.3-r2go

AND

linuxfoundation runcMatch1.0.0_rc94-r0go

AND

linuxfoundation runcMatch1.1.0-r0go

AND

linuxfoundation runcMatch1.1.1-r1go

AND

linuxfoundation runcMatch1.1.2-r0go

AND

linuxfoundation runcMatch1.1.1-r0go

AND

linuxfoundation runcMatch1.0.0_rc95-r0go

AND

alpinelinux alpine_linuxMatchedge

linuxfoundation runcMatch1.1.4-r3go

AND

linuxfoundation runcMatch1.1.4-r4go

AND

linuxfoundation runcMatch1.1.4-r2go

AND

linuxfoundation runcMatch1.1.4-r5go

AND

alpinelinux alpine_linuxMatch3.17

linuxfoundation runcMatch1.0.0~rc92+dfsg1-5debian

AND

debian debian_linuxMatch11

opencontainers github.com/opencontainers/runcRangev1.0.0-rc95–1.0.0-rc95go

Source	Link
github	www.github.com/opencontainers/runc/commit/0abab45c9b97c113ff2cdc16f3a7388444c3fbec
github	www.github.com/opencontainers/runc/pull/3785
github	www.github.com/opencontainers/runc/security/advisories/GHSA-g2j6-57v7-gm8c
security	www.security.netapp.com/advisory/ntap-20241206-0005/

07 Nov 2023 21:13Current

7.2High risk

Vulners AI Score7.2

CVSS 3.16.1 - 7.8

EPSS0.00012

SSVC