All the vulnerabilites related to microfocus - service_management_automation
cve-2018-6498
Vulnerability from cvelistv5
Published
2018-08-30 21:00
Modified
2024-09-17 01:11
Severity ?
EPSS score ?
Summary
Remote Code Execution in the following products Hybrid Cloud Management Containerized Suite HCM2017.11, HCM2018.02, HCM2018.05, Operations Bridge Containerized Suite 2017.11, 2018.02, 2018.05, Data Center Automation Containerized Suite 2017.01 until 2018.05, Service Management Automation Suite 2017.11, 2018.02, 2018.05 and Network Operations Management (NOM) Suite CDF 2017.11, 2018.02, 2018.05 will allow Remote Code Execution.
References
| ▼ | URL | Tags |
|---|---|---|
| https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236667 | x_refsource_CONFIRM | |
| https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236669 | x_refsource_CONFIRM | |
| https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236725 | x_refsource_CONFIRM | |
| https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236632 | x_refsource_CONFIRM | |
| https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236678 | x_refsource_CONFIRM |
Impacted products
| Vendor | Product | Version | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ▼ | Micro Focus | Network Operations Management (NOM) Suite CDF |
Version: 2017.11, 2018.02, 2018.05 |
||||||||||||||||
|
|||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T06:01:49.095Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236667"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236669"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236725"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236632"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236678"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Network Operations Management (NOM) Suite CDF",
"vendor": "Micro Focus",
"versions": [
{
"status": "affected",
"version": "2017.11, 2018.02, 2018.05"
}
]
},
{
"product": "Service Management Automation Suite",
"vendor": "Micro Focus",
"versions": [
{
"status": "affected",
"version": "2017.11, 2018.02, 2018.05"
}
]
},
{
"product": "Data Center Automation Containerized Suite",
"vendor": "Micro Focus",
"versions": [
{
"status": "affected",
"version": "2017.01 until 2018.05"
}
]
},
{
"product": "Operations Bridge Containerized Suite",
"vendor": "Micro Focus",
"versions": [
{
"status": "affected",
"version": "2017.11, 2018.02, 2018.05"
}
]
},
{
"product": "Hybrid Cloud Management Containerized Suite",
"vendor": "Micro Focus",
"versions": [
{
"status": "affected",
"version": "HCM2017.11, HCM2018.02, HCM2018.05"
}
]
}
],
"datePublic": "2018-08-30T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Remote Code Execution in the following products Hybrid Cloud Management Containerized Suite HCM2017.11, HCM2018.02, HCM2018.05, Operations Bridge Containerized Suite 2017.11, 2018.02, 2018.05, Data Center Automation Containerized Suite 2017.01 until 2018.05, Service Management Automation Suite 2017.11, 2018.02, 2018.05 and Network Operations Management (NOM) Suite CDF 2017.11, 2018.02, 2018.05 will allow Remote Code Execution."
}
],
"exploits": [
{
"lang": "en",
"value": "Remote Code Execution"
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Remote Code Execution",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-01-06T16:15:27",
"orgId": "f81092c5-7f14-476d-80dc-24857f90be84",
"shortName": "microfocus"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236667"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236669"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236725"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236632"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236678"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "Micro Focus Container Deployment Foundation (CDF), Remote Code Execution",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@microfocus.com",
"DATE_PUBLIC": "2018-08-30T17:00:00.000Z",
"ID": "CVE-2018-6498",
"STATE": "PUBLIC",
"TITLE": "Micro Focus Container Deployment Foundation (CDF), Remote Code Execution"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Network Operations Management (NOM) Suite CDF",
"version": {
"version_data": [
{
"version_value": "2017.11, 2018.02, 2018.05"
}
]
}
},
{
"product_name": "Service Management Automation Suite",
"version": {
"version_data": [
{
"version_value": "2017.11, 2018.02, 2018.05"
}
]
}
},
{
"product_name": "Data Center Automation Containerized Suite",
"version": {
"version_data": [
{
"version_value": "2017.01 until 2018.05"
}
]
}
},
{
"product_name": "Operations Bridge Containerized Suite",
"version": {
"version_data": [
{
"version_value": "2017.11, 2018.02, 2018.05"
}
]
}
},
{
"product_name": "Hybrid Cloud Management Containerized Suite",
"version": {
"version_data": [
{
"version_value": "HCM2017.11, HCM2018.02, HCM2018.05"
}
]
}
}
]
},
"vendor_name": "Micro Focus"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Remote Code Execution in the following products Hybrid Cloud Management Containerized Suite HCM2017.11, HCM2018.02, HCM2018.05, Operations Bridge Containerized Suite 2017.11, 2018.02, 2018.05, Data Center Automation Containerized Suite 2017.01 until 2018.05, Service Management Automation Suite 2017.11, 2018.02, 2018.05 and Network Operations Management (NOM) Suite CDF 2017.11, 2018.02, 2018.05 will allow Remote Code Execution."
}
]
},
"exploit": [
{
"lang": "en",
"value": "Remote Code Execution"
}
],
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Remote Code Execution"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236667",
"refsource": "CONFIRM",
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236667"
},
{
"name": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236669",
"refsource": "CONFIRM",
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236669"
},
{
"name": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236725",
"refsource": "CONFIRM",
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236725"
},
{
"name": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236632",
"refsource": "CONFIRM",
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236632"
},
{
"name": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236678",
"refsource": "CONFIRM",
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236678"
}
]
},
"source": {
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "f81092c5-7f14-476d-80dc-24857f90be84",
"assignerShortName": "microfocus",
"cveId": "CVE-2018-6498",
"datePublished": "2018-08-30T21:00:00Z",
"dateReserved": "2018-02-01T00:00:00",
"dateUpdated": "2024-09-17T01:11:00.440Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2018-6499
Vulnerability from cvelistv5
Published
2018-08-30 21:00
Modified
2024-09-17 04:19
Severity ?
EPSS score ?
Summary
Remote Code Execution in the following products Hybrid Cloud Management Containerized Suite HCM2017.11, HCM2018.02, HCM2018.05, Operations Bridge Containerized Suite 2017.11, 2018.02, 2018.05, Data Center Automation Containerized Suite 2017.01 until 2018.05, Service Management Automation Suite 2017.11, 2018.02, 2018.05, Service Virtualization (SV) with floating licenses using Any version using APLS older than 10.7, Unified Functional Testing (UFT) with floating licenses using Any version using APLS older than 10.7, Network Virtualization (NV) with floating licenses using Any version using APLS older than 10.7 and Network Operations Management (NOM) Suite CDF 2017.11, 2018.02, 2018.05 will allow Remote Code Execution.
References
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ▼ | Micro Focus | Network Operations Management (NOM) Suite CDF |
Version: 2017.11, 2018.02, 2018.05 |
||||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T06:01:49.170Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236722"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236667"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236669"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236648"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236632?lang=en\u0026cc=us\u0026hpappid=206728_SSO_PRO"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236726"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Network Operations Management (NOM) Suite CDF",
"vendor": "Micro Focus",
"versions": [
{
"status": "affected",
"version": "2017.11, 2018.02, 2018.05"
}
]
},
{
"product": "Service Management Automation Suite",
"vendor": "Micro Focus",
"versions": [
{
"status": "affected",
"version": "2017.11, 2018.02, 2018.05"
}
]
},
{
"product": "Data Center Automation Containerized Suite",
"vendor": "Micro Focus",
"versions": [
{
"status": "affected",
"version": "2017.01 until 2018.05"
}
]
},
{
"product": "Operations Bridge Containerized Suite",
"vendor": "Micro Focus",
"versions": [
{
"status": "affected",
"version": "2017.11, 2018.02, 2018.05"
}
]
},
{
"product": "Hybrid Cloud Management Containerized Suite",
"vendor": "Micro Focus",
"versions": [
{
"status": "affected",
"version": "HCM2017.11, HCM2018.02, HCM2018.05"
}
]
},
{
"product": "Network Virtualization (NV) with floating licenses",
"vendor": "Micro Focus",
"versions": [
{
"status": "affected",
"version": "using Any version using APLS older than 10.7"
}
]
},
{
"product": "Unified Functional Testing (UFT) with floating licenses",
"vendor": "Micro Focus",
"versions": [
{
"status": "affected",
"version": "using Any version using APLS older than 10.7"
}
]
},
{
"product": "Service Virtualization (SV) with floating licenses",
"vendor": "Micro Focus",
"versions": [
{
"status": "affected",
"version": "using Any version using APLS older than 10.7"
}
]
}
],
"datePublic": "2018-08-30T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Remote Code Execution in the following products Hybrid Cloud Management Containerized Suite HCM2017.11, HCM2018.02, HCM2018.05, Operations Bridge Containerized Suite 2017.11, 2018.02, 2018.05, Data Center Automation Containerized Suite 2017.01 until 2018.05, Service Management Automation Suite 2017.11, 2018.02, 2018.05, Service Virtualization (SV) with floating licenses using Any version using APLS older than 10.7, Unified Functional Testing (UFT) with floating licenses using Any version using APLS older than 10.7, Network Virtualization (NV) with floating licenses using Any version using APLS older than 10.7 and Network Operations Management (NOM) Suite CDF 2017.11, 2018.02, 2018.05 will allow Remote Code Execution."
}
],
"exploits": [
{
"lang": "en",
"value": "Remote Code Execution"
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:H",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "Remote Code Execution",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-01-06T16:16:04",
"orgId": "f81092c5-7f14-476d-80dc-24857f90be84",
"shortName": "microfocus"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236722"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236667"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236669"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236648"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236632?lang=en\u0026cc=us\u0026hpappid=206728_SSO_PRO"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236726"
}
],
"source": {
"defect": [
"Micro",
"Focus",
"Autopass",
"License",
"Server",
"(APLS)",
"Remote",
"Code",
"Execution"
],
"discovery": "UNKNOWN"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@microfocus.com",
"DATE_PUBLIC": "2018-08-30T18:00:00.000Z",
"ID": "CVE-2018-6499",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Network Operations Management (NOM) Suite CDF",
"version": {
"version_data": [
{
"version_value": "2017.11, 2018.02, 2018.05"
}
]
}
},
{
"product_name": "Service Management Automation Suite",
"version": {
"version_data": [
{
"version_value": "2017.11, 2018.02, 2018.05"
}
]
}
},
{
"product_name": "Data Center Automation Containerized Suite",
"version": {
"version_data": [
{
"version_value": "2017.01 until 2018.05"
}
]
}
},
{
"product_name": "Operations Bridge Containerized Suite",
"version": {
"version_data": [
{
"version_value": "2017.11, 2018.02, 2018.05"
}
]
}
},
{
"product_name": "Hybrid Cloud Management Containerized Suite",
"version": {
"version_data": [
{
"version_value": "HCM2017.11, HCM2018.02, HCM2018.05"
}
]
}
},
{
"product_name": "Network Virtualization (NV) with floating licenses",
"version": {
"version_data": [
{
"version_value": "using Any version using APLS older than 10.7"
}
]
}
},
{
"product_name": "Unified Functional Testing (UFT) with floating licenses",
"version": {
"version_data": [
{
"version_value": "using Any version using APLS older than 10.7"
}
]
}
},
{
"product_name": "Service Virtualization (SV) with floating licenses",
"version": {
"version_data": [
{
"version_value": "using Any version using APLS older than 10.7"
}
]
}
}
]
},
"vendor_name": "Micro Focus"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Remote Code Execution in the following products Hybrid Cloud Management Containerized Suite HCM2017.11, HCM2018.02, HCM2018.05, Operations Bridge Containerized Suite 2017.11, 2018.02, 2018.05, Data Center Automation Containerized Suite 2017.01 until 2018.05, Service Management Automation Suite 2017.11, 2018.02, 2018.05, Service Virtualization (SV) with floating licenses using Any version using APLS older than 10.7, Unified Functional Testing (UFT) with floating licenses using Any version using APLS older than 10.7, Network Virtualization (NV) with floating licenses using Any version using APLS older than 10.7 and Network Operations Management (NOM) Suite CDF 2017.11, 2018.02, 2018.05 will allow Remote Code Execution."
