{"id":"CVE-2019-16884","aliases":["ALPINE-CVE-2019-16884","ALSA-2019:4269","BELL-CVE-2019-16884","DEBIAN-CVE-2019-16884","DLA-3322-1","DLA-3369-1","EUVD-2022-0981","GHSA-fgv8-vj5c-2ppq","GO-2021-0085","MGASA-2020-0050","RHBA-2020:1232","RHSA-2019:3940","RHSA-2019:4074","RHSA-2019:4269","RHSA-2020:1234","RLSA-2019:4269","SUSE-SU-2019:2786-1","SUSE-SU-2019:2787-1","SUSE-SU-2019:2810-1","SUSE-SU-2020:0035-1","SUSE-SU-2020:0065-1","SUSE-SU-2021:1458-1","UBUNTU-CVE-2019-16884","USN-4297-1","USN-4867-1","openSUSE-SU-2019:2418-1","openSUSE-SU-2019:2434-1","openSUSE-SU-2020:0045-1","openSUSE-SU-2024:11358-1"],"status":"published","title":"Incorrect Authorization in runc","description":"runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /proc directory.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.04409,"percentile":0.91454,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-863"],"published":"2019-09-25T00:00:00Z","modified":"2026-11-03T06:31:53Z","fixes":[{"ecosystem":"Go","package":"github.com/opencontainers/runc","fixed_in":["1.0.0-rc8.0.20190930145003-cad42f6e0932"],"sources":["ghsa","osv"]},{"ecosystem":"Go","package":"github.com/opencontainers/selinux","fixed_in":["1.3.1-0.20190929122143-5215b1806f52"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.11","package":"containerd","fixed_in":["1.3.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"containerd","fixed_in":["1.3.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"containerd","fixed_in":["1.3.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"containerd","fixed_in":["1.3.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"containerd","fixed_in":["1.3.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"containerd","fixed_in":["1.3.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"containerd","fixed_in":["1.3.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"containerd","fixed_in":["1.3.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"containerd","fixed_in":["1.3.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"containerd","fixed_in":["1.3.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"containerd","fixed_in":["1.3.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"containerd","fixed_in":["1.3.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"containerd","fixed_in":["1.3.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"containerd","fixed_in":["1.3.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"runc","fixed_in":["1.0.0_rc9"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"runc","fixed_in":["1.0.0_rc9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"runc","fixed_in":["1.0.0_rc9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"runc","fixed_in":["1.0.0_rc9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"runc","fixed_in":["1.0.0_rc9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"runc","fixed_in":["1.0.0_rc9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"runc","fixed_in":["1.0.0_rc9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"runc","fixed_in":["1.0.0_rc9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"runc","fixed_in":["1.0.0_rc9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"runc","fixed_in":["1.0.0_rc9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"runc","fixed_in":["1.0.0_rc9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"runc","fixed_in":["1.0.0_rc9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"runc","fixed_in":["1.0.0_rc9-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"runc","fixed_in":["1.0.0_rc9-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"golang-github-opencontainers-selinux","fixed_in":["1.3.0-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"golang-github-opencontainers-selinux","fixed_in":["1.3.0-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"golang-github-opencontainers-selinux","fixed_in":["1.3.0-2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"runc","fixed_in":["1.0.0~rc9+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"runc","fixed_in":["1.0.0~rc9+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"runc","fixed_in":["1.0.0~rc9+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"golang-github-opencontainers-selinux","fixed_in":["1.0.0~rc1+git20170621.5.4a2974b-1+deb10u1"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"opencontainers-runc","fixed_in":["1.0.0-0.rc9.3.mga7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_extras_other:7","package":"runc","fixed_in":["0:1.0.0-67.rc10.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_extras_other:7","package":"runc-debuginfo","fixed_in":["0:1.0.0-67.rc10.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.1::el8","package":"runc","fixed_in":["0:1.0.0-62.rc8.rhaos4.1.git3cbe540.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.1::el8","package":"runc-debuginfo","fixed_in":["0:1.0.0-62.rc8.rhaos4.1.git3cbe540.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.1::el8","package":"runc-debugsource","fixed_in":["0:1.0.0-62.rc8.rhaos4.1.git3cbe540.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.2::el8","package":"runc","fixed_in":["0:1.0.0-63.rc8.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.2::el8","package":"runc-debuginfo","fixed_in":["0:1.0.0-63.rc8.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.2::el8","package":"runc-debugsource","fixed_in":["0:1.0.0-63.rc8.el8"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Containers 15","package":"docker-runc","fixed_in":["1.0.0rc8+gitr3826_425e105d5a03-6.24.1","1.0.0rc8+gitr3917_3e425f80a8c9-6.27.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP1","package":"docker-runc","fixed_in":["1.0.0rc8+gitr3826_425e105d5a03-6.24.1","1.0.0rc8+gitr3917_3e425f80a8c9-6.27.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Containers 12","package":"docker-runc","fixed_in":["1.0.0rc8+gitr3826_425e105d5a03-1.32.1","1.0.0rc8+gitr3917_3e425f80a8c9-1.35.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP1","package":"runc","fixed_in":["1.0.0~rc8-1.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Containers 15","package":"containerd","fixed_in":["1.2.10-5.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Containers 15","package":"docker","fixed_in":["19.03.5_ce-6.31.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Containers 15","package":"golang-github-docker-libnetwork","fixed_in":["0.7.0.1+gitr2877_3eb39382bfa6-4.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP1","package":"containerd","fixed_in":["1.2.10-5.19.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP1","package":"docker","fixed_in":["19.03.5_ce-6.31.