CVE-2022-27649

Опубликовано: 04 апр. 2022

Источник: nvd

CVSS3: 7.5

CVSS2: 6

EPSS Низкий

Описание

A flaw was found in Podman, where containers were started incorrectly with non-empty default permissions. A vulnerability was found in Moby (Docker Engine), where containers were started incorrectly with non-empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs.

Ссылки

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:podman_project:podman:*:*:*:*:*:*:*:*

Версия до 4.0.3 (исключая)

Конфигурация 2

Одно из

cpe:2.3:a:redhat:developer_tools:1.0:*:*:*:*:*:*:*

cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux:8.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_eus:8.4:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_eus:8.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems:8.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.4:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_for_ibm_z_systems_eus:8.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian:8.0:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_for_power_little_endian_eus:8.4:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_aus:8.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.4:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_for_power_little_endian_update_services_for_sap_solutions:8.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_tus:8.6:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:8.4:*:*:*:*:*:*:*

cpe:2.3:o:redhat:enterprise_linux_server_update_services_for_sap_solutions:8.6:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*

EPSS

Процентиль: 68%

0.00583

Низкий

7.5 High

CVSS3

6 Medium

CVSS2

Дефекты

CWE-276

Связанные уязвимости

CVE-2022-27649

CVSS3: 7.5

ubuntu

почти 4 года назад

CVE-2022-27649

CVSS3: 5

redhat

почти 4 года назад

CVE-2022-27649

CVSS3: 7.5

msrc

почти 4 года назад

Описание отсутствует

CVE-2022-27649

CVSS3: 7.5

debian

почти 4 года назад

A flaw was found in Podman, where containers were started incorrectly ...

GHSA-qvf8-p83w-v58j

CVSS3: 7.5

github

почти 4 года назад

Podman's default inheritable capabilities for linux container not empty

EPSS

Процентиль: 68%

0.00583

Низкий

7.5 High

CVSS3

6 Medium

CVSS2

Дефекты

CWE-276