}
]
},
"exploit": [
{
"lang": "en",
"value": "Remote Code Execution"
}
],
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:H",
"version": "3.0"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Remote Code Execution"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236722",
"refsource": "CONFIRM",
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236722"
},
{
"name": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236667",
"refsource": "CONFIRM",
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236667"
},
{
"name": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236669",
"refsource": "CONFIRM",
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236669"
},
{
"name": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236648",
"refsource": "CONFIRM",
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236648"
},
{
"name": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236632?lang=en\u0026cc=us\u0026hpappid=206728_SSO_PRO",
"refsource": "CONFIRM",
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236632?lang=en\u0026cc=us\u0026hpappid=206728_SSO_PRO"
},
{
"name": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236726",
"refsource": "CONFIRM",
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236726"
}
]
},
"source": {
"defect": [
"Micro",
"Focus",
"Autopass",
"License",
"Server",
"(APLS)",
"Remote",
"Code",
"Execution"
],
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "f81092c5-7f14-476d-80dc-24857f90be84",
"assignerShortName": "microfocus",
"cveId": "CVE-2018-6499",
"datePublished": "2018-08-30T21:00:00Z",
"dateReserved": "2018-02-01T00:00:00",
"dateUpdated": "2024-09-17T04:19:15.400Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2019-5736
Vulnerability from cvelistv5
Published
2019-02-11 00:00
Modified
2024-08-04 20:01
Severity ?
EPSS score ?
Summary
runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a command as root within one of these types of containers: (1) a new container with an attacker-controlled image, or (2) an existing container, to which the attacker previously had write access, that can be attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/self/exe.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T20:01:52.208Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://github.com/opencontainers/runc/commit/6635b4f0c6af3810594d2770f662f34ddc15b40d"
},
{
"name": "RHSA-2019:0408",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2019:0408"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/rancher/runc-cve"
},
{
"name": "RHSA-2019:0401",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2019:0401"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/docker/docker-ce/releases/tag/v18.09.2"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.synology.com/security/advisory/Synology_SA_19_06"
},
{
"tags": [
"x_transferred"
],
"url": "https://security.netapp.com/advisory/ntap-20190307-0008/"
},
{
"name": "RHSA-2019:0303",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2019:0303"
},
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190215-runc"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/q3k/cve-2019-5736-poc"
},
{
"name": "46359",
"tags": [
"exploit",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/46359/"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/opencontainers/runc/commit/0a8e4117e7f715d5fbeef398405813ce8e88558b"
},
{
"tags": [
"x_transferred"
],
"url": "https://aws.amazon.com/security/security-bulletins/AWS-2019-002/"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.openwall.com/lists/oss-security/2019/02/11/2"
},
{
"tags": [
"x_transferred"
],
"url": "https://kubernetes.io/blog/2019/02/11/runc-and-cve-2019-5736/"
},
{
"tags": [
"x_transferred"
],
"url": "https://access.redhat.com/security/cve/cve-2019-5736"
},
{
"name": "46369",
"tags": [
"exploit",
"x_transferred"
],
"url": "https://www.exploit-db.com/exploits/46369/"
},
{
"name": "RHSA-2019:0304",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2019:0304"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/Frichetten/CVE-2019-5736-PoC"
},
{
"tags": [
"x_transferred"
],
"url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbhf03913en_us"
},
{
"tags": [
"x_transferred"
],
"url": "https://brauner.github.io/2019/02/12/privileged-containers.html"
},
{
"tags": [
"x_transferred"
],
"url": "https://www.twistlock.com/2019/02/11/how-to-mitigate-cve-2019-5736-in-runc-and-docker/"
},
{
"tags": [
"x_transferred"
],
"url": "https://cloud.google.com/kubernetes-engine/docs/security-bulletins#february-11-2019-runc"
},
{
"name": "106976",
"tags": [
"vdb-entry",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/106976"
},
{
"tags": [
"x_transferred"
],
"url": "https://access.redhat.com/security/vulnerabilities/runcescape"
},
{
"tags": [
"x_transferred"
],
"url": "https://blog.dragonsector.pl/2019/02/cve-2019-5736-escape-from-docker-and.html"
},
{
"tags": [
"x_transferred"
],
"url": "https://bugzilla.suse.com/show_bug.cgi?id=1121967"
},
{
"name": "[mesos-dev] 20190323 CVE-2019-0204: Some Mesos components can be overwritten making arbitrary code execution possible.",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/b162dd624dc088cd634292f0402282a1d1d0ce853baeae8205bc033c%40%3Cdev.mesos.apache.org%3E"
},
{
"name": "[mesos-user] 20190323 CVE-2019-0204: Some Mesos components can be overwritten making arbitrary code execution possible.",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/a258757af84c5074dc7bf932622020fd4f60cef65a84290380386706%40%3Cuser.mesos.apache.org%3E"
},
{
"name": "[oss-security] 20190323 CVE-2019-0204: Some Mesos components can be overwritten making arbitrary code execution possible.",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2019/03/23/1"
},
{
"tags": [
"x_transferred"
],
"url": "https://support.mesosphere.com/s/article/Known-Issue-Container-Runtime-Vulnerability-MSPH-2019-0003"
},
{
"name": "openSUSE-SU-2019:1079",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00044.html"
},
{
"name": "openSUSE-SU-2019:1227",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00074.html"
},
{
"name": "openSUSE-SU-2019:1275",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00091.html"
},
{
"name": "FEDORA-2019-bc70b381ad",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V6A4OSFM5GGOWW4ECELV5OHX2XRAUSPH/"
},
{
"name": "FEDORA-2019-6174b47003",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SWFJGIPYAAAMVSWWI3QWYXGA3ZBU2H4W/"
},
{
"tags": [
"x_transferred"
],
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03410944"
},
{
"name": "RHSA-2019:0975",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2019:0975"
},
{
"tags": [
"x_transferred"
],
"url": "https://azure.microsoft.com/en-us/updates/cve-2019-5736-and-runc-vulnerability/"
},
{
"tags": [
"x_transferred"
],
"url": "https://azure.microsoft.com/en-us/updates/iot-edge-fix-cve-2019-5736/"
},
{
"name": "[dlab-dev] 20190524 [jira] [Created] (DLAB-723) Runc vulnerability CVE-2019-5736",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/acacf018c12636e41667e94ac0a1e9244e887eef2debdd474640aa6e%40%3Cdev.dlab.apache.org%3E"
},
{
"name": "[dlab-dev] 20190524 [jira] [Updated] (DLAB-723) Runc vulnerability CVE-2019-5736",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/a585f64d14c31ab393b90c5f17e41d9765a1a17eec63856ce750af46%40%3Cdev.dlab.apache.org%3E"
},
{
"name": "openSUSE-SU-2019:1444",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00060.html"
},
{
"name": "openSUSE-SU-2019:1481",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00073.html"
},
{
"name": "openSUSE-SU-2019:1499",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00011.html"
},
{
"name": "openSUSE-SU-2019:1506",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00015.html"
},
{
"name": "[oss-security] 20190628 Re: linux-distros membership application - Microsoft",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2019/06/28/2"
},
{
"name": "[oss-security] 20190706 Re: linux-distros membership application - Microsoft",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2019/07/06/3"
},
{
"name": "[oss-security] 20190706 Re: linux-distros membership application - Microsoft",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2019/07/06/4"
},
{
"name": "USN-4048-1",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://usn.ubuntu.com/4048-1/"
},
{
"name": "openSUSE-SU-2019:2021",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00084.html"
},
{
"name": "FEDORA-2019-2baa1f7b19",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EGZKRCKI3Y7FMADO2MENMT4TU24QGHFR/"
},
{
"name": "FEDORA-2019-c1dac1b3b8",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DLC52IOJN6IQJWJ6CUI6AIUP6GVVG2QP/"
},
{
"name": "[dlab-dev] 20190923 [jira] [Assigned] (DLAB-723) Runc vulnerability CVE-2019-5736",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/24e54e3c6b2259e3903b6b8fe26896ac649c481ea99c5739468c92a3%40%3Cdev.dlab.apache.org%3E"
},
{
"name": "openSUSE-SU-2019:2245",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00007.html"
},
{
"name": "openSUSE-SU-2019:2286",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00029.html"
},
{
"name": "[oss-security] 20191023 Membership application for linux-distros - VMware",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2019/10/24/1"
},
{
"name": "[oss-security] 20191029 Re: Membership application for linux-distros - VMware",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2019/10/29/3"
},
{
"name": "GLSA-202003-21",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://security.gentoo.org/glsa/202003-21"
},
{
"name": "[dlab-dev] 20200525 [jira] [Deleted] (DLAB-723) Runc vulnerability CVE-2019-5736",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/rc494623986d76593873ce5a40dd69cb3629400d10750d5d7e96b8587%40%3Cdev.dlab.apache.org%3E"
},
{
"name": "[geode-issues] 20200831 [jira] [Created] (GEODE-8471) Dependency security issues in geode-core-1.12",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E"
},
{
"tags": [
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/163339/Docker-Container-Escape.html"
},
{
"tags": [
"x_transferred"