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP1","package":"golang-github-docker-libnetwork","fixed_in":["0.7.0.1+gitr2877_3eb39382bfa6-4.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Containers 12","package":"containerd","fixed_in":["1.2.10-16.26.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Containers 12","package":"docker","fixed_in":["19.03.5_ce-98.51.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Containers 12","package":"golang-github-docker-libnetwork","fixed_in":["0.7.0.1+gitr2877_3eb39382bfa6-28.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"runc","fixed_in":["1.0.0~rc7+git20190403.029124da-0ubuntu1~16.04.4+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"runc","fixed_in":["1.0.0~rc10-0ubuntu1~18.04.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"runc","fixed_in":["1.0.0~rc8+git20190923.3e425f80-0ubuntu1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.0","package":"docker-runc","fixed_in":["1.0.0rc8+gitr3826_425e105d5a03-lp150.5.28.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.1","package":"docker-runc","fixed_in":["1.0.0rc8+gitr3826_425e105d5a03-lp151.3.9.1","1.0.0rc8+gitr3917_3e425f80a8c9-lp151.3.12.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.1","package":"containerd","fixed_in":["1.2.10-lp151.2.9.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.1","package":"docker","fixed_in":["19.03.5_ce-lp151.2.15.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.1","package":"golang-github-docker-libnetwork","fixed_in":["0.7.0.1+gitr2877_3eb39382bfa6-lp151.2.9.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/opencontainers/runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-rc8.0.20190930145003-cad42f6e0932"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/opencontainers/selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.1-0.20190929122143-5215b1806f52"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.0.1"},{"fixed":"1.0.0_rc9"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.0.1"},{"fixed":"1.0.0_rc9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.0.1"},{"fixed":"1.0.0_rc9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.0.1"},{"fixed":"1.0.0_rc9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.0.1"},{"fixed":"1.0.0_rc9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.0.1"},{"fixed":"1.0.0_rc9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.0.1"},{"fixed":"1.0.0_rc9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.0.1"},{"fixed":"1.0.0_rc9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.0.1"},{"fixed":"1.0.0_rc9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.0.1"},{"fixed":"1.0.0_rc9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.0.1"},{"fixed":"1.0.0_rc9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.0.1"},{"fixed":"1.0.0_rc9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.0.1"},{"fixed":"1.0.0_rc9-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.0.1"},{"fixed":"1.0.0_rc9-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"oci-systemd-hook","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.1.15-2.git2d0b8a3.module_el8.5.0+119+9a9ec082"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"oci-systemd-hook","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.1.15-2.git2d0b8a3.module_el8.4.0+2496+12421f43"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"oci-systemd-hook","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.1.15-2.git2d0b8a3.module_el8.3.0+2044+12421f43"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"oci-umount","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.3.4-2.git87f9237.module_el8.5.0+119+9a9ec082"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"oci-umount","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.3.4-2.git87f9237.module_el8.4.0+2496+12421f43"}]}],"bundled":4},{"source":"osv","ecosystem":"AlmaLinux:8","package":"oci-umount","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.3.4-2.git87f9237.module_el8.3.0+2044+12421f43"}]}],"bundled":4},{"source":"osv","ecosystem":"Debian:12","package":"golang-github-opencontainers-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"golang-github-opencontainers-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"golang-github-opencontainers-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.0-2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0~rc9+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0~rc9+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0~rc9+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"golang-github-opencontainers-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0~rc1+git20170621.5.4a2974b-1+deb10u1"}]}],"versions":["1.0.0~rc1+git20170621.5.4a2974b-1"]},{"source":"osv","ecosystem":"Debian:10","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0~rc6+dfsg1-3+deb10u2"}]}],"versions":["1.0.0~rc6+dfsg1-3","1.0.0~rc6+dfsg1-3+deb10u1"],"bundled":6},{"source":"osv","ecosystem":"Go","package":"github.com/opencontainers/runc","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.0.0-rc8.0.20190930145003-cad42f6e0932"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/opencontainers/selinux","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.3.1-0.20190929122143-5215b1806f52"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/opencontainers/runc","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.0.0-rc8.0.20190930145003-cad42f6e0932"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/opencontainers/selinux","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.3.1-0.20190929122143-5215b1806f52"}]}]},{"source":"osv","ecosystem":"Mageia:7","package":"opencontainers-runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-0.rc9.3.mga7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_extras_other:7","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-67.rc10.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_extras_other:7","package":"runc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-67.rc10.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.1::el8","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-62.rc8.rhaos4.1.git3cbe540.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.1::el8","package":"runc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-62.rc8.rhaos4.1.git3cbe540.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.1::el8","package":"runc-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-62.rc8.rhaos4.1.git3cbe540.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.2::el8","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-63.rc8.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.2::el8","package":"runc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-63.rc8.