CVE-2019-18837 - An issue was discovered in crun before 0.10.5

Back Back to CVE browser

HIGH

An issue was discovered in crun before 0.10.5

Published Nov 13, 2019

8.6

HIGH

CVSS 3.1

EPSS 1.43%

Description

An issue was discovered in crun before 0.10.5. With a crafted image, it doesn't correctly check whether a target is a symlink, resulting in access to files outside of the container. This occurs in libcrun/linux.c and libcrun/chroot_realpath.c.

Affected products

Vendor Crun Product Crun Default
n/a
- Version
  before 0.10.5
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Crun

n/a

Version	Status	Constraints
before 0.10.5	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-59

References (5)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-8538
Advisory
https://github.com/containers/crun/pull/173
x_refsource_MISC
https://github.com/containers/crun/releases/tag/0.10.5
x_refsource_CONFIRM
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DTA5SJUAKQUK6HRY2CZVJUIZP5BO3EOG/
x_refsource_MISC
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ITB2UNEGHXZUR3ATYHWPSK5LJB36N7AP/
x_refsource_MISC

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-8538		Advisory
https://github.com/containers/crun/pull/173		x_refsource_MISC
https://github.com/containers/crun/releases/tag/0.10.5		x_refsource_CONFIRM
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DTA5SJUAKQUK6HRY2CZVJUIZP5BO3EOG/		x_refsource_MISC
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ITB2UNEGHXZUR3ATYHWPSK5LJB36N7AP/		x_refsource_MISC