{"id":"CVE-2019-19921","aliases":["ALPINE-CVE-2019-19921","ALSA-2020:1650","ALSA-2023:6380","ALSA-2023:6938","ALSA-2023:6939","BELL-CVE-2019-19921","DEBIAN-CVE-2019-19921","DLA-3369-1","EUVD-2021-1060","GHSA-fh74-hm69-rqjw","GO-2021-0087","MGASA-2020-0103","RHSA-2020:0688","RHSA-2020:0695","RHSA-2020:0942","RHSA-2020:1485","RHSA-2020:1650","RLSA-2020:1650","SUSE-SU-2020:0375-1","SUSE-SU-2020:0376-1","SUSE-SU-2020:0944-1","SUSE-SU-2021:1458-1","UBUNTU-CVE-2019-19921","USN-4297-1","USN-6088-2","openSUSE-SU-2020:0219-1","openSUSE-SU-2024:11358-1"],"status":"published","title":"opencontainers runc contains procfs race condition with a shared volume mount","description":"runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. (This vulnerability does not affect Docker due to an implementation detail that happens to block the attack.)","severity":{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.00433,"percentile":0.38067,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-362","CWE-706"],"published":"2020-02-07T16:30:28Z","modified":"2026-11-03T06:31:56Z","fixes":[{"ecosystem":"Go","package":"github.com/opencontainers/runc","fixed_in":["1.0.0-rc9.0.20200122160610-2fc03cc11c77"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.11","package":"containerd","fixed_in":["1.3.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"containerd","fixed_in":["1.3.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"containerd","fixed_in":["1.3.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"containerd","fixed_in":["1.3.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"containerd","fixed_in":["1.3.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"containerd","fixed_in":["1.3.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"containerd","fixed_in":["1.3.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"containerd","fixed_in":["1.3.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"containerd","fixed_in":["1.3.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"containerd","fixed_in":["1.3.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"containerd","fixed_in":["1.3.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"containerd","fixed_in":["1.3.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"containerd","fixed_in":["1.3.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"containerd","fixed_in":["1.3.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"runc","fixed_in":["1.0.0_rc10"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"runc","fixed_in":["1.0.0_rc10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"runc","fixed_in":["1.0.0_rc10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"runc","fixed_in":["1.0.0_rc10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"runc","fixed_in":["1.0.0_rc10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"runc","fixed_in":["1.0.0_rc10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"runc","fixed_in":["1.0.0_rc10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"runc","fixed_in":["1.0.0_rc10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"runc","fixed_in":["1.0.0_rc10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"runc","fixed_in":["1.0.0_rc10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"runc","fixed_in":["1.0.0_rc10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"runc","fixed_in":["1.0.0_rc10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"runc","fixed_in":["1.0.0_rc10-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"runc","fixed_in":["1.0.0_rc10-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"runc","fixed_in":["1.0.0~rc10+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"runc","fixed_in":["1.0.0~rc10+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"runc","fixed_in":["1.0.0~rc10+dfsg1-1"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"opencontainers-runc","fixed_in":["1.0.0-0.rc10.3.1.mga7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.2::el8","package":"runc","fixed_in":["0:1.0.0-63.rc10.rhaos4.2.gitdc9208a.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.2::el8","package":"runc-debuginfo","fixed_in":["0:1.0.0-63.rc10.rhaos4.2.gitdc9208a.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.2::el8","package":"runc-debugsource","fixed_in":["0:1.0.0-63.rc10.rhaos4.2.gitdc9208a.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.1::el8","package":"runc","fixed_in":["0:1.0.0-63.rc8.rhaos4.1.git3cbe540.el8_0"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.1::el8","package":"runc-debuginfo","fixed_in":["0:1.0.0-63.rc8.rhaos4.1.git3cbe540.el8_0"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.1::el8","package":"runc-debugsource","fixed_in":["0:1.0.0-63.rc8.rhaos4.1.git3cbe540.el8_0"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_extras_other:7","package":"runc","fixed_in":["0:1.0.0-66.rc8.el7_7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_extras_other:7","package":"runc-debuginfo","fixed_in":["0:1.0.0-66.rc8.el7_7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.3::el7","package":"runc","fixed_in":["0:1.0.0-66.rc10.rhaos4.3.el7_8"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:4.3::el7","package":"runc-debuginfo","fixed_in":["0:1.0.0-66.rc10.rhaos4.3.el7_8"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP1","package":"docker-runc","fixed_in":["1.0.0rc8+gitr3917_3e425f80a8c9-6.32.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Containers 12","package":"docker-runc","fixed_in":["1.0.0rc8+gitr3917_3e425f80a8c9-1.40.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP1","package":"runc","fixed_in":["1.0.0~rc10-1.9.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"runc","fixed_in":["1.0.0~rc7+git20190403.029124da-0ubuntu1~16.04.4+esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"runc","fixed_in":["1.0.0~rc10-0ubuntu1~18.04.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"runc","fixed_in":["1.0.0~rc10-0ubuntu1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.1","package":"docker-runc","fixed_in":["1.0.0rc8+gitr3917_3e425f80a8c9-lp151.3.15.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/opencontainers/runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-rc9.0.20200122160610-2fc03cc11c77"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0_rc10"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0_rc10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0_rc10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0_rc10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0_rc10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0_rc10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0_rc10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0_rc10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0_rc10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0_rc10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0_rc10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0_rc10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0_rc10-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0_rc10-r0"}]}]},{"source":"osv","ecosystem":"AlmaLinux:8","package":"crit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12-9.module_el8.3.0+2044+12421f43"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"crit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12-9.module_el8.4.0+2496+12421f43"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"crit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12-9.module_el8.5.0+119+9a9ec082"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"criu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12-9.module_el8.4.0+2496+12421f43"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"criu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12-9.module_el8.3.0+2044+12421f43"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"criu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12-9.module_el8.5.0+119+9a9ec082"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"python-podman-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-0.2.gitd0a45fe.module_el8.5.0+2635+e4386a39"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"python-podman-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-0.2.gitd0a45fe.module_el8.5.0+108+00865455"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"python3-criu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12-9.module_el8.3.0+2044+12421f43"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"python3-criu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12-9.module_el8.4.0+2496+12421f43"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"python3-criu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12-9.module_el8.5.0+119+9a9ec082"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"slirp4netns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.2-3.git21fdece.module_el8.5.0+2635+e4386a39"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"slirp4netns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.2-3.git21fdece.module_el8.5.0+108+00865455"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"toolbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.7-1.module_el8.5.0+108+00865455"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"toolbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.7-1.module_el8.5.0+2635+e4386a39"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"udica","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.1-2.module_el8.5.0