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.2::el8","package":"runc-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-63.rc8.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.0-5.module+el8.1.0+4240+893c1ab8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"buildah-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.0-5.module+el8.1.0+4240+893c1ab8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"buildah-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.0-5.module+el8.1.0+4240+893c1ab8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"buildah-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.0-5.module+el8.1.0+4240+893c1ab8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"buildah-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.9.0-5.module+el8.1.0+4240+893c1ab8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cockpit-podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4-1.module+el8.1.0+4081+b29780af"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"container-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.123.0-2.module+el8.1.0+4900+9d7326b8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"containernetworking-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8.1-3.module+el8.1.0+4881+045289ee"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"containernetworking-plugins-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8.1-3.module+el8.1.0+4881+045289ee"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"containernetworking-plugins-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8.1-3.module+el8.1.0+4881+045289ee"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"containers-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.1.37-6.module+el8.1.0+4876+e678a192"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"fuse-overlayfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.1-1.module+el8.1.0+4081+b29780af"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"fuse-overlayfs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.1-1.module+el8.1.0+4081+b29780af"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"fuse-overlayfs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.1-1.module+el8.1.0+4081+b29780af"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"oci-systemd-hook","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.1.15-2.git2d0b8a3.module+el8.1.0+4081+b29780af"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"oci-systemd-hook-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.1.15-2.git2d0b8a3.module+el8.1.0+4081+b29780af"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"oci-systemd-hook-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.1.15-2.git2d0b8a3.module+el8.1.0+4081+b29780af"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"oci-umount","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.3.4-2.git87f9237.module+el8.1.0+4081+b29780af"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"oci-umount-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.3.4-2.git87f9237.module+el8.1.0+4081+b29780af"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"oci-umount-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.3.4-2.git87f9237.module+el8.1.0+4081+b29780af"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.2-6.module+el8.1.0+4830+f49150d7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"podman-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.2-6.module+el8.1.0+4830+f49150d7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"podman-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.2-6.module+el8.1.0+4830+f49150d7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"podman-docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.2-6.module+el8.1.0+4830+f49150d7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"podman-manpages","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.2-6.module+el8.1.0+4830+f49150d7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"podman-remote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.2-6.module+el8.1.0+4830+f49150d7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"podman-remote-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.2-6.module+el8.1.0+4830+f49150d7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"podman-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.4.2-6.module+el8.1.0+4830+f49150d7"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python-podman-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.0-0.1.gitd0a45fe.module+el8.1.0+4081+b29780af"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-61.rc8.module+el8.1.0+4873+4a24e241"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"runc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-61.rc8.module+el8.1.0+4873+4a24e241"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"runc-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-61.rc8.module+el8.1.0+4873+4a24e241"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.1.37-6.module+el8.1.0+4876+e678a192"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"skopeo-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.1.37-6.module+el8.1.0+4876+e678a192"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"skopeo-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.1.37-6.module+el8.1.0+4876+e678a192"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"skopeo-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.1.37-6.module+el8.1.0+4876+e678a192"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"slirp4netns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.3.0-4.module+el8.1.0+4306+1d917805"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"slirp4netns-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.3.0-4.module+el8.1.0+4306+1d917805"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"slirp4netns-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.3.0-4.module+el8.1.0+4306+1d917805"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"toolbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.0.4-1.module+el8.1.0+4081+b29780af"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:rhel_extras_other:7","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.13.1-161.git64e9980.el7_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_extras_other:7","package":"docker-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.13.1-161.git64e9980.el7_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_extras_other:7","package":"docker-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.13.1-161.git64e9980.el7_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_