CVE-2021-3101

Опубликовано: 19 апр. 2022

Источник: nvd

CVSS3: 8.8

CVSS2: 7.2

EPSS Низкий

Описание

Hotdog, prior to v1.0.1, did not mimic the capabilities or the SELinux label of the target JVM process. This would allow a container to gain full privileges on the host, bypassing restrictions set on the container.

Ссылки

https://github.com/bottlerocket-os/hotdog/security/advisories/GHSA-qfhv-c5cc-mhgp
Third Party Advisory
https://unit42.paloaltonetworks.com/aws-log4shell-hot-patch-vulnerabilities
Exploit
Patch
Third Party Advisory
https://github.com/bottlerocket-os/hotdog/security/advisories/GHSA-qfhv-c5cc-mhgp
Third Party Advisory
https://unit42.paloaltonetworks.com/aws-log4shell-hot-patch-vulnerabilities
Exploit
Patch
Third Party Advisory

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:hotdog_project:hotdog:*:*:*:*:*:java:*:*

Версия до 1.0.1 (исключая)

EPSS

Процентиль: 12%

0.0004

Низкий

8.8 High

CVSS3

7.2 High

CVSS2

Дефекты

CWE-250

CWE-269

Связанные уязвимости

BDU:2022-04342