diff --git a/advisories/github-reviewed/2023/03/GHSA-vpvm-3wq2-2wvm/GHSA-vpvm-3wq2-2wvm.json b/advisories/github-reviewed/2023/03/GHSA-vpvm-3wq2-2wvm/GHSA-vpvm-3wq2-2wvm.json index 13115d75b71..0c23494a6ca 100644 --- a/advisories/github-reviewed/2023/03/GHSA-vpvm-3wq2-2wvm/GHSA-vpvm-3wq2-2wvm.json +++ b/advisories/github-reviewed/2023/03/GHSA-vpvm-3wq2-2wvm/GHSA-vpvm-3wq2-2wvm.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-vpvm-3wq2-2wvm", - "modified": "2023-03-10T15:31:24Z", + "modified": "2023-03-29T14:46:15Z", "published": "2023-03-03T21:30:19Z", "aliases": [ "CVE-2023-27561" ], "summary": "Opencontainers runc Incorrect Authorization vulnerability", - "details": "runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to `libcontainer/rootfs_linux.go`. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. NOTE: this issue exists because of a CVE-2019-19921 regression.", + "details": "runc 1.0.0-rc95 through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to `libcontainer/rootfs_linux.go`. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. NOTE: this issue exists because of a CVE-2019-19921 regression.", "severity": [ { "type": "CVSS_V3", @@ -25,10 +25,10 @@ "type": "ECOSYSTEM", "events": [ { - "introduced": "0" + "introduced": "1.0.0-rc95" }, { - "last_affected": "1.1.4" + "fixed": "1.1.5" } ] } @@ -48,6 +48,10 @@ "type": "WEB", "url": "https://github.com/opencontainers/runc/issues/3751" }, + { + "type": "WEB", + "url": "https://github.com/opencontainers/runc/pull/3785" + }, { "type": "WEB", "url": "https://gist.github.com/LiveOverflow/c937820b688922eb127fb760ce06dab9" @@ -56,6 +60,10 @@ "type": "PACKAGE", "url": "https://github.com/opencontainers/runc" }, + { + "type": "WEB", + "url": "https://github.com/opencontainers/runc/releases/tag/v1.1.5" + }, { "type": "WEB", "url": "https://lists.debian.org/debian-lts-announce/2023/03/msg00023.html"