extras_other:7","package":"docker-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.13.1-161.git64e9980.el7_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_extras_other:7","package":"docker-logrotate","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.13.1-161.git64e9980.el7_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_extras_other:7","package":"docker-lvm-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.13.1-161.git64e9980.el7_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_extras_other:7","package":"docker-novolume-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.13.1-161.git64e9980.el7_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_extras_other:7","package":"docker-rhel-push-plugin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.13.1-161.git64e9980.el7_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:rhel_extras_other:7","package":"docker-v1.10-migrator","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.13.1-161.git64e9980.el7_8"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"oci-systemd-hook","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.1.15-2.git2d0b8a3.module+el8.4.0+557+48ba8b2f"}]}],"bundled":4},{"source":"osv","ecosystem":"Rocky Linux:8","package":"oci-umount","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.3.4-2.git87f9237.module+el8.4.0+557+48ba8b2f"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15","package":"docker-runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0rc8+gitr3826_425e105d5a03-6.24.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP1","package":"docker-runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0rc8+gitr3826_425e105d5a03-6.24.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 12","package":"docker-runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0rc8+gitr3826_425e105d5a03-1.32.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP1","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0~rc8-1.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.10-5.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.03.5_ce-6.31.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15","package":"docker-runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0rc8+gitr3917_3e425f80a8c9-6.27.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15","package":"golang-github-docker-libnetwork","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0.1+gitr2877_3eb39382bfa6-4.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP1","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.10-5.19.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP1","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.03.5_ce-6.31.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP1","package":"docker-runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0rc8+gitr3917_3e425f80a8c9-6.27.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP1","package":"golang-github-docker-libnetwork","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0.1+gitr2877_3eb39382bfa6-4.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 12","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.10-16.26.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 12","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.03.5_ce-98.51.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 12","package":"docker-runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0rc8+gitr3917_3e425f80a8c9-1.35.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 12","package":"golang-github-docker-libnetwork","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0.1+gitr2877_3eb39382bfa6-28.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 12","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4-16.38.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 12","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.6_ce-98.66.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 12","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0~rc93-16.8.1"}]}],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0~rc7+git20190403.029124da-0ubuntu1~16.04.4+esm2"}]}],"versions":["0.0.8+dfsg-2","0.1.1-0ubuntu5~16.04","1.0.0~rc1-0ubuntu1~16.04","1.0.0~rc1-0ubuntu2~16.04.1","1.0.0~rc1-0ubuntu2~16.04.1.1","1.0.0~rc2-0ubuntu2~16.04.1","1.0.0~rc2+docker1.12.6-0ubuntu1~16.04.1","1.0.0~rc2+docker1.13.1-0ubuntu1~16.04.1","1.0.0~rc2+docker1.13.1-0ubuntu1~16.04.2","1.0.0~rc7+git20190403.029124da-0ubuntu1~16.04.3","1.0.0~rc7+git20190403.029124da-0ubuntu1~16.04.4","1.0.0~rc7+git20190403.029124da-0ubuntu1~16.04.4+esm1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0~rc10-0ubuntu1~18.04.2"}]}],"versions":["1.0.0~rc2+docker1.13.1-0ubuntu1","1.0.0~rc4+dfsg1-2","1.0.0~rc4+dfsg1-6","1.0.0~rc4+dfsg1-6ubuntu0.18.04.1","1.0.0~rc7+git20190403.029124da-0ubuntu1~18.04.1","1.0.0~rc7+git20190403.029124da-0ubuntu1~18.04.2","1.0.0~rc10-0ubuntu1~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0~rc8+git20190923.3e425f80-0ubuntu1"}]}]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0~rc10-0ubuntu1~18.04.2"}]}],"versions":["1.0.0~rc2+docker1.13.1-0ubuntu1","1.0.0~rc4+dfsg1-2","1.0.0~rc4+dfsg1-6","1.0.0~rc4+dfsg1-6ubuntu0.18.04.1","1.0.0~rc7+git20190403.029124da-0ubuntu1~18.04.1","1.0.0~rc7+git20190403.029124da-0ubuntu1~18.04.2","1.0.0~rc10-0ubuntu1~18.04.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0~rc7+git20190403.029124da-0ubuntu1~16.04.4+esm2"}]}],"versions":["0.0.8+dfsg-2","0.1.1-0ubuntu5~16.04","1.0.0~rc1-0ubuntu1~16.04","1.0.0~rc1-0ubuntu2~16.04.1","1.0.0~rc1-0ubuntu2~16.04.1.1","1.0.0~rc2-0ubuntu2~16.04.1","1.0.0~rc2+docker1.12.6-0ubuntu1~16.04.1","1.0.0~rc2+docker1.13.1-0ubuntu1~16.04.1","1.0.0~rc2+docker1.13.1-0ubuntu1~16.04.2","1.0.0~rc7+git20190403.029124da-0ubuntu1~16.04.3","1.0.0~rc7+git20190403.029124da-0ubuntu1~16.04.4","1.0.0~rc7+git20190403.029124da-0ubuntu1~16.04.4+esm1"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.0","package":"docker-runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0rc8+gitr3826_425e105d5a03-lp150.5.28.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"docker-runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0rc8+gitr3826_425e105d5a03-lp151.3.9.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.10-lp151.2.9.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.03.5_ce-lp151.2.15.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"docker-runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0rc8+gitr3917_3e425f80a8c9-lp151.3.12.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"golang-github-docker-libnetwork","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.0.1+gitr2877_3eb39382bfa6-lp151.2.9.