GHSA-c5pj-mqfh-rvc3

Source

https://github.com/advisories/GHSA-c5pj-mqfh-rvc3

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/04/GHSA-c5pj-mqfh-rvc3/GHSA-c5pj-mqfh-rvc3.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-c5pj-mqfh-rvc3

Related

Withdrawn

2024-04-30T09:37:23Z

Published

2024-04-26T06:30:34Z

Modified

2024-06-05T18:30:34Z

Severity

7.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVSS Calculator

Summary

Withdrawn: Runc allows an arbitrary systemd property to be injected

Details

Withdrawn Advisory

This advisory has been withdrawn because it was incorrectly attributed to runc. Please see the issue here for more information.

Original Description

A flaw was found in cri-o, where an arbitrary systemd property can be injected via a Pod annotation. Any user who can create a pod with an arbitrary annotation may perform an arbitrary action on the host system. This issue has its root in how runc handles Config Annotations lists.

Database specific

{
    "github_reviewed_at": "2024-04-26T22:44:51Z",
    "cwe_ids": [
        "CWE-77"
    ],
    "nvd_published_at": "2024-04-26T04:15:09Z",
    "github_reviewed": true,
    "severity": "HIGH"
}

References

Affected packages

Go / github.com/opencontainers/runc

Package

Name: github.com/opencontainers/runc; View open source insights on deps.dev
Purl: pkg:golang/github.com/opencontainers/runc

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.2.0-rc.1