+108+00865455"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:8","package":"udica","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.1-2.module_el8.5.0+2635+e4386a39"}]}],"bundled":3},{"source":"osv","ecosystem":"AlmaLinux:9","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4:1.1.9-1.el9"}]}],"bundled":6},{"source":"osv","ecosystem":"AlmaLinux:8","package":"aardvark-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.0.1-38.module_el8.9.0+3627+db8ec155"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:8","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.24.6-7.module_el8.9.0+3627+db8ec155"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:8","package":"buildah-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.24.6-7.module_el8.9.0+3627+db8ec155"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:8","package":"cockpit-podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"46-1.module_el8.7.0+3344+5bcd850f"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:8","package":"conmon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.1.4-2.module_el8.9.0+3627+db8ec155"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:8","package":"container-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.205.0-3.module_el8.9.0+3627+db8ec155"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:8","package":"containernetworking-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.1-5.module_el8.9.0+3627+db8ec155"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:8","package":"containers-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1-38.module_el8.9.0+3627+db8ec155"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:8","package":"crit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.15-3.module_el8.6.0+3137+d33c3efb"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:8","package":"crit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.15-3.module_el8.6.0+2877+8e437bf5"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:8","package":"criu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.15-3.module_el8.6.0+2877+8e437bf5"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:8","package":"criu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.15-3.module_el8.6.0+3137+d33c3efb"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:8","package":"criu-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.15-3.module_el8.6.0+2877+8e437bf5"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:8","package":"criu-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.15-3.module_el8.6.0+3137+d33c3efb"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:8","package":"criu-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.15-3.module_el8.6.0+2877+8e437bf5"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:8","package":"criu-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.15-3.module_el8.6.0+3137+d33c3efb"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:8","package":"crun","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.3-1.module_el8.9.0+3627+db8ec155"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:8","package":"fuse-overlayfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9-2.module_el8.9.0+3627+db8ec155"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libslirp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-1.module_el8.6.0+2877+8e437bf5"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libslirp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-1.module_el8.6.0+3137+d33c3efb"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libslirp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-1.module_el8.6.0+3137+d33c3efb"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libslirp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-1.module_el8.6.0+2877+8e437bf5"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:8","package":"netavark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.0.1-38.module_el8.9.0+3627+db8ec155"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:8","package":"oci-seccomp-bpf-hook","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.5-2.module_el8.8.0+3468+16b86c82"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:8","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.0.2-24.module_el8.9.0+3627+db8ec155"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:8","package":"podman-catatonit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.0.2-24.module_el8.9.0+3627+db8ec155"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:8","package":"podman-docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.0.2-24.module_el8.9.0+3627+db8ec155"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:8","package":"podman-gvproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.0.2-24.module_el8.9.0+3627+db8ec155"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:8","package":"podman-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.0.2-24.module_el8.9.0+3627+db8ec155"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:8","package":"podman-remote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.0.2-24.module_el8.9.0+3627+db8ec155"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:8","package":"podman-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.0.2-24.module_el8.9.0+3627+db8ec155"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:8","package":"python3-criu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.15-3.module_el8.6.0+3137+d33c3efb"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:8","package":"python3-criu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.15-3.module_el8.6.0+2877+8e437bf5"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:8","package":"python3-podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.0-2.module_el8.9.0+3627+db8ec155"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:8","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.5-2.module_el8.9.0+3627+db8ec155"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:8","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.6.2-8.module_el8.9.0+3627+db8ec155"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:8","package":"skopeo-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.6.2-8.module_el8.9.0+3627+db8ec155"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:8","package":"slirp4netns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.8-3.module_el8.9.0+3627+db8ec155"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:8","package":"toolbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.99.4-5.module_el8.9.0+3627+db8ec155"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:8","package":"toolbox-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.99.4-5.module_el8.9.0+3627+db8ec155"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:8","package":"udica","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.6-4.module_el8.9.0+3627+db8ec155"}]}],"bundled":17},{"source":"osv","ecosystem":"AlmaLinux:8","package":"aardvark-dns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.7.0-1.module_el8.9.0+3657+d86e192f"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:8","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.31.3-1.module_el8.9.0+3643+9234dc3b"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:8","package":"buildah-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.31.3-1.module_el8.9.0+3643+9234dc3b"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:8","package":"cockpit-podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"75-1.module_el8.9.0+3643+9234dc3b"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:8","package":"conmon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:2.1.8-1.module_el8.9.0+3643+9234dc3b"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:8","package":"container-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.221.0-1.module_el8.9.0+3643+9234dc3b"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:8","package":"containernetworking-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.3.0-4.module_el8.9.0+3643+9234dc3b"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:8","package":"containers-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1-54.module_el8.9.0+3673+0c64b403"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:8","package":"crit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.18-4.module_el8.9.0+3643+9234dc3b"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:8","package":"criu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.18-4.module_el8.9.0+3643+9234dc3b"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:8","package":"criu-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.18-4.module_el8.9.0+3643+9234dc3b"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:8","package":"criu-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.18-4.module_el8.9.0+3643+9234dc3b"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:8","package":"crun","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.7-1.module_el8.9.0+3643+9234dc3b"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:8","package":"fuse-overlayfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12-1.module_el8.9.0+3643+9234dc3b"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libslirp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-1.module_el8.8.0+3615+3543c705"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:8","package":"libslirp