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2-1.2"}]}],"bundled":8}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"docker","product":"docker"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"linuxfoundation","product":"runc"},{"vendor":"opensuse","product":"leap"},{"vendor":"redhat","product":"enterprise_linux"},{"vendor":"redhat","product":"enterprise_linux_eus"},{"vendor":"redhat","product":"enterprise_linux_server_aus"},{"vendor":"redhat","product":"enterprise_linux_server_tus"},{"vendor":"redhat","product":"openshift_container_platform"}],"references":[{"url":"https://github.com/opencontainers/runc/issues/2128","tags":["x_transferred","Exploit","Issue Tracking","Third Party Advisory","report","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DGK6IV5JGVDXHOXEKJOJWKOVNZLT6MYR/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/62OQ2P7K5YDZ5BRCH2Q6DHUJIHQD3QCD/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SPK4JWP32BUIVDJ3YODZSOEVEW6BHQCF/","tags":["vendor-advisory","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00073.html","tags":["vendor-advisory","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-11/msg00009.html","tags":["vendor-advisory","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3940","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2019:4074","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2019:4269","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00010.html","tags":["vendor-advisory","x_transferred","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://security.gentoo.org/glsa/202003-21","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://usn.ubuntu.com/4297-1/","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20220221-0004/","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/02/msg00016.html","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/03/msg00023.html","tags":["mailing-list","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-16884","tags":["advisory"]},{"url":"https://github.com/opencontainers/runc/pull/2129","tags":["web"]},{"url":"https://github.com/crosbymichael/runc/commit/78dce1cf1ec36bbe7fe6767bdb81f7cbf6d34d70","tags":["web"]},{"url":"https://github.com/opencontainers/runc/pull/2130","tags":["web","fix"]},{"url":"https://github.com/opencontainers/runc/commit/cad42f6e0932db0ce08c3a3d9e89e6063ec283e4","tags":["web","fix"]},{"url":"https://github.com/opencontainers/selinux/commit/03b517dc4fd57245b1cf506e8ba7b817b6d309da","tags":["web","fix"]},{"url":"https://pkg.go.dev/vuln/GO-2021-0085","tags":["web"]},{"url":"https://usn.ubuntu.com/4297-1","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20220221-0004","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPK4JWP32BUIVDJ3YODZSOEVEW6BHQCF","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DGK6IV5JGVDXHOXEKJOJWKOVNZLT6MYR","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/62OQ2P7K5YDZ5BRCH2Q6DHUJIHQD3QCD","tags":["web"]},{"url":"https://github.com/advisories/GHSA-fgv8-vj5c-2ppq"},{"url":"https://security.alpinelinux.org/vuln/CVE-2019-16884","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/1735645","tags":["report"]},{"url":"https://bugzilla.redhat.com/1735744","tags":["report"]},{"url":"https://bugzilla.redhat.com/1744588","tags":["report"]},{"url":"https://bugzilla.redhat.com/1757214","tags":["report"]},{"url":"https://bugzilla.redhat.com/1764318","tags":["report"]},{"url":"https://bugzilla.redhat.com/1770176","tags":["report"]},{"url":"https://bugzilla.redhat.com/1774382","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2019-4269.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2019-16884","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2019-18466","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2019-9512","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2019-9514","tags":["report"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2019-16884","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-16884","tags":["advisory"]},{"url":"https://github.com/opencontainers/runc","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2020-0050.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=25806","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/DGK6IV5JGVDXHOXEKJOJWKOVNZLT6MYR/","tags":["web"]},{"url":"https://access.redhat.com/errata/RHBA-2020:1232","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1791287","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhba-2020_1232.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-16884","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1757214","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-16884","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_3940.json","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_4074.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1735645","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1735744","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1764318","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1770176","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1774382","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_4269.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-9512","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-9512","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-9512","tags":["advisory"]},{"url":"https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md","tags":["article"]},{"url":"https://groups.google.com/forum/#!topic/golang-announce/65QixT3tcmg","tags":["article"]},{"url":"https://groups.google.com/forum/#!topic/kubernetes-security-announce/wlHLHit1BqA","tags":["article"]},{"url":"https://nodejs.org/en/blog/vulnerability/aug-2019-security-releases/","tags":["article"]},{"url":"https://www.mail-archive.com/grpc-io@googlegroups.com/msg06408.html","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-9514","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-9514","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-9514","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-18466","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1744588","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-18466","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-18466","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:1234","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1784228","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1792796","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1795376","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1795838","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1796451","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_1234.