OESA-2025-1564

See a problem?
Please try reporting it to the source first.
Source
https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1564
Import Source
https://repo.openeuler.org/security/data/osv/OESA-2025-1564.json
JSON Data
https://api.test.osv.dev/v1/vulns/OESA-2025-1564
Upstream
Published
2025-05-30T13:48:06Z
Modified
2025-08-12T05:49:25.663001Z
Summary
crun security update
Details

crun is a fast and low-memory footprint OCI Container Runtime fully written in C.

Security Fix(es):

crun is an open source OCI Container Runtime fully written in C. In affected versions A malicious container image could trick the krun handler into escaping the root filesystem, allowing file creation or modification on the host. No special permissions are needed, only the ability for the current user to write to the target file. The problem is fixed in crun 1.20 and all users are advised to upgrade. There are no known workarounds for this vulnerability.(CVE-2025-24965)

Database specific 
{
    "severity": "High"
}
References

Affected packages

openEuler:24.03-LTS-SP1 / crun

Package

Name
crun
Purl
pkg:rpm/openEuler/crun&distro=openEuler-24.03-LTS-SP1

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.8.7-3.oe2403sp1

Ecosystem specific 

{
    "aarch64": [
        "crun-1.8.7-3.oe2403sp1.aarch64.rpm",
        "crun-debuginfo-1.8.7-3.oe2403sp1.aarch64.rpm",
        "crun-debugsource-1.8.7-3.oe2403sp1.aarch64.rpm",
        "crun-help-1.8.7-3.oe2403sp1.aarch64.rpm"
    ],
    "x86_64": [
        "crun-1.8.7-3.oe2403sp1.x86_64.rpm",
        "crun-debuginfo-1.8.7-3.oe2403sp1.x86_64.rpm",
        "crun-debugsource-1.8.7-3.oe2403sp1.x86_64.rpm",
        "crun-help-1.8.7-3.oe2403sp1.x86_64.rpm"
    ],
    "src": [
        "crun-1.8.7-3.oe2403sp1.src.rpm"
    ]
}