runc-1.0.0-69.rc10.el7

エラータID: AXSA:2021-1760:01

Release date: 
Tuesday, June 1, 2021 - 03:17
Subject: 
runc-1.0.0-69.rc10.el7
Affected Channels: 
Asianux Server 7 for x86_64
Severity: 
High
Description: 

The runC tool is a lightweight, portable implementation of the Open Container
Format (OCF) that provides container runtime.

Security Fix(es):

* runc: vulnerable to symlink exchange attack (CVE-2021-30465)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s)
listed in the References section.

CVE-2021-30465
runc before 1.0.0-rc95 allows a Container Filesystem Breakout via Directory
Traversal. To exploit the vulnerability, an attacker must be able to create
multiple containers with a fairly specific mount configuration. The problem
occurs via a symlink-exchange attack that relies on a race condition.

Solution: 

Update packages.

CVEs: 
CVE-2021-30465
runc before 1.0.0-rc95 allows a Container Filesystem Breakout via Directory Traversal. To exploit the vulnerability, an attacker must be able to create multiple containers with a fairly specific mount configuration. The problem occurs via a symlink-exchange attack that relies on a race condition.
Additional Info: 

N/A

Download: 

SRPMS
  1. runc-1.0.0-69.rc10.el7.src.rpm
    MD5: 36c7c17188c56fb3c66ed5f79d086252
    SHA-256: 48a4dfa22f81d5937290d4094aeb79d31f0fffa972a10b6630114402421bc1b7
    Size: 1.80 MB

Asianux Server 7 for x86_64
  1. runc-1.0.0-69.rc10.el7.x86_64.rpm
    MD5: 729f8db96b064ba42c514dadbda487b6
    SHA-256: e492edc074a0285bcc100b99b8eb55f5586c8f8afbbdbcd15ca0b1de598011b7
    Size: 2.67 MB