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-1702","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-1702","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-1702","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-8945","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-8945","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8945","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2019:4269","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20192786-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1152308","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-16884","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20192787-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20192810-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1131314","tags":["report"]},{"url":"https://bugzilla.suse.com/1131553","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20200035-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1122469","tags":["report"]},{"url":"https://bugzilla.suse.com/1143349","tags":["report"]},{"url":"https://bugzilla.suse.com/1150397","tags":["report"]},{"url":"https://bugzilla.suse.com/1153367","tags":["report"]},{"url":"https://bugzilla.suse.com/1158590","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20200065-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211458-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1028638","tags":["report"]},{"url":"https://bugzilla.suse.com/1034053","tags":["report"]},{"url":"https://bugzilla.suse.com/1048046","tags":["report"]},{"url":"https://bugzilla.suse.com/1051429","tags":["report"]},{"url":"https://bugzilla.suse.com/1053532","tags":["report"]},{"url":"https://bugzilla.suse.com/1095817","tags":["report"]},{"url":"https://bugzilla.suse.com/1118897","tags":["report"]},{"url":"https://bugzilla.suse.com/1118898","tags":["report"]},{"url":"https://bugzilla.suse.com/1118899","tags":["report"]},{"url":"https://bugzilla.suse.com/1121967","tags":["report"]},{"url":"https://bugzilla.suse.com/1149954","tags":["report"]},{"url":"https://bugzilla.suse.com/1160452","tags":["report"]},{"url":"https://bugzilla.suse.com/1168481","tags":["report"]},{"url":"https://bugzilla.suse.com/1175081","tags":["report"]},{"url":"https://bugzilla.suse.com/1175821","tags":["report"]},{"url":"https://bugzilla.suse.com/1181594","tags":["report"]},{"url":"https://bugzilla.suse.com/1181641","tags":["report"]},{"url":"https://bugzilla.suse.com/1181677","tags":["report"]},{"url":"https://bugzilla.suse.com/1181730","tags":["report"]},{"url":"https://bugzilla.suse.com/1181732","tags":["report"]},{"url":"https://bugzilla.suse.com/1181749","tags":["report"]},{"url":"https://bugzilla.suse.com/1182451","tags":["report"]},{"url":"https://bugzilla.suse.com/1182476","tags":["report"]},{"url":"https://bugzilla.suse.com/1182947","tags":["report"]},{"url":"https://bugzilla.suse.com/1183024","tags":["report"]},{"url":"https://bugzilla.suse.com/1183397","tags":["report"]},{"url":"https://bugzilla.suse.com/1183855","tags":["report"]},{"url":"https://bugzilla.suse.com/1184768","tags":["report"]},{"url":"https://bugzilla.suse.com/1184962","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16874","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16875","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19921","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5736","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21284","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21285","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21334","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2019-16884","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4297-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-4867-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-19921","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-30465","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XQUO7JWM2QDHYISZWKF27GHWQFEZNITO/#XQUO7JWM2QDHYISZWKF27GHWQFEZNITO","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/CCB4TJ7VRHVOBIOYGLDTKVCWSLRC5IPU/#CCB4TJ7VRHVOBIOYGLDTKVCWSLRC5IPU","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/7SG42XULDNEP3QYZYRNN6W3EOIOR7RWW/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9962","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-30465","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-16884","description":"runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /proc directory.","status":"published","published":"2019-09-25T00:00:00Z","modified":"2024-08-05T01:24:48.342Z","updated_at":"2026-11-02T14:32:23.189113Z"}],"euvd":[{"id":"EUVD-2022-0981","description":"runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /proc directory.","status":"published","published":"2019-09-25T00:00:00Z","modified":"2024-08-05T01:24:48Z","updated_at":"2026-11-03T02:40:31.468839Z"}],"ghsa":[{"id":"GHSA-fgv8-vj5c-2ppq","title":"Incorrect Authorization in runc","description":"runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /proc directory.","status":"published","published":"2022-02-22T15:38:08Z","modified":"2024-05-20T19:45:18Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:37:50.750599Z"}],"nvd":[{"id":"CVE-2019-16884","description":"runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /proc directory.","status":"published","published":"2019-09-25T18:15:13.057Z","modified":"2026-06-17T02:22:53.837Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:05:28.126831Z"}],"osv":[{"id":"ALPINE-CVE-2019-16884","description":"runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /proc directory.","status":"published","published":"2019-09-25T18:15:13.057Z","modified":"2026-11-03T06:31:53.410116403Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-03T07:18:15.355745Z"},{"id":"BELL-CVE-2019-16884","title":"CVE-2019-16884 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:16:23.159001Z","modified":"2026-01-26T09:49:14.130634Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:15.340685Z"},{"id":"CVE-2019-16884","description":"runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /proc directory.","status":"published","published":"2019-09-25T18:15:13.057Z","modified":"2026-10-24T10:47:42.030023492Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:11.673963Z"},{"id":"DEBIAN-CVE-2019-16884","description":"runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /proc directory.","status":"published","published":"2019-09-25T18:15:13.057Z","modified":"2026-09-21T07:03:07.851491676Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:31.867036Z"},{"id":"GHSA-fgv8-vj5c-2ppq","title":"Incorrect Authorization in