-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.4.0-1.module_el8.8.0+3615+3543c705"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:8","package":"netavark","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.7.0-1.module_el8.9.0+3643+9234dc3b"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:8","package":"oci-seccomp-bpf-hook","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.9-1.module_el8.9.0+3643+9234dc3b"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:8","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.6.1-4.module_el8.9.0+3643+9234dc3b"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:8","package":"podman-catatonit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.6.1-4.module_el8.9.0+3643+9234dc3b"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:8","package":"podman-docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.6.1-4.module_el8.9.0+3643+9234dc3b"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:8","package":"podman-gvproxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.6.1-4.module_el8.9.0+3643+9234dc3b"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:8","package":"podman-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.6.1-4.module_el8.9.0+3643+9234dc3b"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:8","package":"podman-remote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.6.1-4.module_el8.9.0+3643+9234dc3b"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:8","package":"podman-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3:4.6.1-4.module_el8.9.0+3643+9234dc3b"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:8","package":"python3-criu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.18-4.module_el8.9.0+3643+9234dc3b"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:8","package":"python3-podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.0-1.module_el8.9.0+3643+9234dc3b"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:8","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.9-1.module_el8.9.0+3643+9234dc3b"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:8","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.13.3-1.module_el8.9.0+3643+9234dc3b"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:8","package":"skopeo-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.13.3-1.module_el8.9.0+3643+9234dc3b"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:8","package":"slirp4netns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.1-1.module_el8.9.0+3643+9234dc3b"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:8","package":"toolbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.99.4-5.module_el8.9.0+3643+9234dc3b"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:8","package":"toolbox-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.99.4-5.module_el8.9.0+3643+9234dc3b"}]}],"bundled":18},{"source":"osv","ecosystem":"AlmaLinux:8","package":"udica","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.6-20.module_el8.8.0+3615+3543c705"}]}],"bundled":18},{"source":"osv","ecosystem":"Debian:12","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0~rc10+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0~rc10+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0~rc10+dfsg1-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0~rc6+dfsg1-3+deb10u2"}]}],"versions":["1.0.0~rc6+dfsg1-3","1.0.0~rc6+dfsg1-3+deb10u1"],"bundled":6},{"source":"osv","ecosystem":"Go","package":"github.com/opencontainers/runc","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.0.0-rc9.0.20200122160610-2fc03cc11c77"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/opencontainers/runc","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.0.0-rc9.0.20200122160610-2fc03cc11c77"}]}]},{"source":"osv","ecosystem":"Mageia:7","package":"opencontainers-runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0-0.rc10.3.1.mga7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.2::el8","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-63.rc10.rhaos4.2.gitdc9208a.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.2::el8","package":"runc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-63.rc10.rhaos4.2.gitdc9208a.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.2::el8","package":"runc-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-63.rc10.rhaos4.2.gitdc9208a.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.1::el8","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-63.rc8.rhaos4.1.git3cbe540.el8_0"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.1::el8","package":"runc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-63.rc8.rhaos4.1.git3cbe540.el8_0"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.1::el8","package":"runc-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-63.rc8.rhaos4.1.git3cbe540.el8_0"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_extras_other:7","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-66.rc8.el7_7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_extras_other:7","package":"runc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-66.rc8.el7_7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.3::el7","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-66.rc10.rhaos4.3.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:4.3::el7","package":"runc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-66.rc10.rhaos4.3.el7_8"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"buildah","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.11.6-7.module+el8.2.0+5856+b8046c6d"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"buildah-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.11.6-7.module+el8.2.0+5856+b8046c6d"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"buildah-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.11.6-7.module+el8.2.0+5856+b8046c6d"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"buildah-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.11.6-7.module+el8.2.0+5856+b8046c6d"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"buildah-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.11.6-7.module+el8.2.0+5856+b8046c6d"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cockpit-podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12-1.module+el8.2.0+5950+6d183a6a"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"conmon","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.0.6-1.module+el8.2.0+5182+3136e5d4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"container-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.124.0-1.module+el8.2.0+5182+3136e5d4"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"containernetworking-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8.3-5.module+el8.2.0+5201+6b31f0d9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"containernetworking-plugins-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8.3-5.module+el8.2.0+5201+6b31f0d9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"containernetworking-plugins-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.8.3-5.module+el8.2.0+5201+6b31f0d9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"containers-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.1.40-10.module+el8.2.0+5955+6cd70ceb"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"crit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12-9.module+el8.2.0+5029+3ac48e7d"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"criu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12-9.module+el8.2.0+5029+3ac48e7d"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"criu-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12-9.module+el8.2.0+5029+3ac48e7d"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"criu-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12-9.module+el8.2.0+5029+3ac48e7d"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"fuse-overlayfs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.7.2-5.module+el8.2.0+6060+9dbc027d"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"fuse-overlayfs-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.7.2-5.module+el8.2.0+6060+9dbc027d"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"fuse-overlayfs-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.7.2-5.module+el8.2.0+6060+9dbc027d"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"podman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.4-10.module+el8.2.0+6063+e761893a"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"podman-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.4-10.module+el8.2.0+6063+e761893a"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"podman-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.4-10.module+el8.2.0+6063+e761893a"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"podman-docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.4-10.module+el8.2.0+6063+e761893a"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"podman-remote","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.4-10.module+el8.2.0+6063+e761893a"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"podman-remote-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.4-10.module+el8.2.0+6063+e761893a"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"podman-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.4-10.module+el8.2.0+6063+e761893a"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