],
"url": "http://packetstormsecurity.com/files/165197/Docker-runc-Command-Execution-Proof-Of-Concept.html"
},
{
"name": "[oss-security] 20240201 runc: CVE-2024-21626: high severity container breakout attack",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2024/01/31/6"
},
{
"name": "[oss-security] 20240201 Re: runc: CVE-2024-21626: high severity container breakout attack",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2024/02/01/1"
},
{
"name": "[oss-security] 20240202 Re: Re: runc: CVE-2024-21626: high severity container breakout attack",
"tags": [
"mailing-list",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2024/02/02/3"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2019-02-11T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a command as root within one of these types of containers: (1) a new container with an attacker-controlled image, or (2) an existing container, to which the attacker previously had write access, that can be attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/self/exe."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-02-02T12:06:25.591627",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://github.com/opencontainers/runc/commit/6635b4f0c6af3810594d2770f662f34ddc15b40d"
},
{
"name": "RHSA-2019:0408",
"tags": [
"vendor-advisory"
],
"url": "https://access.redhat.com/errata/RHSA-2019:0408"
},
{
"url": "https://github.com/rancher/runc-cve"
},
{
"name": "RHSA-2019:0401",
"tags": [
"vendor-advisory"
],
"url": "https://access.redhat.com/errata/RHSA-2019:0401"
},
{
"url": "https://github.com/docker/docker-ce/releases/tag/v18.09.2"
},
{
"url": "https://www.synology.com/security/advisory/Synology_SA_19_06"
},
{
"url": "https://security.netapp.com/advisory/ntap-20190307-0008/"
},
{
"name": "RHSA-2019:0303",
"tags": [
"vendor-advisory"
],
"url": "https://access.redhat.com/errata/RHSA-2019:0303"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190215-runc"
},
{
"url": "https://github.com/q3k/cve-2019-5736-poc"
},
{
"name": "46359",
"tags": [
"exploit"
],
"url": "https://www.exploit-db.com/exploits/46359/"
},
{
"url": "https://github.com/opencontainers/runc/commit/0a8e4117e7f715d5fbeef398405813ce8e88558b"
},
{
"url": "https://aws.amazon.com/security/security-bulletins/AWS-2019-002/"
},
{
"url": "https://www.openwall.com/lists/oss-security/2019/02/11/2"
},
{
"url": "https://kubernetes.io/blog/2019/02/11/runc-and-cve-2019-5736/"
},
{
"url": "https://access.redhat.com/security/cve/cve-2019-5736"
},
{
"name": "46369",
"tags": [
"exploit"
],
"url": "https://www.exploit-db.com/exploits/46369/"
},
{
"name": "RHSA-2019:0304",
"tags": [
"vendor-advisory"
],
"url": "https://access.redhat.com/errata/RHSA-2019:0304"
},
{
"url": "https://github.com/Frichetten/CVE-2019-5736-PoC"
},
{
"url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbhf03913en_us"
},
{
"url": "https://brauner.github.io/2019/02/12/privileged-containers.html"
},
{
"url": "https://www.twistlock.com/2019/02/11/how-to-mitigate-cve-2019-5736-in-runc-and-docker/"
},
{
"url": "https://cloud.google.com/kubernetes-engine/docs/security-bulletins#february-11-2019-runc"
},
{
"name": "106976",
"tags": [
"vdb-entry"
],
"url": "http://www.securityfocus.com/bid/106976"
},
{
"url": "https://access.redhat.com/security/vulnerabilities/runcescape"
},
{
"url": "https://blog.dragonsector.pl/2019/02/cve-2019-5736-escape-from-docker-and.html"
},
{
"url": "https://bugzilla.suse.com/show_bug.cgi?id=1121967"
},
{
"name": "[mesos-dev] 20190323 CVE-2019-0204: Some Mesos components can be overwritten making arbitrary code execution possible.",
"tags": [
"mailing-list"
],
"url": "https://lists.apache.org/thread.html/b162dd624dc088cd634292f0402282a1d1d0ce853baeae8205bc033c%40%3Cdev.mesos.apache.org%3E"
},
{
"name": "[mesos-user] 20190323 CVE-2019-0204: Some Mesos components can be overwritten making arbitrary code execution possible.",
"tags": [
"mailing-list"
],
"url": "https://lists.apache.org/thread.html/a258757af84c5074dc7bf932622020fd4f60cef65a84290380386706%40%3Cuser.mesos.apache.org%3E"
},
{
"name": "[oss-security] 20190323 CVE-2019-0204: Some Mesos components can be overwritten making arbitrary code execution possible.",
"tags": [
"mailing-list"
],
"url": "http://www.openwall.com/lists/oss-security/2019/03/23/1"
},
{
"url": "https://support.mesosphere.com/s/article/Known-Issue-Container-Runtime-Vulnerability-MSPH-2019-0003"
},
{
"name": "openSUSE-SU-2019:1079",
"tags": [
"vendor-advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00044.html"
},
{
"name": "openSUSE-SU-2019:1227",
"tags": [
"vendor-advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00074.html"
},
{
"name": "openSUSE-SU-2019:1275",
"tags": [
"vendor-advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00091.html"
},
{
"name": "FEDORA-2019-bc70b381ad",
"tags": [
"vendor-advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V6A4OSFM5GGOWW4ECELV5OHX2XRAUSPH/"
},
{
"name": "FEDORA-2019-6174b47003",
"tags": [
"vendor-advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SWFJGIPYAAAMVSWWI3QWYXGA3ZBU2H4W/"
},
{
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03410944"
},
{
"name": "RHSA-2019:0975",
"tags": [
"vendor-advisory"
],
"url": "https://access.redhat.com/errata/RHSA-2019:0975"
},
{
"url": "https://azure.microsoft.com/en-us/updates/cve-2019-5736-and-runc-vulnerability/"
},
{
"url": "https://azure.microsoft.com/en-us/updates/iot-edge-fix-cve-2019-5736/"
},
{
"name": "[dlab-dev] 20190524 [jira] [Created] (DLAB-723) Runc vulnerability CVE-2019-5736",
"tags": [
"mailing-list"
],
"url": "https://lists.apache.org/thread.html/acacf018c12636e41667e94ac0a1e9244e887eef2debdd474640aa6e%40%3Cdev.dlab.apache.org%3E"
},
{
"name": "[dlab-dev] 20190524 [jira] [Updated] (DLAB-723) Runc vulnerability CVE-2019-5736",
"tags": [
"mailing-list"
],
"url": "https://lists.apache.org/thread.html/a585f64d14c31ab393b90c5f17e41d9765a1a17eec63856ce750af46%40%3Cdev.dlab.apache.org%3E"
},
{
"name": "openSUSE-SU-2019:1444",
"tags": [
"vendor-advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00060.html"
},
{
"name": "openSUSE-SU-2019:1481",
"tags": [
"vendor-advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00073.html"
},
{
"name": "openSUSE-SU-2019:1499",
"tags": [
"vendor-advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00011.html"
},
{
"name": "openSUSE-SU-2019:1506",
"tags": [
"vendor-advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00015.html"
},
{
"name": "[oss-security] 20190628 Re: linux-distros membership application - Microsoft",
"tags": [
"mailing-list"
],
"url": "http://www.openwall.com/lists/oss-security/2019/06/28/2"
},
{
"name": "[oss-security] 20190706 Re: linux-distros membership application - Microsoft",
"tags": [
"mailing-list"
],
"url": "http://www.openwall.com/lists/oss-security/2019/07/06/3"
},
{
"name": "[oss-security] 20190706 Re: linux-distros membership application - Microsoft",
"tags": [
"mailing-list"
],
"url": "http://www.openwall.com/lists/oss-security/2019/07/06/4"
},
{
"name": "USN-4048-1",
"tags": [
"vendor-advisory"
],
"url": "https://usn.ubuntu.com/4048-1/"
},
{
"name": "openSUSE-SU-2019:2021",
"tags": [
"vendor-advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00084.html"
},
{
"name": "FEDORA-2019-2baa1f7b19",
"tags": [
"vendor-advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EGZKRCKI3Y7FMADO2MENMT4TU24QGHFR/"
},
{
"name": "FEDORA-2019-c1dac1b3b8",
"tags": [
"vendor-advisory"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DLC52IOJN6IQJWJ6CUI6AIUP6GVVG2QP/"
},
{
"name": "[dlab-dev] 20190923 [jira] [Assigned] (DLAB-723) Runc vulnerability CVE-2019-5736",
"tags": [
"mailing-list"
],
"url": "https://lists.apache.org/thread.html/24e54e3c6b2259e3903b6b8fe26896ac649c481ea99c5739468c92a3%40%3Cdev.dlab.apache.org%3E"
},
{
"name": "openSUSE-SU-2019:2245",
"tags": [
"vendor-advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00007.html"
},
{
"name": "openSUSE-SU-2019:2286",
"tags": [
"vendor-advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00029.html"
},
{
"name": "[oss-security] 20191023 Membership application for linux-distros - VMware",
"tags": [
"mailing-list"
],
"url": "http://www.openwall.com/lists/oss-security/2019/10/24/1"
},
{
"name": "[oss-security] 20191029 Re: Membership application for linux-distros - VMware",
"tags": [
"mailing-list"
],
"url": "http://www.openwall.com/lists/oss-security/2019/10/29/3"
},
{
"name": "GLSA-202003-21",
"tags": [
"vendor-advisory"
],
"url": "https://security.gentoo.org/glsa/202003-21"
},
{
"name": "[dlab-dev] 20200525 [jira] [Deleted] (DLAB-723) Runc vulnerability CVE-2019-5736",
"tags": [
"mailing-list"
],
"url": "https://lists.apache.org/thread.html/rc494623986d76593873ce5a40dd69cb3629400d10750d5d7e96b8587%40%3Cdev.dlab.apache.org%3E"
},
{
"name": "[geode-issues] 20200831 [jira] [Created] (GEODE-8471) Dependency security issues in geode-core-1.12",
"tags": [
"mailing-list"
],
"url": "https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E"
},
{
"url": "http://packetstormsecurity.com/files/163339/Docker-Container-Escape.html"
},
{
"url": "http://packetstormsecurity.com/files/165197/Docker-runc-Command-Execution-Proof-Of-Concept.html"
},
{
"name": "[oss-security] 20240201 runc: CVE-2024-21626: high severity container breakout attack",
"tags": [
"mailing-list"
],
"url": "http://www.openwall.com/lists/oss-security/2024/01/31/6"
},
{
"name": "[oss-security] 20240201 Re: runc: CVE-2024-21626: high severity container breakout attack",
"tags": [
"mailing-list"
],
"url": "http://www.openwall.com/lists/oss-security/2024/02/01/1"
},
{
"name": "[oss-security] 20240202 Re: Re: runc: CVE-2024-21626: high severity container breakout attack",
"tags": [
"mailing-list"
],
"url": "http://www.openwall.com/lists/oss-security/2024/02/02/3"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2019-5736",
"datePublished": "2019-02-11T00:00:00",
"dateReserved": "2019-01-08T00:00:00",
"dateUpdated": "2024-08-04T20:01:52.208Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
cve-2020-11844
Vulnerability from cvelistv5
Published
2020-05-29 21:15
Modified
2024-08-04 11:42
Severity ?