runc","description":"runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /proc directory.","status":"published","published":"2022-02-22T15:38:08Z","modified":"2026-09-10T03:48:32.085889707Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T15:46:46.39441Z"},{"id":"RHBA-2020:1232","title":"Red Hat Bug Fix Advisory: runc bug fix update","status":"published","published":"2024-09-13T16:11:00Z","modified":"2026-06-26T10:45:34Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"RHSA-2019:3940","title":"Red Hat Security Advisory: OpenShift Container Platform 4.1.24 runc security update","status":"published","published":"2024-09-13T16:14:10Z","modified":"2025-11-22T11:51:54Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"RHSA-2019:4074","title":"Red Hat Security Advisory: OpenShift Container Platform 4.2 runc security update","status":"published","published":"2024-09-13T16:14:49Z","modified":"2025-11-22T11:52:20Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"RHSA-2019:4269","title":"Red Hat Security Advisory: container-tools:rhel8 security and bug fix update","status":"published","published":"2024-10-09T06:54:15Z","modified":"2026-10-13T10:01:35Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"RHSA-2020:1234","title":"Red Hat Security Advisory: docker security and bug fix update","status":"published","published":"2024-09-13T22:39:19Z","modified":"2026-06-27T10:09:32Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"RLSA-2019:4269","title":"Important: container-tools:rhel8 security and bug fix update","description":"The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.\n\nSecurity Fix(es):\n\n* HTTP/2: flood using PING frames results in unbounded memory growth (CVE-2019-9512)\n\n* HTTP/2: flood using HEADERS frames results in unbounded memory growth (CVE-2019-9514)\n\n* runc: AppArmor/SELinux bypass with malicious image that specifies a volume at /proc (CVE-2019-16884)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* avc: podman run --security-opt label=type:svirt_qemu_net_t (BZ#1764318)\n\n* backport json-file logging support to 1.4.2 (BZ#1770176)\n\n* Selinux won't allow SCTP inter pod communication (BZ#1774382)","status":"published","published":"2019-12-17T09:19:28Z","modified":"2026-02-04T13:15:05.94206Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2019-16884","description":"runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /proc directory.","status":"published","published":"2019-09-25T18:15:00Z","modified":"2026-02-04T03:29:46.473626Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:54:20.325378Z"},{"id":"ALSA-2019:4269","title":"Important: container-tools:rhel8 security and bug fix update","description":"The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.\n\nSecurity Fix(es):\n\n* HTTP/2: flood using PING frames results in unbounded memory growth (CVE-2019-9512)\n\n* HTTP/2: flood using HEADERS frames results in unbounded memory growth (CVE-2019-9514)\n\n* runc: AppArmor/SELinux bypass with malicious image that specifies a volume at /proc (CVE-2019-16884)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* avc: podman run --security-opt label=type:svirt_qemu_net_t (BZ#1764318)\n\n* backport json-file logging support to 1.4.2 (BZ#1770176)\n\n* Selinux won't allow SCTP inter pod communication (BZ#1774382)","status":"published","published":"2019-12-17T09:19:28Z","modified":"2026-10-29T11:12:08.242336221Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"DLA-3322-1","title":"golang-github-opencontainers-selinux - security update","status":"published","published":"2023-02-18T00:00:00Z","modified":"2026-03-09T01:21:31.006297Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"DLA-3369-1","title":"runc - security update","status":"published","published":"2023-03-27T00:00:00Z","modified":"2026-03-09T01:18:39.384079Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"GO-2021-0085","title":"Authorization bypass in github.com/opencontainers/runc","description":"AppArmor restrictions may be bypassed due to improper validation of mount targets, allowing a malicious image to mount volumes over e.g. /proc.","status":"published","published":"2021-04-14T20:04:52Z","modified":"2026-02-04T02:43:28.254816Z","updated_at":"2026-11-02T15:47:00.604718Z"},{"id":"MGASA-2020-0050","title":"Updated opencontainers-runc packages fix security vulnerability","description":"runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other\nproducts, allows AppArmor restriction bypass because \nlibcontainer/rootfs_linux.go incorrectly checks mount targets, and thus\na malicious Docker image can mount over a /proc directory\n(CVE-2019-16884).\n","status":"published","published":"2020-01-28T07:52:40Z","modified":"2026-04-16T04:43:54.450422854Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"openSUSE-SU-2019:2418-1","title":"Security update for docker-runc","description":"This update for docker-runc fixes the following issues:\n\n- CVE-2019-16884: Fixed an LSM bypass via malicious Docker images that mount over a /proc directory. (bsc#1152308)\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-10-31T09:26:56Z","modified":"2026-02-04T02:58:33.920274Z","updated_at":"2026-11-02T16:58:30.784344Z"},{"id":"openSUSE-SU-2019:2434-1","title":"Security update for docker-runc","description":"This update for docker-runc fixes the following issues:\n\n- CVE-2019-16884: Fixed an LSM bypass via malicious Docker images that mount over a /proc directory. (bsc#1152308)\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-11-05T15:30:38Z","modified":"2025-05-07T18:10:50.731257Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2020:0045-1","title":"Security update for containerd, docker, docker-runc, golang-github-docker-libnetwork","description":"This update for containerd, docker, docker-runc, golang-github-docker-libnetwork fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2019-16884: Fixed incomplete patch for LSM bypass via malicious Docker image that mount over a /proc directory (bsc#1152308). \n\nBug fixes:\n\n- Update to Docker 19.03.5-ce (bsc#1158590).\n- Update to Docker 19.03.3-ce (bsc#1153367).\n- Update to Docker 19.03.2-ce (bsc#1150397).\n- Fixed default installation such that --userns-remap=default works properly (bsc#1143349).\n- Fixed nginx blocked by apparmor (bsc#1122469).