python-podman-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.0-0.2.gitd0a45fe.module+el8.2.0+5201+6b31f0d9"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"python3-criu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12-9.module+el8.2.0+5029+3ac48e7d"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-65.rc10.module+el8.2.0+5762+aaee29fb"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"runc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-65.rc10.module+el8.2.0+5762+aaee29fb"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"runc-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-65.rc10.module+el8.2.0+5762+aaee29fb"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.1.40-10.module+el8.2.0+5955+6cd70ceb"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"skopeo-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.1.40-10.module+el8.2.0+5955+6cd70ceb"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"skopeo-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.1.40-10.module+el8.2.0+5955+6cd70ceb"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"skopeo-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:0.1.40-10.module+el8.2.0+5955+6cd70ceb"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"slirp4netns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.2-3.git21fdece.module+el8.2.0+5658+9a15711d"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"slirp4netns-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.2-3.git21fdece.module+el8.2.0+5658+9a15711d"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"slirp4netns-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.2-3.git21fdece.module+el8.2.0+5658+9a15711d"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"toolbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.0.7-1.module+el8.2.0+6096+9c3f08f3"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"udica","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.2.1-2.module+el8.2.0+4896+8f613c81"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"criu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12-9.module+el8.5.0+681+c9a1951f"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"criu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12-9.module+el8.4.0+557+48ba8b2f"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"python-podman-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.0-0.2.gitd0a45fe.module+el8.5.0+770+e2f49861"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"python-podman-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.0-0.2.gitd0a45fe.module+el8.4.0+559+c02fa3b2"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"python-podman-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.0-0.2.gitd0a45fe.module+el8.5.0+708+6758137d"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-65.rc10.module+el8.4.0+559+c02fa3b2"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"slirp4netns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.2-3.git21fdece.module+el8.5.0+770+e2f49861"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"slirp4netns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.2-3.git21fdece.module+el8.4.0+536+994a2182"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"slirp4netns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.2-3.git21fdece.module+el8.5.0+708+6758137d"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"toolbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.0.7-1.module+el8.5.0+770+e2f49861"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"toolbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.0.7-1.module+el8.4.0+559+c02fa3b2"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"toolbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.0.7-1.module+el8.5.0+708+6758137d"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"udica","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.2.1-2.module+el8.5.0+770+e2f49861"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"udica","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.2.1-2.module+el8.4.0+559+c02fa3b2"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"udica","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.2.1-2.module+el8.5.0+708+6758137d"}]}],"bundled":3},{"source":"osv","ecosystem":"Rocky Linux:8","package":"container-selinux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.124.0-1.gitf958d0c.module+el8.5.0+681+c9a1951f"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP1","package":"docker-runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0rc8+gitr3917_3e425f80a8c9-6.32.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 12","package":"docker-runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0rc8+gitr3917_3e425f80a8c9-1.40.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP1","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0~rc10-1.9.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 12","package":"containerd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4-16.38.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 12","package":"docker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.10.6_ce-98.66.1"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 12","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0~rc93-16.8.1"}]}],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0~rc7+git20190403.029124da-0ubuntu1~16.04.4+esm4"}]}],"versions":["0.0.8+dfsg-2","0.1.1-0ubuntu5~16.04","1.0.0~rc1-0ubuntu1~16.04","1.0.0~rc1-0ubuntu2~16.04.1","1.0.0~rc1-0ubuntu2~16.04.1.1","1.0.0~rc2-0ubuntu2~16.04.1","1.0.0~rc2+docker1.12.6-0ubuntu1~16.04.1","1.0.0~rc2+docker1.13.1-0ubuntu1~16.04.1","1.0.0~rc2+docker1.13.1-0ubuntu1~16.04.2","1.0.0~rc7+git20190403.029124da-0ubuntu1~16.04.3","1.0.0~rc7+git20190403.029124da-0ubuntu1~16.04.4","1.0.0~rc7+git20190403.029124da-0ubuntu1~16.04.4+esm1","1.0.0~rc7+git20190403.029124da-0ubuntu1~16.04.4+esm2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0~rc10-0ubuntu1~18.04.2"}]}],"versions":["1.0.0~rc2+docker1.13.1-0ubuntu1","1.0.0~rc4+dfsg1-2","1.0.0~rc4+dfsg1-6","1.0.0~rc4+dfsg1-6ubuntu0.18.04.1","1.0.0~rc7+git20190403.029124da-0ubuntu1~18.04.1","1.0.0~rc7+git20190403.029124da-0ubuntu1~18.04.2","1.0.0~rc10-0ubuntu1~18.04.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0~rc10-0ubuntu1"}]}],"versions":["1.0.0~rc8+git20190923.3e425f80-0ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0~rc10-0ubuntu1~18.04.2"}]}],"versions":["1.0.0~rc2+docker1.13.1-0ubuntu1","1.0.0~rc4+dfsg1-2","1.0.0~rc4+dfsg1-6","1.0.0~rc4+dfsg1-6ubuntu0.18.04.1","1.0.0~rc7+git20190403.029124da-0ubuntu1~18.04.1","1.0.0~rc7+git20190403.029124da-0ubuntu1~18.04.2","1.0.0~rc10-0ubuntu1~18.04.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0~rc7+git20190403.029124da-0ubuntu1~16.04.4+esm4"}]}],"versions":["0.0.8+dfsg-2","0.1.1-0ubuntu5~16.04","1.0.0~rc1-0ubuntu1~16.04","1.0.0~rc1-0ubuntu2~16.04.1","1.0.0~rc1-0ubuntu2~16.04.1.1","1.0.0~rc2-0ubuntu2~16.04.1","1.0.0~rc2+docker1.12.6-0ubuntu1~16.04.1","1.0.0~rc2+docker1.13.1-0ubuntu1~16.04.1","1.0.0~rc2+docker1.13.1-0ubuntu1~16.04.2","1.0.0~rc7+git20190403.029124da-0ubuntu1~16.04.3","1.0.0~rc7+git20190403.029124da-0ubuntu1~16.04.4","1.0.0~rc7+git20190403.029124da-0ubuntu1~16.04.4+esm1","1.0.0~rc7+git20190403.029124da-0ubuntu1~16.04.4+esm2"],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"docker-runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0rc8+gitr3917_3e425f80a8c9-lp151.3.15.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"runc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.2-1.2"}]}],"bundled":8}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"linuxfoundation","product":"runc"},{"vendor":"opensuse","product":"leap"},{"vendor":"redhat","product":"openshift_container_platform"}],"references":[{"url":"https://github.com/opencontainers/runc/releases","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-19921","tags":["x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/opencontainers/runc/issues/2197","tags":["x_transferred","Issue Tracking","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/opencontainers/runc/pull/2190","tags":["x_transferred","Issue Tracking","Third Party Advisory","report","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00018.html","tags":["vendor-advisory","x_transferred","Broken Link","Mailing List","Third