Red Hat Security Advisory

RHSA-2023:6380

runc security update

Released 2023-11-07 · Red Hat rating Moderate · View on Red Hat →

Fixed in

TI-2022-20115 CVE-2022-41724 · GHSA-89mw-w342-mqrr

MEDIUM 41

Large handshake records may cause panics in crypto/tls.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01111 Published 2023-02-28 Partial fix · 1.19.6, 1.20.1 CWE-400

TI-2023-13160 CVE-2023-28642 · GHSA-g2j6-57v7-gm8c

LOW 34

runc is a CLI tool for spawning and running containers according to the OCI specification.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.00343 Published 2023-03-29 Partial fix · 1.1.5 CWE-281

TI-2023-12273 CVE-2023-27561 · GHSA-vpvm-3wq2-2wvm

LOW 33

runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go.

CVSS 3.1HIGH 7.0 Local Low privileges No interaction EPSS 0.00448 Published 2023-03-03 Partial fix · 1.1.5 CWE-706

TI-2021-19591 CVE-2021-43784 · GHSA-v95c-p5hm-xq8f

LOW 30

runc is a CLI tool for spawning and running containers on Linux according to the OCI specification.

CVSS 3.1MEDIUM 6.0 Network Low privileges No interaction EPSS 0.01803 Published 2021-12-06 Partial fix · 1.0.3 CWE-190

TI-2023-11079 CVE-2023-25809 · GHSA-m8cg-xc2p-r3fc

LOW 28

runc is a CLI tool for spawning and running containers according to the OCI specification.

CVSS 3.1MEDIUM 6.3 Local Low privileges No interaction EPSS 0.00319 Published 2023-03-29 Partial fix · 1.1.5 CWE-281