CVSS: 7.5EPSS: 1%CPEs: 21EXPL: 1CVE-2020-8945 – proglottis/gpgme: Use-after-free in GPGME bindings during container image pull
https://notcve.org/view.php?id=CVE-2020-8945
The proglottis Go wrapper before 0.1.1 for the GPGME library has a use-after-free, as demonstrated by use for container image pulls by Docker or CRI-O. This leads to a crash or potential code execution during GPG signature verification. El contenedor Proglottis Go versiones anteriores a 0.1.1 para la biblioteca GPGME, presenta un uso de la memoria previamente liberada, como es demostrado por el uso para las extracciones de imágenes de contenedores para Docker o CRI-O. Esto conlleva a un bloqueo o posible ejecución de código durante una comprobación de la firma GPG. A use-after-free vulnerability was found in the Go GPGME wrapper library, github.com/proglottis/gpgme. • https://access.redhat.com/errata/RHSA-2020:0679 https://access.redhat.com/errata/RHSA-2020:0689 https://access.redhat.com/errata/RHSA-2020:0697 https://bugzilla.redhat.com/show_bug.cgi?id=1795838 https://github.com/containers/image/commit/4c7a23f82ef09127b0ff28366d1cf31316dd6cc1 https://github.com/proglottis/gpgme/compare/v0.1.0...v0.1.1 https://github.com/proglottis/gpgme/pull/23 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3SOCLOPTSYABTE4CLTSPDIF • CWE-416: Use After Free •
CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2020-8595 – istio: unauthorised access to JWT protected HTTP path
https://notcve.org/view.php?id=CVE-2020-8595
Istio versions 1.2.10 (End of Life) and prior, 1.3 through 1.3.7, and 1.4 through 1.4.3 allows authentication bypass. The Authentication Policy exact-path matching logic can allow unauthorized access to HTTP paths even if they are configured to be only accessed after presenting a valid JWT token. For example, an attacker can add a ? or # character to a URI that would otherwise satisfy an exact-path match. Las versiones Istio 1.2.10 (End of Life) y anteriores, 1.3 a 1.3.7, y 1.4 a 1.4.3 permiten la omisión de autenticación. • https://access.redhat.com/errata/RHSA-2020:0477 https://access.redhat.com/security/cve/cve-2020-8595 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-8595 https://github.com/istio/istio/commits/master https://istio.io/news/security https://istio.io/news/security/istio-security-2020-001 https://access.redhat.com/security/cve/CVE-2020-8595 https://bugzilla.redhat.com/show_bug.cgi?id=1798247 • CWE-285: Improper Authorization CWE-287: Improper Authentication •
CVSS: 9.8EPSS: 2%CPEs: 1EXPL: 1CVE-2014-0234
https://notcve.org/view.php?id=CVE-2014-0234
The default configuration of broker.conf in Red Hat OpenShift Enterprise 2.x before 2.1 has a password of "mooo" for a Mongo account, which allows remote attackers to hijack the broker by providing this password, related to the openshift.sh script in Openshift Extras before 20130920. NOTE: this may overlap CVE-2013-4253 and CVE-2013-4281. La configuración predeterminada de broker.conf en Red Hat OpenShift Enterprise versiones 2.x anteriores a 2.1, presenta una contraseña de "mooo" para una cuenta Mongo, lo que permite a atacantes remotos secuestrar el broker al proporcionar esta contraseña, relacionada con el script openshift.sh en Openshift Extras versiones anteriores a 20130920. NOTA: esto puede solaparse a CVE-2013-4253 y CVE-2013-4281. • http://openwall.com/lists/oss-security/2014/06/05/19 http://www.securityfocus.com/bid/67657 https://bugzilla.redhat.com/show_bug.cgi?id=1097008 https://github.com/openshift/openshift-extras/blob/master/README.md https://rhn.redhat.com/errata/RHSA-2014-0487.html • CWE-1188: Initialization of a Resource with an Insecure Default •
CVSS: 7.0EPSS: 0%CPEs: 17EXPL: 0CVE-2019-19921 – runc: volume mount race condition with shared mounts leads to information leak/integrity manipulation
https://notcve.org/view.php?id=CVE-2019-19921
runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. (This vulnerability does not affect Docker due to an implementation detail that happens to block the attack.) runc versiones hasta 1.0.0-rc9, posee un Control de Acceso Incorrecto conllevando a una escalada de privilegios, relacionado con el archivo libcontainer/rootfs_linux.go. Para explotar esto, un atacante debe ser capaz de generar dos contenedores con configuraciones de montaje de volumen personalizadas y ser capaz de ejecutar imágenes personalizadas. (Esta vulnerabilidad no afecta a Docker debido a un detalle de implementación que bloquea el ataque). • http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00018.html https://access.redhat.com/errata/RHSA-2020:0688 https://access.redhat.com/errata/RHSA-2020:0695 https://github.com/opencontainers/runc/issues/2197 https://github.com/opencontainers/runc/pull/2190 https://github.com/opencontainers/runc/releases https://lists.debian.org/debian-lts-announce/2023/03/msg00023.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ANUGDBJ7NBUMSUFZUSKU3ZMQYZ2Z3S • CWE-41: Improper Resolution of Path Equivalence CWE-706: Use of Incorrectly-Resolved Name or Reference •
CVSS: 5.9EPSS: 0%CPEs: 3EXPL: 0CVE-2020-1726 – podman: incorrectly allows existing files in volumes to be overwritten by a container when it is created
https://notcve.org/view.php?id=CVE-2020-1726
A flaw was discovered in Podman where it incorrectly allows containers when created to overwrite existing files in volumes, even if they are mounted as read-only. When a user runs a malicious container or a container based on a malicious image with an attached volume that is used for the first time, it is possible to trigger the flaw and overwrite files in the volume.This issue was introduced in version 1.6.0. Se detectó un fallo en Podman donde permite incorrectamente que los contenedores cuando se crean sobrescriban los archivos existentes en volúmenes, incluso si están montados como de solo lectura. Cuando un usuario ejecuta un contenedor malicioso o un contenedor basado en una imagen maliciosa con un volumen adjunto que se usa por primera vez, es posible desencadenar el fallo y sobrescribir archivos en el volumen. Este problema fue introducido en la versión 1.6.0. • http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00097.html http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00103.html https://access.redhat.com/errata/RHSA-2020:0680 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1726 https://access.redhat.com/security/cve/CVE-2020-1726 https://bugzilla.redhat.com/show_bug.cgi?id=1801152 • CWE-552: Files or Directories Accessible to External Parties •