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2020-01-13T17:16:40Z","modified":"2026-02-04T02:20:44.19681Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2024:11358-1","title":"runc-1.0.2-1.2 on GA media","description":"These are all security issues fixed in the runc-1.0.2-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:01:48.763706Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2019:2786-1","title":"Security update for docker-runc","description":"This update for docker-runc fixes the following issues:\n\n- CVE-2019-16884: Fixed an LSM bypass via malicious Docker images that mount over a /proc directory. (bsc#1152308)\n","status":"published","published":"2019-10-25T13:56:38Z","modified":"2026-02-04T02:15:42.265713Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"SUSE-SU-2019:2787-1","title":"Security update for docker-runc","description":"This update for docker-runc fixes the following issues:\n\n- CVE-2019-16884: Fixed an LSM bypass via malicious Docker images that mount over a /proc directory. (bsc#1152308)\n","status":"published","published":"2019-10-25T13:56:56Z","modified":"2026-02-04T03:26:05.839714Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"SUSE-SU-2019:2810-1","title":"Security update for runc","description":"This update for runc fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2019-16884: Fixed an LSM bypass via malicious Docker images that mount over a /proc directory. (bsc#1152308)\n\nNon-security issues fixed:\n\n- Includes upstreamed patches for regressions (bsc#1131314 bsc#1131553).\n","status":"published","published":"2019-10-29T13:56:47Z","modified":"2026-02-04T02:48:17.405645Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"SUSE-SU-2020:0035-1","title":"Security update for containerd, docker, docker-runc, golang-github-docker-libnetwork","description":"This update for containerd, docker, docker-runc, golang-github-docker-libnetwork fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2019-16884: Fixed incomplete patch for LSM bypass via malicious Docker image that mount over a /proc directory (bsc#1152308). \n\nBug fixes:\n\n- Update to Docker 19.03.5-ce (bsc#1158590).\n- Update to Docker 19.03.3-ce (bsc#1153367).\n- Update to Docker 19.03.2-ce (bsc#1150397).\n- Fixed default installation such that --userns-remap=default works properly (bsc#1143349).\n- Fixed nginx blocked by apparmor (bsc#1122469).\n","status":"published","published":"2020-01-08T08:06:36Z","modified":"2026-02-04T03:01:23.883111Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"SUSE-SU-2020:0065-1","title":"Security update for containerd, docker, docker-runc, golang-github-docker-libnetwork","description":"This update for containerd, docker, docker-runc, golang-github-docker-libnetwork fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2019-16884: Fixed incomplete patch for LSM bypass via malicious Docker image that mount over a /proc directory (bsc#1152308).\n\nBug fixes:\n\n- Update to Docker 19.03.5-ce (bsc#1158590).\n- Update to Docker 19.03.3-ce (bsc#1153367).\n- Update to Docker 19.03.2-ce (bsc#1150397).\n- Fixed default installation such that --userns-remap=default works properly (bsc#1143349).\n- Fixed nginx blocked by apparmor (bsc#1122469).\n","status":"published","published":"2020-01-10T10:02:51Z","modified":"2026-02-04T04:04:45.165664Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"SUSE-SU-2021:1458-1","title":"Security update for containerd, docker, runc","description":"This update for containerd, docker, runc fixes the following issues:\n\n- Docker was updated to 20.10.6-ce\n  *  Switch version to use -ce suffix rather than _ce to avoid confusing other\n     tools (bsc#1182476).\n  * CVE-2021-21284: Fixed a potential privilege escalation when the root user in \n    the remapped namespace has access to the host filesystem (bsc#1181732)\n  * CVE-2021-21285: Fixed an issue where pulling a malformed Docker image manifest \n    crashes the dockerd daemon (bsc#1181730). \n\n- runc was updated to  v1.0.0~rc93 (bsc#1182451 and bsc#1184962).\n  * Use the upstream runc package (bsc#1181641, bsc#1181677, bsc#1175821).\n  * Fixed /dev/null is not available (bsc#1168481).\n  * Fixed an issue where podman hangs when spawned by salt-minion process (bsc#1149954).\n  * CVE-2019-19921: Fixed a race condition with shared mounts (bsc#1160452).\n  * CVE-2019-16884: Fixed an LSM bypass via malicious Docker image that mount \n    over a /proc directory (bsc#1152308).\n  * CVE-2019-5736: Fixed potential write attacks to the host runc binary (bsc#1121967).\n  * Fixed an issue where after a kernel-update docker doesn't run (bsc#1131314 bsc#1131553)\n  * Ensure that we always include the version information in runc (bsc#1053532).\n  \n- Switch to Go 1.13 for build.\n  * CVE-2018-16873: Fixed a potential remote code execution (bsc#1118897).\n  * CVE-2018-16874: Fixed a directory traversal in 'go get' via curly braces \n    in import paths (bsc#1118898).\n  * CVE-2018-16875: Fixed a CPU denial of service (bsc#1118899).\n  * Fixed an issue with building containers (bsc#1095817).\n\n- containerd was updated to v1.4.4\n  * CVE-2021-21334: Fixed a potential information leak through environment variables (bsc#1183397).\n  * Handle a requirement from docker (bsc#1181594).\n  * Install the containerd-shim* binaries and stop creating (bsc#1183024).\n  * update version to the one required by docker (bsc#1034053)\n\n- Use -buildmode=pie for tests and binary build (bsc#1048046, bsc#1051429)\n- Cleanup seccomp builds similar (bsc#1028638).\n- Update to handle the docker-runc removal, and drop the -kubic flavour (bsc#1181677, bsc#1181749)\n","status":"published","published":"2021-04-30T10:58:51Z","modified":"2026-02-04T02:16:12.876879Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"USN-4297-1","title":"runc vulnerabilities","description":"It was discovered that runC incorrectly checked mount targets. An attacker\nwith a malicious container image could possibly mount over the /proc\ndirectory and escalate privileges. This issue only affected Ubuntu 18.04\nLTS. (CVE-2019-16884)\n\nIt was discovered that runC incorrectly performed access control. An\nattacker could possibly use this issue to escalate privileges.\n(CVE-2019-19921)\n","status":"published","published":"2020-03-09T15:21:21Z","modified":"2026-02-10T04:41:47Z","updated_at":"2026-11-02T16:58:14.547547Z"},{"id":"USN-4867-1","title":"runc vulnerabilities","description":"It was discovered that runC incorrectly checked mount targets. An attacker\nwith a malicious container image could possibly mount over the /proc\ndirectory and escalate privileges. (CVE-2019-16884)\n\nEtienne Champetier discovered that runC incorrectly checked mount targets.\nAn attacker with a malicious container image could possibly mount the host\nfilesystem into the container and escalate privileges. (CVE-2021-30465)","status":"published","published":"2021-08-10T19:58:08Z","modified":"2026-06-25T13:30:32.613330285Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}