Party Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2020:0688","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://access.redhat.com/errata/RHSA-2020:0695","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://security.gentoo.org/glsa/202003-21","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://usn.ubuntu.com/4297-1/","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/03/msg00023.html","tags":["mailing-list","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DHGVGGMKGZSJ7YO67TGGPFEHBYMS63VF/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FYVE3GB4OG3BNT5DLQHYO4M5SXX33AQ5/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I6BF24VCZRFTYBTT3T7HDZUOTKOTNPLZ/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ANUGDBJ7NBUMSUFZUSKU3ZMQYZ2Z3STN/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNB2UEDIIJCRQW4WJLZOPQJZXCVSXMLD/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://github.com/opencontainers/runc/security/advisories/GHSA-fh74-hm69-rqjw","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-19921","tags":["advisory"]},{"url":"https://github.com/opencontainers/runc/pull/2207","tags":["web","fix","report"]},{"url":"https://github.com/opencontainers/runc/commit/2fc03cc11c775b7a8b2e48d7ee447cb9bef32ad0","tags":["web","fix"]},{"url":"https://pkg.go.dev/vuln/GO-2021-0087","tags":["web"]},{"url":"https://usn.ubuntu.com/4297-1","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I6BF24VCZRFTYBTT3T7HDZUOTKOTNPLZ","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FYVE3GB4OG3BNT5DLQHYO4M5SXX33AQ5","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FNB2UEDIIJCRQW4WJLZOPQJZXCVSXMLD","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DHGVGGMKGZSJ7YO67TGGPFEHBYMS63VF","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ANUGDBJ7NBUMSUFZUSKU3ZMQYZ2Z3STN","tags":["web"]},{"url":"https://github.com/advisories/GHSA-fh74-hm69-rqjw"},{"url":"https://security.alpinelinux.org/vuln/CVE-2019-19921","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:1650","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/1703245","tags":["report"]},{"url":"https://bugzilla.redhat.com/1717357","tags":["report"]},{"url":"https://bugzilla.redhat.com/1731107","tags":["report"]},{"url":"https://bugzilla.redhat.com/1732704","tags":["report"]},{"url":"https://bugzilla.redhat.com/1732713","tags":["report"]},{"url":"https://bugzilla.redhat.com/1748519","tags":["report"]},{"url":"https://bugzilla.redhat.com/1749999","tags":["report"]},{"url":"https://bugzilla.redhat.com/1754744","tags":["report"]},{"url":"https://bugzilla.redhat.com/1754763","tags":["report"]},{"url":"https://bugzilla.redhat.com/1755119","tags":["report"]},{"url":"https://bugzilla.redhat.com/1756919","tags":["report"]},{"url":"https://bugzilla.redhat.com/1757693","tags":["report"]},{"url":"https://bugzilla.redhat.com/1757845","tags":["report"]},{"url":"https://bugzilla.redhat.com/1763454","tags":["report"]},{"url":"https://bugzilla.redhat.com/1766774","tags":["report"]},{"url":"https://bugzilla.redhat.com/1768930","tags":["report"]},{"url":"https://bugzilla.redhat.com/1769469","tags":["report"]},{"url":"https://bugzilla.redhat.com/1771990","tags":["report"]},{"url":"https://bugzilla.redhat.com/1774755","tags":["report"]},{"url":"https://bugzilla.redhat.com/1775307","tags":["report"]},{"url":"https://bugzilla.redhat.com/1776112","tags":["report"]},{"url":"https://bugzilla.redhat.com/1779834","tags":["report"]},{"url":"https://bugzilla.redhat.com/1783267","tags":["report"]},{"url":"https://bugzilla.redhat.com/1783268","tags":["report"]},{"url":"https://bugzilla.redhat.com/1783270","tags":["report"]},{"url":"https://bugzilla.redhat.com/1783272","tags":["report"]},{"url":"https://bugzilla.redhat.com/1783274","tags":["report"]},{"url":"https://bugzilla.redhat.com/1784267","tags":["report"]},{"url":"https://bugzilla.redhat.com/1784952","tags":["report"]},{"url":"https://bugzilla.redhat.com/1788539","tags":["report"]},{"url":"https://bugzilla.redhat.com/1792796","tags":["report"]},{"url":"https://bugzilla.redhat.com/1793084","tags":["report"]},{"url":"https://bugzilla.redhat.com/1793598","tags":["report"]},{"url":"https://bugzilla.redhat.com/1796107","tags":["report"]},{"url":"https://bugzilla.redhat.com/1801152","tags":["report"]},{"url":"https://bugzilla.redhat.com/1802907","tags":["report"]},{"url":"https://bugzilla.redhat.com/1803496","tags":["report"]},{"url":"https://bugzilla.redhat.com/1804849","tags":["report"]},{"url":"https://bugzilla.redhat.com/1805017","tags":["report"]},{"url":"https://bugzilla.redhat.com/1805212","tags":["report"]},{"url":"https://bugzilla.redhat.com/1806901","tags":["report"]},{"url":"https://bugzilla.redhat.com/1808707","tags":["report"]},{"url":"https://bugzilla.redhat.com/1810053","tags":["report"]},{"url":"https://bugzilla.redhat.com/1811514","tags":["report"]},{"url":"https://bugzilla.redhat.com/1813295","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2020-1650.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2019-19921","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-1702","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2020-1726","tags":["report"]},{"url":"https://access.redhat.com/errata/RHSA-2023:6380","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-43784","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-41724","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-25809","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-27561","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-28642","tags":["report"]},{"url":"https://bugzilla.redhat.com/2029439","tags":["report"]},{"url":"https://bugzilla.redhat.com/2175721","tags":["report"]},{"url":"https://bugzilla.redhat.com/2178492","tags":["report"]},{"url":"https://bugzilla.redhat.com/2182883","tags":["report"]},{"url":"https://bugzilla.redhat.com/2182884","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2023-6380.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:6938","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-3064","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-41723","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-41725","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-24534","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-24536","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-24537","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-24538","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-24539","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-24540","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-29400","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-29406","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-3978","tags":["report"]},{"url":"https://bugzilla.redhat.com/2163037","tags":["report"]},{"url":"https://bugzilla.redhat.com/2165743","tags":["report"]},{"url":"https://bugzilla.redhat.com/2178358","tags":["report"]},{"url":"https://bugzilla.redhat.com/2178488","tags":["report"]},{"url":"https://bugzilla.redhat.com/2184481","tags":["report"]},{"url":"https://bugzilla.redhat.com/2184482","tags":["report"]},{"url":"https://bugzilla.redhat.com/2184483","tags":["report"]},{"url":"https://bugzilla.redhat.com/2184484","tags":["report"]},{"url":"https://bugzilla.redhat.com/2196026","tags":["report"]},{"url":"https://bugzilla.redhat.com/2196027","tags":["report"]},{"url":"https://bugzilla.redhat.com/2196029","tags":["report"]},{"url":"https://bugzilla.redhat.com/2222167","tags":["report"]},{"url":"https://bugzilla.redhat.com/2228689","tags":["report"]},{"url":"https://bugzilla.redhat.com/2231464","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2023-6938.html","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2023:6939","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-25173","tags":["report"]},{"url":"https://bugzilla.redhat.com/2174485","tags":["report"]},{"url":"https://errata.almalinux.org/8/ALSA-2023-6939.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2019-19921","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2020-0103.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=26173","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/2NWDTSREUDLT3UFYS5SBIVQBS4YRA35A/","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1796107","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_0688.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-19921","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-19921","tags":["advisory","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_0695.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:0942","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_0942.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:1485","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_1485.json","tags":["advisory"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.2_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1703245","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1717357","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1731107","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1732704","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1732713","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1748519","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1749999","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1754744","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1754763","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1755119","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1756919","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1757693","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1757845","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1763454","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1766774","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1768930","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1769469","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1771990","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1774755","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1775307","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1776112","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1779834","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1783267","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1783268","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1783270","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1783272","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1783274","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1784267","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1784952","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1788539","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1792796","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1793084","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1793598","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1801152","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1802907","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1803496","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1804849","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1805017","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1805212","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1806901","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1808707","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1810053","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1811514","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1813295","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_1650.