EPSS score ?
Summary
Incorrect Authorization vulnerability in Micro Focus Container Deployment Foundation component affects products: - Hybrid Cloud Management. Versions 2018.05 to 2019.11. - ArcSight Investigate. versions 2.4.0, 3.0.0 and 3.1.0. - ArcSight Transformation Hub. versions 3.0.0, 3.1.0, 3.2.0. - ArcSight Interset. version 6.0.0. - ArcSight ESM (when ArcSight Fusion 1.0 is installed). version 7.2.1. - Service Management Automation (SMA). versions 2018.05 to 2020.02 - Operation Bridge Suite (Containerized). Versions 2018.05 to 2020.02. - Network Operation Management. versions 2017.11 to 2019.11. - Data Center Automation Containerized. versions 2018.05 to 2019.11 - Identity Intelligence. versions 1.1.0 and 1.1.1. The vulnerability could be exploited to provide unauthorized access to the Container Deployment Foundation.
References
| ▼ | URL | Tags |
|---|---|---|
| https://softwaresupport.softwaregrp.com/doc/KM03645636 | x_refsource_CONFIRM | |
| https://softwaresupport.softwaregrp.com/doc/KM03645642 | x_refsource_CONFIRM | |
| https://softwaresupport.softwaregrp.com/doc/KM03645631 | x_refsource_CONFIRM | |
| https://softwaresupport.softwaregrp.com/doc/KM03645630 | x_refsource_CONFIRM | |
| https://softwaresupport.softwaregrp.com/doc/KM03645629 | x_refsource_CONFIRM | |
| https://softwaresupport.softwaregrp.com/doc/KM03645628 | x_refsource_CONFIRM | |
| https://support.microfocus.com/kb/doc.php?id=7024637 | x_refsource_CONFIRM |
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ▼ | Micro Focus | Hybrid Cloud Management |
Version: 2018.05 < 2019.11 |
||||||||||||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T11:42:00.664Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://softwaresupport.softwaregrp.com/doc/KM03645636"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://softwaresupport.softwaregrp.com/doc/KM03645642"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://softwaresupport.softwaregrp.com/doc/KM03645631"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://softwaresupport.softwaregrp.com/doc/KM03645630"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://softwaresupport.softwaregrp.com/doc/KM03645629"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://softwaresupport.softwaregrp.com/doc/KM03645628"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://support.microfocus.com/kb/doc.php?id=7024637"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Hybrid Cloud Management",
"vendor": "Micro Focus ",
"versions": [
{
"lessThan": "2019.11",
"status": "affected",
"version": "2018.05",
"versionType": "custom"
}
]
},
{
"product": "ArcSight Investigate. versions",
"vendor": "Micro Focus ",
"versions": [
{
"status": "affected",
"version": "2.4.0"
},
{
"status": "affected",
"version": "3.0.0"
},
{
"status": "affected",
"version": "3.1.0"
}
]
},
{
"product": "ArcSight Transformation Hub",
"vendor": "Micro Focus ",
"versions": [
{
"status": "affected",
"version": "3.0.0"
},
{
"status": "affected",
"version": "3.1.0"
},
{
"status": "affected",
"version": "3.2.0"
}
]
},
{
"product": "ArcSight Interset",
"vendor": "Micro Focus ",
"versions": [
{
"status": "affected",
"version": "6.0.0"
}
]
},
{
"product": "ArcSight ESM (when ArcSight Fusion",
"vendor": "Micro Focus ",
"versions": [
{
"status": "affected",
"version": "7.2.1"
}
]
},
{
"product": "Service Management Automation (SMA)",
"vendor": "Micro Focus ",
"versions": [
{
"status": "affected",
"version": "2018.05"
},
{
"status": "affected",
"version": "2018.08"
},
{
"status": "affected",
"version": "2018.11"
},
{
"status": "affected",
"version": "2019.02"
},
{
"status": "affected",
"version": "2019.05"
},
{
"status": "affected",
"version": "2019.08"
},
{
"status": "affected",
"version": "2019.11"
},
{
"status": "affected",
"version": "2020.02"
}
]
},
{
"product": " Operation Bridge Suite (Containerized)",
"vendor": "Micro Focus ",
"versions": [
{
"status": "affected",
"version": "2018.05"
},
{
"status": "affected",
"version": "2018.08"
},
{
"status": "affected",
"version": "2018.11"
},
{
"status": "affected",
"version": "2019.02"
},
{
"status": "affected",
"version": "2019.05"
},
{
"status": "affected",
"version": "2019.8"
},
{
"status": "affected",
"version": "2019.11"
}
]
},
{
"product": "Network Operation Management",
"vendor": "Micro Focus ",
"versions": [
{
"lessThanOrEqual": "2019.11",
"status": "affected",
"version": "2017.11",
"versionType": "custom"
}
]
},
{
"product": "Data Center Automation Containerized",
"vendor": "Micro Focus ",
"versions": [
{
"status": "affected",
"version": "2018.05"
},
{
"status": "affected",
"version": "2018.08"
},
{
"status": "affected",
"version": "2018.11"
},
{
"status": "affected",
"version": "2019.02"
},
{
"status": "affected",
"version": "2019.05"
},
{
"status": "affected",
"version": "2019.08"
},
{
"status": "affected",
"version": "2019.11"
}
]
},
{
"product": "Identity Intelligence. versions",
"vendor": "Micro Focus ",
"versions": [
{
"status": "affected",
"version": "1.1.0"
},
{
"lessThan": "unspecified",
"status": "unaffected",
"version": "next of 1.1.1",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Incorrect Authorization vulnerability in Micro Focus Container Deployment Foundation component affects products: - Hybrid Cloud Management. Versions 2018.05 to 2019.11. - ArcSight Investigate. versions 2.4.0, 3.0.0 and 3.1.0. - ArcSight Transformation Hub. versions 3.0.0, 3.1.0, 3.2.0. - ArcSight Interset. version 6.0.0. - ArcSight ESM (when ArcSight Fusion 1.0 is installed). version 7.2.1. - Service Management Automation (SMA). versions 2018.05 to 2020.02 - Operation Bridge Suite (Containerized). Versions 2018.05 to 2020.02. - Network Operation Management. versions 2017.11 to 2019.11. - Data Center Automation Containerized. versions 2018.05 to 2019.11 - Identity Intelligence. versions 1.1.0 and 1.1.1. The vulnerability could be exploited to provide unauthorized access to the Container Deployment Foundation."
}
],
"exploits": [
{
"lang": "en",
"value": "CWE-863 Incorrect Authorization"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2021-01-06T16:15:54",
"orgId": "f81092c5-7f14-476d-80dc-24857f90be84",
"shortName": "microfocus"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://softwaresupport.softwaregrp.com/doc/KM03645636"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://softwaresupport.softwaregrp.com/doc/KM03645642"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://softwaresupport.softwaregrp.com/doc/KM03645631"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://softwaresupport.softwaregrp.com/doc/KM03645630"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://softwaresupport.softwaregrp.com/doc/KM03645629"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://softwaresupport.softwaregrp.com/doc/KM03645628"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://support.microfocus.com/kb/doc.php?id=7024637"
}
],
"solutions": [
{
"lang": "en",
"value": "For Data Center Automation Containerized https://softwaresupport.softwaregrp.com/doc/KM03645628\nFor Network Operation Management https://softwaresupport.softwaregrp.com/doc/KM03645629\nFor Operation Bridge Suite https://softwaresupport.softwaregrp.com/doc/KM03645630\nFor SMA https://softwaresupport.softwaregrp.com/doc/KM03645631\nFor ArcSight apps https://softwaresupport.softwaregrp.com/doc/KM03645642\nFor Hybrid Cloud Management https://softwaresupport.softwaregrp.com/doc/KM03645636\nFor Identity Intelligence https://support.microfocus.com/kb/doc.php?id=7024637\" } ] }"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "Incorrect Authorization vulnerability in the Micro Focus Container Deployment Foundation affecting multiple products.",
"x_generator": {
"engine": "Vulnogram 0.0.9"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security@microfocus.com",
"ID": "CVE-2020-11844",
"STATE": "PUBLIC",
"TITLE": "Incorrect Authorization vulnerability in the Micro Focus Container Deployment Foundation affecting multiple products."
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Hybrid Cloud Management",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "2018.05",
"version_value": "2019.11"
}
]
}
},
{
"product_name": "ArcSight Investigate. versions",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "2.4.0"
},
{
"version_affected": "=",
"version_value": "3.0.0"
},
{
"version_affected": "=",
"version_value": "3.1.0"
}
]
}
},
{
"product_name": "ArcSight Transformation Hub",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "3.0.0"
},
{
"version_affected": "=",
"version_value": "3.1.0"
},
{
"version_affected": "=",
"version_value": "3.2.0"
}
]
}
},
{
"product_name": "ArcSight Interset",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "6.0.0"
}
]
}
},
{
"product_name": "ArcSight ESM (when ArcSight Fusion",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "7.2.1"
}
]
}
},
{
"product_name": "Service Management Automation (SMA)",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "2018.05"
},
{
"version_affected": "=",
"version_value": "2018.08"
},
{
"version_affected": "=",
"version_value": "2018.11"
},
{
"version_affected": "=",
"version_value": "2019.02"
},
{
"version_affected": "=",
"version_value": "2019.05"
},
{
"version_affected": "=",
"version_value": "2019.08"
},
{
"version_affected": "=",
"version_value": "2019.11"
},
{
"version_affected": "=",
"version_value": "2020.02"
}
]
}
},
{
"product_name": " Operation Bridge Suite (Containerized)",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "2018.05"
},
{
"version_affected": "=",
"version_value": "2018.08"
},
{
"version_affected": "=",
"version_value": "2018.11"
},
{
"version_affected": "=",
"version_value": "2019.02"
},
{
"version_affected": "=",
"version_value": "2019.05"
},
{
"version_affected": "=",
"version_value": "2019.8"
},
{
"version_affected": "=",
"version_value": "2019.11"
}
]
}
},
{
"product_name": "Network Operation Management",
"version": {
"version_data": [
{
"version_affected": "\u003c=",
"version_name": "2017.11",
"version_value": "2019.11"
}
]
}
},
{
"product_name": "Data Center Automation Containerized",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "2018.05"
},
{
"version_affected": "=",
"version_value": "2018.08"
},
{
"version_affected": "=",
"version_value": "2018.11"
},
{
"version_affected": "=",
"version_value": "2019.02"
},
{
"version_affected": "=",
"version_value": "2019.05"
},
{
"version_affected": "=",
"version_value": "2019.08"
},
{
"version_affected": "=",
"version_value": "2019.11"
}
]
}
},
{
"product_name": "Identity Intelligence. versions",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "1.1.0"
},
{
"version_affected": "!\u003e",
"version_value": "1.1.1"
}
]
}
}
]
},
"vendor_name": "Micro Focus "
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Incorrect Authorization vulnerability in Micro Focus Container Deployment Foundation component affects products: - Hybrid Cloud Management. Versions 2018.05 to 2019.11. - ArcSight Investigate. versions 2.4.0, 3.0.0 and 3.1.0. - ArcSight Transformation Hub. versions 3.0.0, 3.1.0, 3.2.0. - ArcSight Interset. version 6.0.0. - ArcSight ESM (when ArcSight Fusion 1.0 is installed). version 7.2.1. - Service Management Automation (SMA). versions 2018.05 to 2020.02 - Operation Bridge Suite (Containerized). Versions 2018.05 to 2020.02. - Network Operation Management. versions 2017.11 to 2019.11. - Data Center Automation Containerized. versions 2018.05 to 2019.11 - Identity Intelligence. versions 1.1.0 and 1.1.1. The vulnerability could be exploited to provide unauthorized access to the Container Deployment Foundation."
