CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2022-27650 – crun: Default inheritable capabilities for linux container should be empty
https://notcve.org/view.php?id=CVE-2022-27650
04 Apr 2022 — A flaw was found in crun where containers were incorrectly started with non-empty default permissions. A vulnerability was found in Moby (Docker Engine) where containers were started incorrectly with non-empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs. Se encontró un fallo en crun donde los contenedores eran iniciados incorrectamente con permisos por de... • https://bugzilla.redhat.com/show_bug.cgi?id=2066845 • CWE-276: Incorrect Default Permissions •
CVSS: 8.6EPSS: 0%CPEs: 3EXPL: 0CVE-2019-18837
https://notcve.org/view.php?id=CVE-2019-18837
13 Nov 2019 — An issue was discovered in crun before 0.10.5. With a crafted image, it doesn't correctly check whether a target is a symlink, resulting in access to files outside of the container. This occurs in libcrun/linux.c and libcrun/chroot_realpath.c. Se descubrió un problema en crun versiones anteriores a la versión 0.10.5. Con una imagen especialmente diseñada, no comprueba correctamente si un objetivo es un enlace simbólico, resultando en el acceso a archivos fuera del contenedor. • https://github.com/containers/crun/pull/173 • CWE-59: Improper Link Resolution Before File Access ('Link Following') •