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-1702","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-1702","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-1702","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-1726","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-1726","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-1726","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2020:1650","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20200375-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1160452","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19921","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20200376-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20200944-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1149954","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211458-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1028638","tags":["report"]},{"url":"https://bugzilla.suse.com/1034053","tags":["report"]},{"url":"https://bugzilla.suse.com/1048046","tags":["report"]},{"url":"https://bugzilla.suse.com/1051429","tags":["report"]},{"url":"https://bugzilla.suse.com/1053532","tags":["report"]},{"url":"https://bugzilla.suse.com/1095817","tags":["report"]},{"url":"https://bugzilla.suse.com/1118897","tags":["report"]},{"url":"https://bugzilla.suse.com/1118898","tags":["report"]},{"url":"https://bugzilla.suse.com/1118899","tags":["report"]},{"url":"https://bugzilla.suse.com/1121967","tags":["report"]},{"url":"https://bugzilla.suse.com/1131314","tags":["report"]},{"url":"https://bugzilla.suse.com/1131553","tags":["report"]},{"url":"https://bugzilla.suse.com/1152308","tags":["report"]},{"url":"https://bugzilla.suse.com/1168481","tags":["report"]},{"url":"https://bugzilla.suse.com/1175081","tags":["report"]},{"url":"https://bugzilla.suse.com/1175821","tags":["report"]},{"url":"https://bugzilla.suse.com/1181594","tags":["report"]},{"url":"https://bugzilla.suse.com/1181641","tags":["report"]},{"url":"https://bugzilla.suse.com/1181677","tags":["report"]},{"url":"https://bugzilla.suse.com/1181730","tags":["report"]},{"url":"https://bugzilla.suse.com/1181732","tags":["report"]},{"url":"https://bugzilla.suse.com/1181749","tags":["report"]},{"url":"https://bugzilla.suse.com/1182451","tags":["report"]},{"url":"https://bugzilla.suse.com/1182476","tags":["report"]},{"url":"https://bugzilla.suse.com/1182947","tags":["report"]},{"url":"https://bugzilla.suse.com/1183024","tags":["report"]},{"url":"https://bugzilla.suse.com/1183397","tags":["report"]},{"url":"https://bugzilla.suse.com/1183855","tags":["report"]},{"url":"https://bugzilla.suse.com/1184768","tags":["report"]},{"url":"https://bugzilla.suse.com/1184962","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16873","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16874","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16875","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-16884","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5736","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21284","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21285","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-21334","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2019-19921","tags":["report"]},{"url":"https://gist.github.com/LiveOverflow/c937820b688922eb127fb760ce06dab9","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4297-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-6088-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2019-16884","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-43784","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-29162","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-25809","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-27561","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-28642","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3HVIKLZGRTAEX4OALOIIAPGKXT3EJBHA/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9962","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-30465","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2019-19921","description":"runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. (This vulnerability does not affect Docker due to an implementation detail that happens to block the attack.)","status":"published","published":"2020-02-12T00:00:00Z","modified":"2024-08-05T02:32:09.419Z","updated_at":"2026-11-02T14:20:20.74896Z"}],"euvd":[{"id":"EUVD-2021-1060","description":"runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. (This vulnerability does not affect Docker due to an implementation detail that happens to block the attack.)","status":"published","published":"2020-02-12T00:00:00Z","modified":"2024-08-05T02:32:09Z","updated_at":"2026-11-03T02:40:23.78072Z"}],"ghsa":[{"id":"GHSA-fh74-hm69-rqjw","title":"opencontainers runc contains procfs race condition with a shared volume mount","description":"### Impact\nBy crafting a malicious root filesystem (with `/proc` being a symlink to a directory which was inside a volume shared with another running container), an attacker in control of both containers can trick `runc` into not correctly configuring the container's security labels and not correctly masking paths inside `/proc` which contain potentially-sensitive information about the host (or even allow for direct attacks against the host).\n\nIn order to exploit this bug, an untrusted user must be able to spawn custom containers with custom mount configurations (such that a volume is shared between two containers). It should be noted that we consider this to be a fairly high level of access for an untrusted user -- and we do not recommend allowing completely untrusted users to have such degrees of access without further restrictions.\n\n### Specific Go Package Affected\ngithub.com/opencontainers/runc/libcontainer\n\n### Patches\nThis vulnerability has been fixed in `1.0.0-rc10`. It should be noted that the current fix is effectively a hot-fix, and there are known ways for it to be worked around (such as making the entire root filesystem a shared volume controlled by another container). We recommend that users review their access policies to ensure that untrusted users do not have such high levels of controls over container mount configuration.\n\n### Workarounds\nIf you are not providing the ability for untrusted users to configure mountpoints for `runc` (or through a higher-level tool such as `docker run -v`) then you are not vulnerable to this issue. This exploit requires fairly complicated levels of access (which are available for some public clouds but are not necessarily available for all deployments).\n\nAdditionally, it appears as though it is not possible to exploit this vulnerability through Docker (due to the order of mounts Docker generates). However you should not depend on this, as it may be possible to work around this roadblock.\n\n### Credits\nThis vulnerability was discovered by Cure53, as part of a third-party security audit.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* [Open an issue](https://github.com/opencontainers/runc/issues/new).