}
]
},
"exploit": [
{
"lang": "en",
"value": "CWE-863 Incorrect Authorization"
}
],
"generator": {
"engine": "Vulnogram 0.0.9"
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-863 Incorrect Authorization"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://softwaresupport.softwaregrp.com/doc/KM03645636",
"refsource": "CONFIRM",
"url": "https://softwaresupport.softwaregrp.com/doc/KM03645636"
},
{
"name": "https://softwaresupport.softwaregrp.com/doc/KM03645642",
"refsource": "CONFIRM",
"url": "https://softwaresupport.softwaregrp.com/doc/KM03645642"
},
{
"name": "https://softwaresupport.softwaregrp.com/doc/KM03645631",
"refsource": "CONFIRM",
"url": "https://softwaresupport.softwaregrp.com/doc/KM03645631"
},
{
"name": "https://softwaresupport.softwaregrp.com/doc/KM03645630",
"refsource": "CONFIRM",
"url": "https://softwaresupport.softwaregrp.com/doc/KM03645630"
},
{
"name": "https://softwaresupport.softwaregrp.com/doc/KM03645629",
"refsource": "CONFIRM",
"url": "https://softwaresupport.softwaregrp.com/doc/KM03645629"
},
{
"name": "https://softwaresupport.softwaregrp.com/doc/KM03645628",
"refsource": "CONFIRM",
"url": "https://softwaresupport.softwaregrp.com/doc/KM03645628"
},
{
"name": "https://support.microfocus.com/kb/doc.php?id=7024637",
"refsource": "CONFIRM",
"url": "https://support.microfocus.com/kb/doc.php?id=7024637"
}
]
},
"solution": [
{
"lang": "en",
"value": "For Data Center Automation Containerized https://softwaresupport.softwaregrp.com/doc/KM03645628\nFor Network Operation Management https://softwaresupport.softwaregrp.com/doc/KM03645629\nFor Operation Bridge Suite https://softwaresupport.softwaregrp.com/doc/KM03645630\nFor SMA https://softwaresupport.softwaregrp.com/doc/KM03645631\nFor ArcSight apps https://softwaresupport.softwaregrp.com/doc/KM03645642\nFor Hybrid Cloud Management https://softwaresupport.softwaregrp.com/doc/KM03645636\nFor Identity Intelligence https://support.microfocus.com/kb/doc.php?id=7024637\" } ] }"
}
],
"source": {
"discovery": "INTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "f81092c5-7f14-476d-80dc-24857f90be84",
"assignerShortName": "microfocus",
"cveId": "CVE-2020-11844",
"datePublished": "2020-05-29T21:15:23",
"dateReserved": "2020-04-16T00:00:00",
"dateUpdated": "2024-08-04T11:42:00.664Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
Vulnerability from fkie_nvd
Published
2018-08-30 21:29
Modified
2024-11-21 04:10
Severity ?
7.1 (High) - CVSS:3.0/AV:A/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:H
9.8 (Critical) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
Remote Code Execution in the following products Hybrid Cloud Management Containerized Suite HCM2017.11, HCM2018.02, HCM2018.05, Operations Bridge Containerized Suite 2017.11, 2018.02, 2018.05, Data Center Automation Containerized Suite 2017.01 until 2018.05, Service Management Automation Suite 2017.11, 2018.02, 2018.05, Service Virtualization (SV) with floating licenses using Any version using APLS older than 10.7, Unified Functional Testing (UFT) with floating licenses using Any version using APLS older than 10.7, Network Virtualization (NV) with floating licenses using Any version using APLS older than 10.7 and Network Operations Management (NOM) Suite CDF 2017.11, 2018.02, 2018.05 will allow Remote Code Execution.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microfocus:data_center_automation:2017.01:*:*:*:*:*:*:*",
"matchCriteriaId": "F8CBD371-84AA-45F2-B53C-FF2F94316FDF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:data_center_automation:2017.05:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA57EDB-69A7-439A-886A-06E844A45CFB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:data_center_automation:2017.08:*:*:*:*:*:*:*",
"matchCriteriaId": "B7E861D6-7812-4190-A3C1-F338D544123E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:data_center_automation:2017.09:*:*:*:*:*:*:*",
"matchCriteriaId": "4CA11555-95A4-4086-9C67-CA4C92EA4D0A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:data_center_automation:2017.11:*:*:*:*:*:*:*",
"matchCriteriaId": "008EA036-C58F-4B01-AEAD-3E8E79304A68",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:data_center_automation:2018.02:*:*:*:*:*:*:*",
"matchCriteriaId": "34E310E2-2F0F-4942-A7CD-61616D366824",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:data_center_automation:2018.05:*:*:*:*:*:*:*",
"matchCriteriaId": "D1CA1EEE-301A-4DB1-ACE6-A8DC7FF101C7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:hybrid_cloud_management:2017.11:*:*:*:premium:*:*:*",
"matchCriteriaId": "EC84CBAE-0AB4-4405-8423-A221E3BABCA4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:hybrid_cloud_management:2017.11:*:*:*:ultimate:*:*:*",
"matchCriteriaId": "28F73BBD-DA6B-42A5-BDC9-F8832E475B03",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:hybrid_cloud_management:2018.02:*:*:*:premium:*:*:*",
"matchCriteriaId": "E52C4EA5-AE1E-476E-9AAF-FB8A6D34658A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:hybrid_cloud_management:2018.02:*:*:*:ultimate:*:*:*",
"matchCriteriaId": "69087F9D-D5F1-462C-8264-13DBCF50474C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:hybrid_cloud_management:2018.05:*:*:*:premium:*:*:*",
"matchCriteriaId": "5686CFAC-0091-4B98-9654-359AC77343EA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:hybrid_cloud_management:2018.05:*:*:*:ultimate:*:*:*",
"matchCriteriaId": "C7E8812B-28DC-4F66-B395-73AF00E57113",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:network_operations_management:2017.11:*:*:*:*:*:*:*",
"matchCriteriaId": "E21E1238-6D5F-4AA5-8FE4-B818D0DBF6C4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:network_operations_management:2018.02:*:*:*:*:*:*:*",
"matchCriteriaId": "EA8F1189-19DF-43EB-9B35-61720EE11357",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:network_operations_management:2018.05:*:*:*:premium:*:*:*",
"matchCriteriaId": "DF75B30C-1E8D-462E-A30A-9C17EF0B7CE7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:operations_bridge:2017.11:*:*:*:premium:*:*:*",
"matchCriteriaId": "34099595-3D44-4B10-AA42-5A6DC9B82F25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:operations_bridge:2018.02:*:*:*:premium:*:*:*",
"matchCriteriaId": "2D4D7844-FA36-4C63-8AD6-C40F81134DBC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:operations_bridge:2018.05:*:*:*:premium:*:*:*",
"matchCriteriaId": "78756DED-D384-4F7F-99C3-6BC6293B1D28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:service_management_automation:2017.11:*:*:*:*:*:*:*",
"matchCriteriaId": "5166B660-88F2-437B-96DA-F7E44E6AE9A3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:service_management_automation:2018.02:*:*:*:*:*:*:*",
"matchCriteriaId": "2DCFB2E7-D769-4365-9B99-952907563749",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:service_management_automation:2018.05:*:*:*:*:*:*:*",
"matchCriteriaId": "3909E337-F1FC-45C8-A120-EEBDBFB0E4D0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microfocus:network_virtualization:12.50:*:*:*:*:*:*:*",
"matchCriteriaId": "38941402-8B70-45C2-A14C-94B68D10E5FF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:service_virtualization:1.00:*:*:*:*:*:*:*",
"matchCriteriaId": "3292BE86-4343-4A86-AB7B-C2EC51ABEABF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:unified_functional_testing:12.50:*:*:*:*:*:*:*",
"matchCriteriaId": "A4C9D71B-481D-46C8-8532-D4781172D442",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microfocus:autopass_license_server:*:*:*:*:*:*:*:*",
"matchCriteriaId": "AB9A56BA-5A4F-4CD3-B1DF-8A452FDB858B",
"versionEndExcluding": "10.7.0",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Remote Code Execution in the following products Hybrid Cloud Management Containerized Suite HCM2017.11, HCM2018.02, HCM2018.05, Operations Bridge Containerized Suite 2017.11, 2018.02, 2018.05, Data Center Automation Containerized Suite 2017.01 until 2018.05, Service Management Automation Suite 2017.11, 2018.02, 2018.05, Service Virtualization (SV) with floating licenses using Any version using APLS older than 10.7, Unified Functional Testing (UFT) with floating licenses using Any version using APLS older than 10.7, Network Virtualization (NV) with floating licenses using Any version using APLS older than 10.7 and Network Operations Management (NOM) Suite CDF 2017.11, 2018.02, 2018.05 will allow Remote Code Execution."
},
{
"lang": "es",
"value": "Ejecuci\u00f3n remota de c\u00f3digo en los siguientes productos: Hybrid Cloud Management Containerized Suite HCM2017.11, HCM2018.02, HCM2018.05; Operations Bridge Containerized Suite 2017.11, 2018.02, 2018.05; Data Center Automation Containerized Suite 2017.01 hasta la versi\u00f3n 2018.05; Service Management Automation Suite 2017.11, 2018.02, 2018.05; Service Virtualization (SV) con licencias flotantes en cualquier versi\u00f3n que emplea APLS anteriores a 10.7; Unified Functional Testing (UFT) con licencias flotantes en cualquier versi\u00f3n que emplea APLS anteriores a 10.7; Network Virtualization (NV) con licencias flotantes en cualquier versi\u00f3n que emplea APLS anteriores a 10.7 y Network Operations Management (NOM) Suite CDF 2017.11, 2018.02y 2018.05 permitir\u00e1 la ejecuci\u00f3n remota de c\u00f3digo."
