Improper Preservation of Permissions Affecting github.com/opencontainers/runc/libcontainer package, versions <1.1.5


Severity

Recommended
0.0
high
0
10

CVSS assessment made by Snyk's Security Team. Learn more

Threat Intelligence

EPSS
0.04% (15th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-GOLANG-GITHUBCOMOPENCONTAINERSRUNCLIBCONTAINER-5296696
  • published30 Mar 2023
  • disclosed30 Mar 2023
  • creditssst0n3

Introduced: 30 Mar 2023

CVE-2023-28642  (opens in a new tab)
CWE-281  (opens in a new tab)

How to fix?

Upgrade github.com/opencontainers/runc/libcontainer to version 1.1.5 or higher.

Overview

github.com/opencontainers/runc/libcontainer is a package for a modern container runtime.

Affected versions of this package are vulnerable to Improper Preservation of Permissions when AppArmor can be bypassed when /proc inside the container is symlinked with a specific mount configuration.

CVSS Scores

version 3.1