CVE-2022-27649

Опубликовано: 04 апр. 2022

Источник: nvd

CVSS3: 7.5

CVSS2: 6

EPSS Низкий

Описание

A flaw was found in Podman, where containers were started incorrectly with non-empty default permissions. A vulnerability was found in Moby (Docker Engine), where containers were started incorrectly with non-empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs.

Ссылки

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:podman_project:podman:*:*:*:*:*:*:*:*

Версия до 4.0.3 (исключая)

Конфигурация 2

Одно из

cpe:2.3:a:redhat:developer_tools:1.0:*:*:*:*:*:*:*

cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:8.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_eus:8.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.4:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.4:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_aus:8.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.4:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_tus:8.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:8.4:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:8.6:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*

EPSS

Процентиль: 68%

0.00569

Низкий

7.5 High

CVSS3

6 Medium

CVSS2

Дефекты

CWE-276

Связанные уязвимости

CVE-2022-27649

CVSS3: 7.5

ubuntu

около 3 лет назад

CVE-2022-27649

CVSS3: 5

redhat

около 3 лет назад

CVE-2022-27649

CVSS3: 7.5

msrc

около 3 лет назад

Описание отсутствует

CVE-2022-27649

CVSS3: 7.5

debian

около 3 лет назад

A flaw was found in Podman, where containers were started incorrectly ...

GHSA-qvf8-p83w-v58j

CVSS3: 7.5

github

около 3 лет назад

Podman's default inheritable capabilities for linux container not empty

EPSS

Процентиль: 68%

0.00569

Низкий

7.5 High

CVSS3

6 Medium

CVSS2

Дефекты

CWE-276