}
],
"id": "CVE-2018-6499",
"lastModified": "2024-11-21T04:10:46.950",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:H",
"version": "3.0"
},
"exploitabilityScore": 1.2,
"impactScore": 5.3,
"source": "security@opentext.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2018-08-30T21:29:00.390",
"references": [
{
"source": "security@opentext.com",
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236632?lang=en\u0026cc=us\u0026hpappid=206728_SSO_PRO"
},
{
"source": "security@opentext.com",
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236648"
},
{
"source": "security@opentext.com",
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236667"
},
{
"source": "security@opentext.com",
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236669"
},
{
"source": "security@opentext.com",
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236722"
},
{
"source": "security@opentext.com",
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236726"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236632?lang=en\u0026cc=us\u0026hpappid=206728_SSO_PRO"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236648"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236667"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236669"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236722"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236726"
}
],
"sourceIdentifier": "security@opentext.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-94"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2020-05-29 22:15
Modified
2024-11-21 04:58
Severity ?
10.0 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
Incorrect Authorization vulnerability in Micro Focus Container Deployment Foundation component affects products: - Hybrid Cloud Management. Versions 2018.05 to 2019.11. - ArcSight Investigate. versions 2.4.0, 3.0.0 and 3.1.0. - ArcSight Transformation Hub. versions 3.0.0, 3.1.0, 3.2.0. - ArcSight Interset. version 6.0.0. - ArcSight ESM (when ArcSight Fusion 1.0 is installed). version 7.2.1. - Service Management Automation (SMA). versions 2018.05 to 2020.02 - Operation Bridge Suite (Containerized). Versions 2018.05 to 2020.02. - Network Operation Management. versions 2017.11 to 2019.11. - Data Center Automation Containerized. versions 2018.05 to 2019.11 - Identity Intelligence. versions 1.1.0 and 1.1.1. The vulnerability could be exploited to provide unauthorized access to the Container Deployment Foundation.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| microfocus | service_management_automation | 2018.05 | |
| microfocus | service_management_automation | 2018.08 | |
| microfocus | service_management_automation | 2018.11 | |
| microfocus | service_management_automation | 2019.02 | |
| microfocus | service_management_automation | 2019.05 | |
| microfocus | service_management_automation | 2019.08 | |
| microfocus | service_management_automation | 2019.11 | |
| microfocus | service_management_automation | 2020.02 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microfocus:service_management_automation:2018.05:*:*:*:*:*:*:*",
"matchCriteriaId": "3909E337-F1FC-45C8-A120-EEBDBFB0E4D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:service_management_automation:2018.08:*:*:*:*:*:*:*",
"matchCriteriaId": "934D6CB3-E159-40F4-8E5B-CDDDD824CAA0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:service_management_automation:2018.11:*:*:*:*:*:*:*",
"matchCriteriaId": "82C0FD9D-6117-40DE-9386-7327867F9615",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:service_management_automation:2019.02:*:*:*:*:*:*:*",
"matchCriteriaId": "8CEF7C73-7A74-4CAE-B420-F1BB011CEA30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:service_management_automation:2019.05:*:*:*:*:*:*:*",
"matchCriteriaId": "19C9AB03-FAC2-4150-BC35-37128DA918C8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:service_management_automation:2019.08:*:*:*:*:*:*:*",
"matchCriteriaId": "DF6D712E-A7E4-4ACD-83D9-FF173C69381C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:service_management_automation:2019.11:*:*:*:*:*:*:*",
"matchCriteriaId": "CBD8E09D-599D-4F8E-8221-C034BF0A70E6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:service_management_automation:2020.02:*:*:*:*:*:*:*",
"matchCriteriaId": "65EF7382-2760-4C01-8731-D5D8DDF3A47E",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Incorrect Authorization vulnerability in Micro Focus Container Deployment Foundation component affects products: - Hybrid Cloud Management. Versions 2018.05 to 2019.11. - ArcSight Investigate. versions 2.4.0, 3.0.0 and 3.1.0. - ArcSight Transformation Hub. versions 3.0.0, 3.1.0, 3.2.0. - ArcSight Interset. version 6.0.0. - ArcSight ESM (when ArcSight Fusion 1.0 is installed). version 7.2.1. - Service Management Automation (SMA). versions 2018.05 to 2020.02 - Operation Bridge Suite (Containerized). Versions 2018.05 to 2020.02. - Network Operation Management. versions 2017.11 to 2019.11. - Data Center Automation Containerized. versions 2018.05 to 2019.11 - Identity Intelligence. versions 1.1.0 and 1.1.1. The vulnerability could be exploited to provide unauthorized access to the Container Deployment Foundation."
},
{
"lang": "es",
"value": "La vulnerabilidad de la autorizaci\u00f3n incorrecta en el componente Micro Focus Container Deployment Foundation afecta a los productos: Hybrid Cloud Management. desde la versi\u00f3n 2018.05 hasta 2019.11. - ArcSight Investigate. versiones 2.4.0, 3.0.0 y 3.1.0. - ArcSight Transformation Hub. versiones 3.0.0, 3.1.0, 3.2.0. - ArcSight Interset. versi\u00f3n 6.0.0. - ArcSight ESM (cuando se instala ArcSight Fusion 1.0). versi\u00f3n 7.2.1. - Service Management Automation (SMA). desde la versi\u00f3n 2018.05 hasta 2020.02 - Operation Bridge Suite (Containerized). desde la versi\u00f3n 2018.05 hasta 2020.02. - Network Operation Management. desde la versi\u00f3n 2017.11 hasta 2019.11. - Data Center Automation Containerized. desde la versi\u00f3n 2018.05 hasta 2019.11. La vulnerabilidad podr\u00eda ser explotada para proporcionar acceso no autorizado al Container Deployment Foundation"
}
],
"id": "CVE-2020-11844",
"lastModified": "2024-11-21T04:58:44.540",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10.0,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 6.0,
"source": "security@opentext.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2020-05-29T22:15:10.473",
"references": [
{
"source": "security@opentext.com",
"url": "https://softwaresupport.softwaregrp.com/doc/KM03645628"
},
{
"source": "security@opentext.com",
"url": "https://softwaresupport.softwaregrp.com/doc/KM03645629"
},
{
"source": "security@opentext.com",
"url": "https://softwaresupport.softwaregrp.com/doc/KM03645630"
},
{
"source": "security@opentext.com",
"url": "https://softwaresupport.softwaregrp.com/doc/KM03645631"
},
{
"source": "security@opentext.com",
"url": "https://softwaresupport.softwaregrp.com/doc/KM03645636"
},
{
"source": "security@opentext.com",
"url": "https://softwaresupport.softwaregrp.com/doc/KM03645642"
},
{
"source": "security@opentext.com",
"url": "https://support.microfocus.com/kb/doc.php?id=7024637"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://softwaresupport.softwaregrp.com/doc/KM03645628"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://softwaresupport.softwaregrp.com/doc/KM03645629"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://softwaresupport.softwaregrp.com/doc/KM03645630"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://softwaresupport.softwaregrp.com/doc/KM03645631"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://softwaresupport.softwaregrp.com/doc/KM03645636"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://softwaresupport.softwaregrp.com/doc/KM03645642"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://support.microfocus.com/kb/doc.php?id=7024637"
}
],
"sourceIdentifier": "security@opentext.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-863"
}
],
"source": "security@opentext.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-863"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2018-08-30 21:29
Modified
2024-11-21 04:10
Severity ?
8.8 (High) - CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H
9.8 (Critical) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
Remote Code Execution in the following products Hybrid Cloud Management Containerized Suite HCM2017.11, HCM2018.02, HCM2018.05, Operations Bridge Containerized Suite 2017.11, 2018.02, 2018.05, Data Center Automation Containerized Suite 2017.01 until 2018.05, Service Management Automation Suite 2017.11, 2018.02, 2018.05 and Network Operations Management (NOM) Suite CDF 2017.11, 2018.02, 2018.05 will allow Remote Code Execution.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| microfocus | data_center_automation | 2017.01 | |
| microfocus | data_center_automation | 2017.05 | |
| microfocus | data_center_automation | 2017.08 | |
| microfocus | data_center_automation | 2017.09 | |
| microfocus | data_center_automation | 2017.11 | |
| microfocus | data_center_automation | 2018.02 | |
| microfocus | data_center_automation | 2018.05 | |
| microfocus | hybrid_cloud_management | 2017.11 | |
| microfocus | hybrid_cloud_management | 2017.11 | |
| microfocus | hybrid_cloud_management | 2018.02 | |
| microfocus | hybrid_cloud_management | 2018.02 | |
| microfocus | hybrid_cloud_management | 2018.05 | |
| microfocus | hybrid_cloud_management | 2018.05 | |
| microfocus | network_operations_management | 2017.11 | |
| microfocus | network_operations_management | 2018.02 | |
| microfocus | network_operations_management | 2018.05 | |
| microfocus | operations_bridge | 2017.11 | |
| microfocus | operations_bridge | 2018.02 | |
| microfocus | operations_bridge | 2018.05 | |
| microfocus | service_management_automation | 2017.11 | |
| microfocus | service_management_automation | 2018.02 | |
| microfocus | service_management_automation | 2018.05 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microfocus:data_center_automation:2017.01:*:*:*:*:*:*:*",
"matchCriteriaId": "F8CBD371-84AA-45F2-B53C-FF2F94316FDF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:data_center_automation:2017.05:*:*:*:*:*:*:*",
"matchCriteriaId": "1FA57EDB-69A7-439A-886A-06E844A45CFB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:data_center_automation:2017.08:*:*:*:*:*:*:*",
"matchCriteriaId": "B7E861D6-7812-4190-A3C1-F338D544123E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:data_center_automation:2017.09:*:*:*:*:*:*:*",
"matchCriteriaId": "4CA11555-95A4-4086-9C67-CA4C92EA4D0A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:data_center_automation:2017.11:*:*:*:*:*:*:*",
"matchCriteriaId": "008EA036-C58F-4B01-AEAD-3E8E79304A68",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:data_center_automation:2018.02:*:*:*:*:*:*:*",
"matchCriteriaId": "34E310E2-2F0F-4942-A7CD-61616D366824",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:data_center_automation:2018.05:*:*:*:*:*:*:*",
"matchCriteriaId": "D1CA1EEE-301A-4DB1-ACE6-A8DC7FF101C7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:hybrid_cloud_management:2017.11:*:*:*:premium:*:*:*",
"matchCriteriaId": "EC84CBAE-0AB4-4405-8423-A221E3BABCA4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:hybrid_cloud_management:2017.11:*:*:*:ultimate:*:*:*",
"matchCriteriaId": "28F73BBD-DA6B-42A5-BDC9-F8832E475B03",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:hybrid_cloud_management:2018.02:*:*:*:premium:*:*:*",
"matchCriteriaId": "E52C4EA5-AE1E-476E-9AAF-FB8A6D34658A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:hybrid_cloud_management:2018.02:*:*:*:ultimate:*:*:*",
"matchCriteriaId": "69087F9D-D5F1-462C-8264-13DBCF50474C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:hybrid_cloud_management:2018.05:*:*:*:premium:*:*:*",
"matchCriteriaId": "5686CFAC-0091-4B98-9654-359AC77343EA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:hybrid_cloud_management:2018.05:*:*:*:ultimate:*:*:*",
"matchCriteriaId": "C7E8812B-28DC-4F66-B395-73AF00E57113",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:network_operations_management:2017.11:*:*:*:*:*:*:*",
"matchCriteriaId": "E21E1238-6D5F-4AA5-8FE4-B818D0DBF6C4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:network_operations_management:2018.02:*:*:*:*:*:*:*",
"matchCriteriaId": "EA8F1189-19DF-43EB-9B35-61720EE11357",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:network_operations_management:2018.05:*:*:*:premium:*:*:*",
"matchCriteriaId": "DF75B30C-1E8D-462E-A30A-9C17EF0B7CE7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:operations_bridge:2017.11:*:*:*:premium:*:*:*",
"matchCriteriaId": "34099595-3D44-4B10-AA42-5A6DC9B82F25",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:operations_bridge:2018.02:*:*:*:premium:*:*:*",
"matchCriteriaId": "2D4D7844-FA36-4C63-8AD6-C40F81134DBC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:operations_bridge:2018.05:*:*:*:premium:*:*:*",
"matchCriteriaId": "78756DED-D384-4F7F-99C3-6BC6293B1D28",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:service_management_automation:2017.11:*:*:*:*:*:*:*",
"matchCriteriaId": "5166B660-88F2-437B-96DA-F7E44E6AE9A3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:service_management_automation:2018.02:*:*:*:*:*:*:*",
"matchCriteriaId": "2DCFB2E7-D769-4365-9B99-952907563749",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:service_management_automation:2018.05:*:*:*:*:*:*:*",
"matchCriteriaId": "3909E337-F1FC-45C8-A120-EEBDBFB0E4D0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Remote Code Execution in the following products Hybrid Cloud Management Containerized Suite HCM2017.11, HCM2018.02, HCM2018.05, Operations Bridge Containerized Suite 2017.11, 2018.02, 2018.05, Data Center Automation Containerized Suite 2017.01 until 2018.05, Service Management Automation Suite 2017.11, 2018.02, 2018.05 and Network Operations Management (NOM) Suite CDF 2017.11, 2018.02, 2018.05 will allow Remote Code Execution."