\n* Email us at [dev@opencontainers.org](mailto:dev@opencontainers.org), or [security@opencontainers.org](mailto:security@opencontainers.org) if you think you've found a security bug.","status":"published","published":"2021-05-27T18:41:17Z","modified":"2026-10-08T11:04:27Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:U/RC:U","level":"medium"}],"cwes":["CWE-362","CWE-706"],"updated_at":"2026-11-02T14:41:29.107536Z"}],"nvd":[{"id":"CVE-2019-19921","description":"runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. (This vulnerability does not affect Docker due to an implementation detail that happens to block the attack.)","status":"published","published":"2020-02-12T15:15:12.21Z","modified":"2026-06-17T02:27:27.39Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":4.4,"vector":"AV:L/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-706"],"updated_at":"2026-11-02T14:05:43.875329Z"}],"osv":[{"id":"ALPINE-CVE-2019-19921","description":"runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. (This vulnerability does not affect Docker due to an implementation detail that happens to block the attack.)","status":"published","published":"2020-02-12T15:15:12.21Z","modified":"2026-11-03T06:31:56.56982047Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:18:15.355745Z"},{"id":"BELL-CVE-2019-19921","title":"CVE-2019-19921 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:16:23.72792Z","modified":"2026-01-26T09:46:37.515264Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:15.340685Z"},{"id":"CVE-2019-19921","description":"runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. (This vulnerability does not affect Docker due to an implementation detail that happens to block the attack.)","status":"published","published":"2020-02-12T15:15:12.21Z","modified":"2026-10-20T10:50:52.290625554Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:12.010761Z"},{"id":"DEBIAN-CVE-2019-19921","description":"runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. (This vulnerability does not affect Docker due to an implementation detail that happens to block the attack.)","status":"published","published":"2020-02-12T15:15:12.21Z","modified":"2026-09-21T07:03:16.799825127Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:32.221385Z"},{"id":"GHSA-fh74-hm69-rqjw","title":"opencontainers runc contains procfs race condition with a shared volume mount","description":"### Impact\nBy crafting a malicious root filesystem (with `/proc` being a symlink to a directory which was inside a volume shared with another running container), an attacker in control of both containers can trick `runc` into not correctly configuring the container's security labels and not correctly masking paths inside `/proc` which contain potentially-sensitive information about the host (or even allow for direct attacks against the host).\n\nIn order to exploit this bug, an untrusted user must be able to spawn custom containers with custom mount configurations (such that a volume is shared between two containers). It should be noted that we consider this to be a fairly high level of access for an untrusted user -- and we do not recommend allowing completely untrusted users to have such degrees of access without further restrictions.\n\n### Specific Go Package Affected\ngithub.com/opencontainers/runc/libcontainer\n\n### Patches\nThis vulnerability has been fixed in `1.0.0-rc10`. It should be noted that the current fix is effectively a hot-fix, and there are known ways for it to be worked around (such as making the entire root filesystem a shared volume controlled by another container). We recommend that users review their access policies to ensure that untrusted users do not have such high levels of controls over container mount configuration.\n\n### Workarounds\nIf you are not providing the ability for untrusted users to configure mountpoints for `runc` (or through a higher-level tool such as `docker run -v`) then you are not vulnerable to this issue. This exploit requires fairly complicated levels of access (which are available for some public clouds but are not necessarily available for all deployments).\n\nAdditionally, it appears as though it is not possible to exploit this vulnerability through Docker (due to the order of mounts Docker generates). However you should not depend on this, as it may be possible to work around this roadblock.\n\n### Credits\nThis vulnerability was discovered by Cure53, as part of a third-party security audit.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* [Open an issue](https://github.com/opencontainers/runc/issues/new).\n* Email us at [dev@opencontainers.org](mailto:dev@opencontainers.org), or [security@opencontainers.org](mailto:security@opencontainers.org) if you think you've found a security bug.","status":"published","published":"2021-05-27T18:41:17Z","modified":"2026-09-10T03:49:14.632691018Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:U/RC:U","level":"medium"}],"cwes":["CWE-362","CWE-706"],"updated_at":"2026-11-02T15:46:46.39441Z"},{"id":"RHSA-2020:0688","title":"Red Hat Security Advisory: OpenShift Container Platform 4.2.22 runc security update","status":"published","published":"2024-09-13T16:16:52Z","modified":"2026-06-27T10:09:11Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"RHSA-2020:0695","title":"Red Hat Security Advisory: OpenShift Container Platform 4.1.38 security update","status":"published","published":"2024-09-13T16:17:00Z","modified":"2026-06-27T10:09:11Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"RHSA-2020:0942","title":"Red Hat Security Advisory: runc security update","status":"published","published":"2024-09-13T16:16:32Z","modified":"2026-06-27T10:09:20Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:06.535721Z"},{"id":"RHSA-2020:1485","title":"Red Hat Security Advisory: OpenShift Container Platform 4.3.13 runc security update","status":"published","published":"2024-09-13T16:17:38Z","modified":"2026-06-27T10:09:50Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"RHSA-2020:1650","title":"Red Hat Security Advisory: container-tools:rhel8 security, bug fix, and enhancement update","status":"published","published":"2024-09-16T03:17:28Z","modified":"2026-06-27T10:09:55Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"RLSA-2020:1650","title":"Moderate: container-tools:rhel8 security, bug fix, and enhancement update","description":"The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.\n\nSecurity Fix(es):\n\n* runc: volume mount race condition with shared mounts leads to information leak/integrity manipulation (CVE-2019-19921)\n\n* containers/image: Container images read entire image manifest into memory (CVE-2020-1702)\n\n* podman: incorrectly allows existing files in volumes to be overwritten by a container when it is created (CVE-2020-1726)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.2 Release Notes linked from the References section.","status":"published","published":"2020-04-28T09:01:00Z","modified":"2026-02-05T06:45:12.461277Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2019-19921","description":"runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. (This vulnerability does not affect Docker due to an implementation detail that happens to block the attack.)","status":"published","published":"2020-02-12T15:15:00Z","modified":"2026-02-04T03:11:55.510941Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:21.213407Z"},{"id":"ALSA-2020:1650","title":"Moderate: container-tools:rhel8 security, bug fix, and enhancement update","description":"The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.\n\nSecurity Fix(es):\n\n* runc: volume mount race condition with shared mounts leads to information leak/integrity manipulation (CVE-2019-19921)\n\n* containers/image: Container images read entire image manifest into memory (CVE-2020-1702)\n\n* podman: incorrectly allows existing files in volumes to be overwritten by a container when it is created (CVE-2020-1726)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2020-04-28T09:01:00Z","modified":"2026-10-31T08:30:02.607442098Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"ALSA-2023:6380","title":"Moderate: runc security update","description":"The runC tool is a lightweight, portable implementation of the Open Container Format (OCF) that provides container runtime.\n\nSecurity Fix(es):\n\n* golang: crypto/tls: large handshake records may cause panics (CVE-2022-41724)\n* runc: Rootless runc makes `/sys/fs/cgroup` writable (CVE-2023-25809)\n* runc: volume mount race condition (regression of CVE-2019-19921) (CVE-2023-27561)\n* runc: AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount configuration (CVE-2023-28642)\n* runc: integer overflow in netlink bytemsg length field allows attacker to override netlink-based container configuration (CVE-2021-43784)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2023-11-07T00:00:00Z","modified":"2026-10-29T11:31:32.183912903Z","updated_at":"2026-11-02T15:27:52.091404Z"},{"id":"ALSA-2023:6938","title":"Moderate: container-tools:4.0 security and bug fix update","description":"The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.\n\nSecurity Fix(es):\n\n* go-yaml: Improve heuristics preventing CPU/memory abuse by parsing malicious or large YAML documents (CVE-2022-3064)\n* golang: html/template: improper handling of JavaScript whitespace (CVE-2023-24540)\n* net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding (CVE-2022-41723)\n* golang: crypto/tls: large handshake records may cause panics (CVE-2022-41724)\n* golang: net/http, mime/multipart: denial of service from excessive resource consumption (CVE-2022-41725)\n* golang.org/x/net/html: Cross site scripting (CVE-2023-3978)\n* golang: net/http, net/textproto: denial of service from excessive memory allocation (CVE-2023-24534)\n* golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption (CVE-2023-24536)\n* golang: go/parser: Infinite loop in parsing (CVE-2023-24537)\n* golang: html/template: backticks not treated as string delimiters (CVE-2023-24538)\n* golang: html/template: improper sanitization of CSS values (CVE-2023-24539)\n* runc: Rootless runc makes `/sys/fs/cgroup` writable (CVE-2023-25809)\n* runc: volume mount race condition (regression of CVE-2019-19921) (CVE-2023-27561)\n* runc: AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount configuration (CVE-2023-28642)\n* golang: html/template: improper handling of empty HTML attributes (CVE-2023-29400)\n* golang: net/http: insufficient sanitization of Host header (CVE-2023-29406)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2023-11-14T00:00:00Z","modified":"2026-10-29T11:02:20.013744235Z","updated_at":"2026-11-02T15:27:52.091404Z"},{"id":"ALSA-2023:6939","title":"Moderate: container-tools:rhel8 security and bug fix update","description":"The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.