Advisory ROSA-SA-2023-2209

software: runc 1.1.7
OS: ROSA-CHROME

package_evr_string: runc-1.1.1.7-1.src.rpm

CVE-ID: CVE-2021-43784
BDU-ID: 2023-02652
CVE-Crit: MEDIUM
CVE-DESC.: A vulnerability in the Runc isolated container tool is related to integer overflow. Exploitation of the vulnerability allows an attacker acting remotely to gain access to sensitive data, compromise its integrity, and cause a denial-of-service condition
CVE-STATUS: Resolved
CVE-REV: To close, run the command: sudo dnf update runc

CVE-ID: CVE-2022-24769
BDU-ID: 2023-00215
CVE-Crit: MEDIUM.
CVE-DESC.: A vulnerability in the Containerd container runtime environment is related to the incorrect assignment of permissions for a critical resource. Exploitation of the vulnerability allows an attacker to gain access to sensitive data, compromise its integrity, and cause a denial-of-service condition
CVE-STATUS: Resolved
CVE-REV: To close, run the command: sudo dnf update runc

CVE-ID: CVE-2022-29162
BDU-ID: 2022-05793
CVE-Crit: MEDIUM
CVE-DESC.: A vulnerability in the ‘runc exec --cap’ command of the Runc isolated container startup tool is related to default permissions settings. Exploitation of the vulnerability allows an attacker to gain access to sensitive data, compromise its integrity, and cause a denial-of-service condition
CVE-STATUS: Resolved
CVE-REV: To close, run the command: sudo dnf update runc

CVE-ID: CVE-2023-25809
BDU-ID: 2023-03860
CVE-Crit: MEDIUM
CVE-DESC.: A vulnerability in the Runc isolated container launch tool is related to improper permission saving. Exploitation of the vulnerability allows an attacker to gain access to sensitive data, compromise its integrity, and cause a denial-of-service condition
CVE-STATUS: Fixed
CVE-REV: To close, run the command: sudo dnf update runc

CVE-ID: CVE-2023-27561
BDU-ID: 2023-03863
CVE-Crit: MEDIUM.
CVE-DESC.: A vulnerability in the libcontainer/rootfs_linux.go component of the Runc isolated container startup tool is related to the use of an invalidly referenced name. Exploitation of the vulnerability allows an attacker to gain access to sensitive data, compromise its integrity, and cause a denial-of-service condition
CVE-STATUS: Resolved
CVE-REV: To close, run the command: sudo dnf update runc

CVE-ID: CVE-2023-28642
BDU-ID: 2023-03869
CVE-Crit: MEDIUM.
CVE-DESC.: A vulnerability in the Runc isolated container tool is related to incorrectly defining symbolic links before accessing a file. Exploitation of the vulnerability allows an attacker to access sensitive data, compromise its integrity, and cause a denial of service
CVE-STATUS: Fixed
CVE-REV: To close, run the command: sudo dnf update runc