},
{
"lang": "es",
"value": "Ejecuci\u00f3n remota de c\u00f3digo en los siguientes productos: Hybrid Cloud Management Containerized Suite HCM2017.11, HCM2018.02, HCM2018.05; Operations Bridge Containerized Suite 2017.11, 2018.02, 2018.05; Data Center Automation Containerized Suite 2017.01 hasta la versi\u00f3n 2018.05; Service Management Automation Suite 2017.11, 2018.02, 2018.05 y Network Operations Management (NOM) Suite CDF 2017.11, 2018.02 y 2018.05 permitir\u00e1 la ejecuci\u00f3n remota de c\u00f3digo."
}
],
"id": "CVE-2018-6498",
"lastModified": "2024-11-21T04:10:46.813",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:H",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 5.3,
"source": "security@opentext.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2018-08-30T21:29:00.267",
"references": [
{
"source": "security@opentext.com",
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236632"
},
{
"source": "security@opentext.com",
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236667"
},
{
"source": "security@opentext.com",
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236669"
},
{
"source": "security@opentext.com",
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236678"
},
{
"source": "security@opentext.com",
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236725"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236632"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236667"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236669"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236678"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03236725"
}
],
"sourceIdentifier": "security@opentext.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-94"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2019-02-11 19:29
Modified
2024-11-21 04:45
Severity ?
Summary
runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a command as root within one of these types of containers: (1) a new container with an attacker-controlled image, or (2) an existing container, to which the attacker previously had write access, that can be attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/self/exe.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:docker:docker:*:*:*:*:*:*:*:*",
"matchCriteriaId": "A367C4FA-18DF-402F-B120-254B35F73BD1",
"versionEndExcluding": "18.09.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:linuxfoundation:runc:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D522E8C1-E7F0-4A3D-AF68-6D962944A0E5",
"versionEndIncluding": "0.1.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:linuxfoundation:runc:1.0.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "949172CC-EBB5-47F6-B987-207C802EED0F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:linuxfoundation:runc:1.0.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "F6D87B50-2849-4F4D-A0F9-4F7EBA3C2647",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:linuxfoundation:runc:1.0.0:rc3:*:*:*:*:*:*",
"matchCriteriaId": "3E580E25-F94C-4DA4-8718-15D5F1C3ADAF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:linuxfoundation:runc:1.0.0:rc4:*:*:*:*:*:*",
"matchCriteriaId": "FD565CE0-D9E9-4FD9-8998-8AC55030FAB7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:linuxfoundation:runc:1.0.0:rc5:*:*:*:*:*:*",
"matchCriteriaId": "093326B1-448C-4E3B-886D-CAC8B6813BFF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:linuxfoundation:runc:1.0.0:rc6:*:*:*:*:*:*",
"matchCriteriaId": "F672C421-789D-4F21-B483-DA3EB251BA1D",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:redhat:container_development_kit:3.7:*:*:*:*:*:*:*",
"matchCriteriaId": "48FAFDE5-1E73-4874-8F2E-3C74B1955096",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:redhat:openshift:3.4:*:*:*:*:*:*:*",
"matchCriteriaId": "785C0A0D-5FF3-43D5-B89F-DCB2D6FDE310",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:redhat:openshift:3.5:*:*:*:*:*:*:*",
"matchCriteriaId": "E9955945-7509-4542-BF83-B7BA0B4D8D05",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:redhat:openshift:3.6:*:*:*:*:*:*:*",
"matchCriteriaId": "A52F7AE1-754D-4EE1-8EC1-7765292B4C2D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:redhat:openshift:3.7:*:*:*:*:*:*:*",
"matchCriteriaId": "55349BC5-90EC-4954-8CEB-3C37D34742C4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F4CFF558-3C47-480D-A2F0-BABF26042943",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "51EF4996-72F4-4FA4-814F-F5991E7A8318",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:google:kubernetes_engine:-:*:*:*:*:*:*:*",
"matchCriteriaId": "3C2EB454-D0C9-47FC-B727-1D61A8811967",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:linuxcontainers:lxc:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1AF77BB2-6F7A-408A-9F54-60F1F53B3709",
"versionEndExcluding": "3.2.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:hp:onesphere:-:*:*:*:*:*:*:*",
"matchCriteriaId": "41FF9E5A-7BD1-477E-9875-8525FD87B13F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A3C19813-E823-456A-B1CE-EC0684CE1953",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A6E9EF0C-AFA8-4F7B-9FDC-1E0F7C26E737",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:apache:mesos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "CA0695E0-954A-4533-9D93-58257E9EA6D5",
"versionEndExcluding": "1.4.3",
"versionStartIncluding": "1.4.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:apache:mesos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "B51B8DF0-FCE4-42A7-A582-0476226C6188",
"versionEndExcluding": "1.5.3",
"versionStartIncluding": "1.5.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:apache:mesos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "01878119-E05A-469B-B49D-5D19082CED28",
"versionEndExcluding": "1.6.2",
"versionStartIncluding": "1.6.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:apache:mesos:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1AB1BB7C-46A1-4676-9D15-D75EC1E4594C",
"versionEndExcluding": "1.7.2",
"versionStartIncluding": "1.7.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:opensuse:backports_sle:15.0:-:*:*:*:*:*:*",
"matchCriteriaId": "D83DA865-E4A6-4FBF-AA1B-A969EBA6B2AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:opensuse:backports_sle:15.0:sp1:*:*:*:*:*:*",
"matchCriteriaId": "40513095-7E6E-46B3-B604-C926F1BA3568",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*",
"matchCriteriaId": "F1E78106-58E6-4D59-990F-75DA575BFAD9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*",
"matchCriteriaId": "B620311B-34A3-48A6-82DF-6F078D7A4493",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:opensuse:leap:42.3:*:*:*:*:*:*:*",
"matchCriteriaId": "5F65DAB0-3DAD-49FF-BC73-3581CC3D5BF3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:d2iq:kubernetes_engine:*:*:*:*:*:*:*:*",
"matchCriteriaId": "632B24FA-F2D6-42B0-87C7-7F142E15EFC7",
"versionEndExcluding": "2.2.0-1.13.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:d2iq:dc\\/os:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0AD20FA7-737F-47C0-B2AC-735438253AA9",
"versionEndExcluding": "1.10.10",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:d2iq:dc\\/os:*:*:*:*:*:*:*:*",
"matchCriteriaId": "5E5AE03E-3AC4-4439-9D0D-45E097B2552C",
"versionEndExcluding": "1.11.9",
"versionStartIncluding": "1.10.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:d2iq:dc\\/os:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E2F3078E-08E0-4C76-A7A3-A93B953BEDD5",
"versionEndExcluding": "1.12.1",
"versionStartIncluding": "1.11.10",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*",
"matchCriteriaId": "D100F7CE-FC64-4CC6-852A-6136D72DA419",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*",
"matchCriteriaId": "97A4B8DF-58DA-4AB6-A1F9-331B36409BA3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*",
"matchCriteriaId": "F7016A2A-8365-4F1A-89A2-7A19F2BCAE5B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*",
"matchCriteriaId": "23A7C53F-B80F-4E6A-AFA9-58EEA84BE11D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*",
"matchCriteriaId": "07C312A0-CD2C-4B9C-B064-6409B25C278F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*",
"matchCriteriaId": "CD783B0C-9246-47D9-A937-6144FE8BFF0F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microfocus:service_management_automation:2018.02:*:*:*:*:*:*:*",
"matchCriteriaId": "2DCFB2E7-D769-4365-9B99-952907563749",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:service_management_automation:2018.05:*:*:*:*:*:*:*",
"matchCriteriaId": "3909E337-F1FC-45C8-A120-EEBDBFB0E4D0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:service_management_automation:2018.08:*:*:*:*:*:*:*",
"matchCriteriaId": "934D6CB3-E159-40F4-8E5B-CDDDD824CAA0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microfocus:service_management_automation:2018.11:*:*:*:*:*:*:*",
"matchCriteriaId": "82C0FD9D-6117-40DE-9386-7327867F9615",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a command as root within one of these types of containers: (1) a new container with an attacker-controlled image, or (2) an existing container, to which the attacker previously had write access, that can be attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/self/exe."