\n\nSecurity Fix(es):\n\n* go-yaml: Improve heuristics preventing CPU/memory abuse by parsing malicious or large YAML documents (CVE-2022-3064)\n* golang: html/template: improper handling of JavaScript whitespace (CVE-2023-24540)\n* net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding (CVE-2022-41723)\n* golang: crypto/tls: large handshake records may cause panics (CVE-2022-41724)\n* golang: net/http, mime/multipart: denial of service from excessive resource consumption (CVE-2022-41725)\n* golang.org/x/net/html: Cross site scripting (CVE-2023-3978)\n* golang: net/http, net/textproto: denial of service from excessive memory allocation (CVE-2023-24534)\n* golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption (CVE-2023-24536)\n* golang: go/parser: Infinite loop in parsing (CVE-2023-24537)\n* golang: html/template: backticks not treated as string delimiters (CVE-2023-24538)\n* golang: html/template: improper sanitization of CSS values (CVE-2023-24539)\n* containerd: Supplementary groups are not set up properly (CVE-2023-25173)\n* runc: Rootless runc makes `/sys/fs/cgroup` writable (CVE-2023-25809)\n* runc: volume mount race condition (regression of CVE-2019-19921) (CVE-2023-27561)\n* runc: AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount configuration (CVE-2023-28642)\n* golang: html/template: improper handling of empty HTML attributes (CVE-2023-29400)\n* golang: net/http: insufficient sanitization of Host header (CVE-2023-29406)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2023-11-14T00:00:00Z","modified":"2026-10-29T11:02:20.02956464Z","updated_at":"2026-11-02T15:27:52.091404Z"},{"id":"DLA-3369-1","title":"runc - security update","status":"published","published":"2023-03-27T00:00:00Z","modified":"2026-03-09T01:18:39.384079Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"GO-2021-0087","title":"Race condition in github.com/opencontainers/runc","description":"A race while mounting volumes allows a possible symlink-exchange attack, allowing a user whom can start multiple containers with custom volume mount configurations to escape the container.","status":"published","published":"2021-04-14T20:04:52Z","modified":"2026-02-04T03:07:02.484214Z","updated_at":"2026-11-02T15:47:00.604718Z"},{"id":"MGASA-2020-0103","title":"Updated opencontainers-runc packages fix security vulnerability","description":"Updated opencontainers-runc package fixes security vulnerability:\n\nAn attacker who controls the container image for two containers that\nshare a volume can race volume mounts during container initialization,\nby adding a symlink to the rootfs that points to a directory on the\nvolume (CVE-2019-19921).\n","status":"published","published":"2020-02-26T10:21:01Z","modified":"2026-04-16T04:44:48.188902196Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"openSUSE-SU-2020:0219-1","title":"Security update for docker-runc","description":"This update for docker-runc fixes the following issues:\n\n- CVE-2019-19921: Fixed a volume mount race condition with shared mounts (bsc#1160452).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2020-02-13T19:13:24Z","modified":"2026-02-04T04:11:34.134097Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2024:11358-1","title":"runc-1.0.2-1.2 on GA media","description":"These are all security issues fixed in the runc-1.0.2-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:01:48.763706Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2020:0375-1","title":"Security update for docker-runc","description":"This update for docker-runc fixes the following issues:\n\n- CVE-2019-19921: Fixed a volume mount race condition with shared mounts (bsc#1160452).\n","status":"published","published":"2020-02-07T16:30:28Z","modified":"2026-02-04T04:26:19.057488Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"SUSE-SU-2020:0376-1","title":"Security update for docker-runc","description":"This update for docker-runc fixes the following issues:\n\n- CVE-2019-19921: Fixed a volume mount race condition with shared mounts (bsc#1160452).\n","status":"published","published":"2020-02-07T16:31:38Z","modified":"2025-05-02T04:09:09.27959Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"SUSE-SU-2020:0944-1","title":"Security update for runc","description":"This update for runc fixes the following issues:\n\nrunc was updated to v1.0.0~rc10\n\n- CVE-2019-19921: Fixed a mount race condition with shared mounts (bsc#1160452).\n- Fixed an issue where podman run hangs when spawned by salt-minion process (bsc#1149954).\t  \n","status":"published","published":"2020-04-07T13:49:38Z","modified":"2026-02-04T04:24:25.107533Z","updated_at":"2026-11-02T15:53:47.634847Z"},{"id":"SUSE-SU-2021:1458-1","title":"Security update for containerd, docker, runc","description":"This update for containerd, docker, runc fixes the following issues:\n\n- Docker was updated to 20.10.6-ce\n  *  Switch version to use -ce suffix rather than _ce to avoid confusing other\n     tools (bsc#1182476).\n  * CVE-2021-21284: Fixed a potential privilege escalation when the root user in \n    the remapped namespace has access to the host filesystem (bsc#1181732)\n  * CVE-2021-21285: Fixed an issue where pulling a malformed Docker image manifest \n    crashes the dockerd daemon (bsc#1181730). \n\n- runc was updated to  v1.0.0~rc93 (bsc#1182451 and bsc#1184962).\n  * Use the upstream runc package (bsc#1181641, bsc#1181677, bsc#1175821).\n  * Fixed /dev/null is not available (bsc#1168481).\n  * Fixed an issue where podman hangs when spawned by salt-minion process (bsc#1149954).\n  * CVE-2019-19921: Fixed a race condition with shared mounts (bsc#1160452).\n  * CVE-2019-16884: Fixed an LSM bypass via malicious Docker image that mount \n    over a /proc directory (bsc#1152308).\n  * CVE-2019-5736: Fixed potential write attacks to the host runc binary (bsc#1121967).\n  * Fixed an issue where after a kernel-update docker doesn't run (bsc#1131314 bsc#1131553)\n  * Ensure that we always include the version information in runc (bsc#1053532).\n  \n- Switch to Go 1.13 for build.\n  * CVE-2018-16873: Fixed a potential remote code execution (bsc#1118897).\n  * CVE-2018-16874: Fixed a directory traversal in 'go get' via curly braces \n    in import paths (bsc#1118898).\n  * CVE-2018-16875: Fixed a CPU denial of service (bsc#1118899).\n  * Fixed an issue with building containers (bsc#1095817).\n\n- containerd was updated to v1.4.4\n  * CVE-2021-21334: Fixed a potential information leak through environment variables (bsc#1183397).\n  * Handle a requirement from docker (bsc#1181594).\n  * Install the containerd-shim* binaries and stop creating (bsc#1183024).\n  * update version to the one required by docker (bsc#1034053)\n\n- Use -buildmode=pie for tests and binary build (bsc#1048046, bsc#1051429)\n- Cleanup seccomp builds similar (bsc#1028638).\n- Update to handle the docker-runc removal, and drop the -kubic flavour (bsc#1181677, bsc#1181749)\n","status":"published","published":"2021-04-30T10:58:51Z","modified":"2026-02-04T02:16:12.876879Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"USN-4297-1","title":"runc vulnerabilities","description":"It was discovered that runC incorrectly checked mount targets. An attacker\nwith a malicious container image could possibly mount over the /proc\ndirectory and escalate privileges. This issue only affected Ubuntu 18.04\nLTS. (CVE-2019-16884)\n\nIt was discovered that runC incorrectly performed access control. An\nattacker could possibly use this issue to escalate privileges.\n(CVE-2019-19921)\n","status":"published","published":"2020-03-09T15:21:21Z","modified":"2026-02-10T04:41:47Z","updated_at":"2026-11-02T16:58:14.547547Z"},{"id":"USN-6088-2","title":"runc vulnerabilities","description":"USN-6088-1 fixed vulnerabilities in runC. This update provides\nthe corresponding updates for Ubuntu 16.04 LTS.\n\nIt was discovered that runC incorrectly performed access control when\nmounting /proc to non-directories. An attacker could possibly use\nthis issue to escalate privileges.\n(CVE-2019-19921)\n\nFelix Wilhelm discovered that runC incorrecly handled netlink \nmessages. An attacker could possibly use\nthis issue to escalate privileges. (CVE-2021-43784)\n\nAndrew G. Morgan discovered that runC incorrectly set\ninherited process capabilities inside the container.\nAn attacker could possibly use this issue to\nescalate privileges. (CVE-2022-29162)\n\nOriginal advisory details:\n\n It was discovered that runC incorrectly made /sys/fs/cgroup\n writable when in rootless mode. An attacker could possibly\n use this issue to escalate privileges. (CVE-2023-25809)\n \n It was discovered that runC incorrectly performed access control when\n mounting /proc to non-directories. An attacker could possibly use\n this issue to escalate privileges. (CVE-2023-27561)\n \n It was discovered that runC incorrectly handled /proc and \n /sys mounts inside a container. An attacker could possibly\n use this issue to bypass AppArmor, and potentially SELinux.\n (CVE-2023-28642)\n","status":"published","published":"2023-05-23T14:07:29Z","modified":"2026-06-25T13:32:04.23949437Z","updated_at":"2026-11-02T16:58:16.738762Z"}]}}