},
{
"lang": "es",
"value": "runc, hasta la versi\u00f3n 1.0-rc6, tal y como se emplea en Docker, en versiones anteriores a la 18.09.2 y otros productos, permite que los atacantes sobrescriban el binario del host runc (y, as\u00ed, obtengan acceso root al host) aprovechando la capacidad para ejecutar un comando como root con uno de estos tipos de contenedores: (1) un nuevo contenedor con una imagen controlada por el atacante o (2) un contenedor existente, para el cual el atacante contaba previamente con acceso de escritura, que puede adjuntarse con docker exec. Esto ocurre debido a la gesti\u00f3n incorrecta del descriptor de archivos; esto est\u00e1 relacionado con /proc/self/exe."
}
],
"id": "CVE-2019-5736",
"lastModified": "2024-11-21T04:45:24.603",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 9.3,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 6.0,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2019-02-11T19:29:00.297",
"references": [
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00044.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00074.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00091.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00060.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00073.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00011.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00015.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00084.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00007.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00029.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/163339/Docker-Container-Escape.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/165197/Docker-runc-Command-Execution-Proof-Of-Concept.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2019/03/23/1"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2019/06/28/2"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2019/07/06/3"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2019/07/06/4"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2019/10/24/1"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2019/10/29/3"
},
{
"source": "cve@mitre.org",
"url": "http://www.openwall.com/lists/oss-security/2024/01/31/6"
},
{
"source": "cve@mitre.org",
"url": "http://www.openwall.com/lists/oss-security/2024/02/01/1"
},
{
"source": "cve@mitre.org",
"url": "http://www.openwall.com/lists/oss-security/2024/02/02/3"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/106976"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/errata/RHSA-2019:0303"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/errata/RHSA-2019:0304"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/errata/RHSA-2019:0401"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/errata/RHSA-2019:0408"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/errata/RHSA-2019:0975"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/security/cve/cve-2019-5736"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/security/vulnerabilities/runcescape"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://aws.amazon.com/security/security-bulletins/AWS-2019-002/"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Third Party Advisory",
"Vendor Advisory"
],
"url": "https://azure.microsoft.com/en-us/updates/cve-2019-5736-and-runc-vulnerability/"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Third Party Advisory",
"Vendor Advisory"
],
"url": "https://azure.microsoft.com/en-us/updates/iot-edge-fix-cve-2019-5736/"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Mitigation",
"Third Party Advisory"
],
"url": "https://blog.dragonsector.pl/2019/02/cve-2019-5736-escape-from-docker-and.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Technical Description",
"Third Party Advisory"
],
"url": "https://brauner.github.io/2019/02/12/privileged-containers.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Issue Tracking",
"Patch",
"Third Party Advisory"
],
"url": "https://bugzilla.suse.com/show_bug.cgi?id=1121967"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://cloud.google.com/kubernetes-engine/docs/security-bulletins#february-11-2019-runc"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/Frichetten/CVE-2019-5736-PoC"
},
{
"source": "cve@mitre.org",
"tags": [
"Release Notes",
"Third Party Advisory"
],
"url": "https://github.com/docker/docker-ce/releases/tag/v18.09.2"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/opencontainers/runc/commit/0a8e4117e7f715d5fbeef398405813ce8e88558b"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/opencontainers/runc/commit/6635b4f0c6af3810594d2770f662f34ddc15b40d"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/q3k/cve-2019-5736-poc"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://github.com/rancher/runc-cve"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://kubernetes.io/blog/2019/02/11/runc-and-cve-2019-5736/"
},
{
"source": "cve@mitre.org",
"url": "https://lists.apache.org/thread.html/24e54e3c6b2259e3903b6b8fe26896ac649c481ea99c5739468c92a3%40%3Cdev.dlab.apache.org%3E"
},
{
"source": "cve@mitre.org",
"url": "https://lists.apache.org/thread.html/a258757af84c5074dc7bf932622020fd4f60cef65a84290380386706%40%3Cuser.mesos.apache.org%3E"
},
{
"source": "cve@mitre.org",
"url": "https://lists.apache.org/thread.html/a585f64d14c31ab393b90c5f17e41d9765a1a17eec63856ce750af46%40%3Cdev.dlab.apache.org%3E"
},
{
"source": "cve@mitre.org",
"url": "https://lists.apache.org/thread.html/acacf018c12636e41667e94ac0a1e9244e887eef2debdd474640aa6e%40%3Cdev.dlab.apache.org%3E"
},
{
"source": "cve@mitre.org",
"url": "https://lists.apache.org/thread.html/b162dd624dc088cd634292f0402282a1d1d0ce853baeae8205bc033c%40%3Cdev.mesos.apache.org%3E"
},
{
"source": "cve@mitre.org",
"url": "https://lists.apache.org/thread.html/rc494623986d76593873ce5a40dd69cb3629400d10750d5d7e96b8587%40%3Cdev.dlab.apache.org%3E"
},
{
"source": "cve@mitre.org",
"url": "https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E"
},
{
"source": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DLC52IOJN6IQJWJ6CUI6AIUP6GVVG2QP/"
},
{
"source": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EGZKRCKI3Y7FMADO2MENMT4TU24QGHFR/"
},
{
"source": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SWFJGIPYAAAMVSWWI3QWYXGA3ZBU2H4W/"
},
{
"source": "cve@mitre.org",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V6A4OSFM5GGOWW4ECELV5OHX2XRAUSPH/"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://security.gentoo.org/glsa/202003-21"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://security.netapp.com/advisory/ntap-20190307-0008/"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03410944"
},
{
"source": "cve@mitre.org",
"tags": [
"Permissions Required"
],
"url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbhf03913en_us"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch",
"Third Party Advisory"
],
"url": "https://support.mesosphere.com/s/article/Known-Issue-Container-Runtime-Vulnerability-MSPH-2019-0003"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190215-runc"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://usn.ubuntu.com/4048-1/"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "https://www.exploit-db.com/exploits/46359/"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "https://www.exploit-db.com/exploits/46369/"
},
{
"source": "cve@mitre.org",
"tags": [
"Mailing List",
"Patch",
"Third Party Advisory"
],
"url": "https://www.openwall.com/lists/oss-security/2019/02/11/2"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://www.synology.com/security/advisory/Synology_SA_19_06"
},
{
"source": "cve@mitre.org",
"tags": [
"Third Party Advisory"
],
"url": "https://www.twistlock.com/2019/02/11/how-to-mitigate-cve-2019-5736-in-runc-and-docker/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00044.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00074.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00091.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00060.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00073.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00011.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00015.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00084.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00007.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00029.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/163339/Docker-Container-Escape.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://packetstormsecurity.com/files/165197/Docker-runc-Command-Execution-Proof-Of-Concept.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2019/03/23/1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2019/06/28/2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2019/07/06/3"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2019/07/06/4"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2019/10/24/1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2019/10/29/3"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2024/01/31/6"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2024/02/01/1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2024/02/02/3"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"VDB Entry"
],
"url": "http://www.securityfocus.com/bid/106976"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/errata/RHSA-2019:0303"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/errata/RHSA-2019:0304"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/errata/RHSA-2019:0401"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/errata/RHSA-2019:0408"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/errata/RHSA-2019:0975"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/security/cve/cve-2019-5736"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://access.redhat.com/security/vulnerabilities/runcescape"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://aws.amazon.com/security/security-bulletins/AWS-2019-002/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Third Party Advisory",
"Vendor Advisory"
],
"url": "https://azure.microsoft.com/en-us/updates/cve-2019-5736-and-runc-vulnerability/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Third Party Advisory",
"Vendor Advisory"
],
"url": "https://azure.microsoft.com/en-us/updates/iot-edge-fix-cve-2019-5736/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Mitigation",
"Third Party Advisory"
],
"url": "https://blog.dragonsector.pl/2019/02/cve-2019-5736-escape-from-docker-and.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Technical Description",
"Third Party Advisory"
],
"url": "https://brauner.github.io/2019/02/12/privileged-containers.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Issue Tracking",
"Patch",
"Third Party Advisory"
],
"url": "https://bugzilla.suse.com/show_bug.cgi?id=1121967"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://cloud.google.com/kubernetes-engine/docs/security-bulletins#february-11-2019-runc"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/Frichetten/CVE-2019-5736-PoC"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Third Party Advisory"
],
"url": "https://github.com/docker/docker-ce/releases/tag/v18.09.2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/opencontainers/runc/commit/0a8e4117e7f715d5fbeef398405813ce8e88558b"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Third Party Advisory"
],
"url": "https://github.com/opencontainers/runc/commit/6635b4f0c6af3810594d2770f662f34ddc15b40d"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory"
],
"url": "https://github.com/q3k/cve-2019-5736-poc"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://github.com/rancher/runc-cve"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://kubernetes.io/blog/2019/02/11/runc-and-cve-2019-5736/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/24e54e3c6b2259e3903b6b8fe26896ac649c481ea99c5739468c92a3%40%3Cdev.dlab.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/a258757af84c5074dc7bf932622020fd4f60cef65a84290380386706%40%3Cuser.mesos.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/a585f64d14c31ab393b90c5f17e41d9765a1a17eec63856ce750af46%40%3Cdev.dlab.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/acacf018c12636e41667e94ac0a1e9244e887eef2debdd474640aa6e%40%3Cdev.dlab.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/b162dd624dc088cd634292f0402282a1d1d0ce853baeae8205bc033c%40%3Cdev.mesos.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/rc494623986d76593873ce5a40dd69cb3629400d10750d5d7e96b8587%40%3Cdev.dlab.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DLC52IOJN6IQJWJ6CUI6AIUP6GVVG2QP/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EGZKRCKI3Y7FMADO2MENMT4TU24QGHFR/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SWFJGIPYAAAMVSWWI3QWYXGA3ZBU2H4W/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V6A4OSFM5GGOWW4ECELV5OHX2XRAUSPH/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://security.gentoo.org/glsa/202003-21"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://security.netapp.com/advisory/ntap-20190307-0008/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03410944"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Permissions Required"
],
"url": "https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US\u0026docId=emr_na-hpesbhf03913en_us"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch",
"Third Party Advisory"
],
"url": "https://support.mesosphere.com/s/article/Known-Issue-Container-Runtime-Vulnerability-MSPH-2019-0003"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190215-runc"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://usn.ubuntu.com/4048-1/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "https://www.exploit-db.com/exploits/46359/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Third Party Advisory",
"VDB Entry"
],
"url": "https://www.exploit-db.com/exploits/46369/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Mailing List",
"Patch",
"Third Party Advisory"
],
"url": "https://www.openwall.com/lists/oss-security/2019/02/11/2"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://www.synology.com/security/advisory/Synology_SA_19_06"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "https://www.twistlock.com/2019/02/11/how-to-mitigate-cve-2019-5736-in-runc-and-docker/"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-78"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}