[Bug 1219065] CVE-2015-3631 docker: volume mounts allow LSM profile escalation
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1219065
Vincent Danen <vdanen(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=moderate,public=2015 |impact=moderate,public=2015
|0507,reported=20150501,sour |0507,reported=20150501,sour
|ce=upstream,cvss2=4.3/AV:N/ |ce=upstream,cvss2=4.3/AV:N/
|AC:M/Au:N/C:N/I:P/A:N,rhel- |AC:M/Au:N/C:N/I:P/A:N,rhel-
|7/docker=affected,fedora-al |7/docker=notaffected,fedora
|l/docker-io=affected |-all/docker-io=affected
--
You are receiving this mail because:
You are on the CC list for the bug.
8 years, 7 months
[Bug 1219063] CVE-2015-3630 docker: Read/write proc paths allow host modification & information disclosure
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1219063
Vincent Danen <vdanen(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=moderate,public=2015 |impact=moderate,public=2015
|0507,reported=20150501,sour |0507,reported=20150501,sour
|ce=upstream,cvss2=5.8/AV:N/ |ce=upstream,cvss2=5.8/AV:N/
|AC:M/Au:N/C:P/I:P/A:N,rhel- |AC:M/Au:N/C:P/I:P/A:N,rhel-
|7/docker=affected,fedora-al |7/docker=notaffected,fedora
|l/docker-io=affected |-all/docker-io=affected
--
You are receiving this mail because:
You are on the CC list for the bug.
8 years, 7 months
[Bug 1219061] CVE-2015-3627 docker: insecure opening of file-descriptor 1 leading to privilege escalation
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1219061
Vincent Danen <vdanen(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=moderate,public=2015 |impact=moderate,public=2015
|0507,reported=20150501,sour |0507,reported=20150501,sour
|ce=upstream,cvss2=4.3/AV:N/ |ce=upstream,cvss2=4.3/AV:N/
|AC:M/Au:N/C:N/I:P/A:N,cwe=C |AC:M/Au:N/C:N/I:P/A:N,cwe=C
|WE-22,rhel-7/docker=affecte |WE-22,rhel-7/docker=notaffe
|d,fedora-all/docker-io=affe |cted,fedora-all/docker-io=a
|cted |ffected
--
You are receiving this mail because:
You are on the CC list for the bug.
8 years, 7 months
[Bug 1219058] CVE-2015-3629 docker: symlink traversal on container respawn allows local privilege escalation
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1219058
Vincent Danen <vdanen(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=moderate,public=2015 |impact=moderate,public=2015
|0507,reported=20150501,sour |0507,reported=20150501,sour
|ce=upstream,cvss2=4.3/AV:N/ |ce=upstream,cvss2=4.3/AV:N/
|AC:M/Au:N/C:N/I:P/A:N,cwe=C |AC:M/Au:N/C:N/I:P/A:N,cwe=C
|WE-22,rhel-7/docker=affecte |WE-22,rhel-7/docker=notaffe
|d,fedora-all/docker-io=affe |cted,fedora-all/docker-io=a
|cted |ffected
--
You are receiving this mail because:
You are on the CC list for the bug.
8 years, 7 months
[Bug 1172782] CVE-2014-9357 docker: Escalation of privileges during decompression of LZMA archives
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1172782
Vincent Danen <vdanen(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=low,public=20141211, |impact=low,public=20141211,
|reported=20141205,source=up |reported=20141205,source=up
|stream,cvss2=4.6/AV:A/AC:H/ |stream,cvss2=4.6/AV:A/AC:H/
|Au:N/C:N/I:C/A:N,rhel-7/doc |Au:N/C:N/I:C/A:N,rhel-7/doc
|ker=affected,fedora-all/doc |ker=notaffected,fedora-all/
|ker-io=affected |docker-io=affected
--
You are receiving this mail because:
You are on the CC list for the bug.
8 years, 7 months
[Bug 1111687] CVE-2014-3499 docker: systemd socket activation results in privilege escalation
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1111687
Vincent Danen <vdanen(a)redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Whiteboard|impact=important,public=201 |impact=important,public=201
|40701,reported=20140620,sou |40701,reported=20140620,sou
|rce=researcher,cvss2=7.2/AV |rce=researcher,cvss2=7.2/AV
|:L/AC:L/Au:N/C:C/I:C/A:C,fe |:L/AC:L/Au:N/C:C/I:C/A:C,fe
|dora-all/docker-io=affected |dora-all/docker-io=affected
|,epel-6/docker-io=notaffect |,epel-6/docker-io=notaffect
|ed,rhel-7/docker=affected,e |ed,rhel-7/docker=notaffecte
|pel-7/docker-io=affected,cw |d,epel-7/docker-io=affected
|e=CWE-732->CWE-266 |,cwe=CWE-732->CWE-266
--
You are receiving this mail because:
You are on the CC list for the bug.
8 years, 7 months
[Bug 1271253] New: CVE-2014-8178 Attacker controlled layer IDs lead to local graph content poisoning
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1271253
Bug ID: 1271253
Summary: CVE-2014-8178 Attacker controlled layer IDs lead to
local graph content poisoning
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: low
Priority: low
Assignee: security-response-team(a)redhat.com
Reporter: tjay(a)redhat.com
CC: adimania(a)gmail.com, admiller(a)redhat.com,
dwalsh(a)redhat.com, golang(a)lists.fedoraproject.org,
hushan.jia(a)gmail.com, ichavero(a)redhat.com,
jchaloup(a)redhat.com, jperrin(a)centos.org,
lsm5(a)redhat.com, mgoldman(a)redhat.com,
miminar(a)redhat.com, s(a)shk.io, thrcka(a)redhat.com,
vbatts(a)redhat.com, wolfy(a)nobugconsulting.ro
Docker image layers are stored with a non-globally unique identifier vulnerable
to a collision attack. These identifiers are shared during docker pull and
push, allowing poisoning of a host's image cache. This allows maliciously
crafted images to poison subsequently pulled images.
Independently discovered by Florian Weimer of Red Hat and Tõnis Tiigi of the
Docker Engine Tem.
--
You are receiving this mail because:
You are on the CC list for the bug.
8 years, 7 months
[Bug 1271256] New: CVE-2014-8179 Manifest validation and parsing logic errors allow pull-by-digest validation bypass
by Red Hat Bugzilla
https://bugzilla.redhat.com/show_bug.cgi?id=1271256
Bug ID: 1271256
Summary: CVE-2014-8179 Manifest validation and parsing logic
errors allow pull-by-digest validation bypass
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: low
Priority: low
Assignee: security-response-team(a)redhat.com
Reporter: tjay(a)redhat.com
CC: adimania(a)gmail.com, admiller(a)redhat.com,
dwalsh(a)redhat.com, golang(a)lists.fedoraproject.org,
hushan.jia(a)gmail.com, ichavero(a)redhat.com,
jchaloup(a)redhat.com, jperrin(a)centos.org,
lsm5(a)redhat.com, mgoldman(a)redhat.com,
miminar(a)redhat.com, s(a)shk.io, thrcka(a)redhat.com,
vbatts(a)redhat.com, wolfy(a)nobugconsulting.ro
During Docker pulls validation and extraction of the manifest object from its
JSON representation are done in separate steps. The digest that represents the
manifest corresponds to a hash of the payload portion of the JSON blob returned
by the remote registry. Even though the validity of the payload portion is
being verified, an injection of new attributes in the surrounding JSON object
is possible. This allows an override of the verified content at JSON
deserialization time leading to pulling unverified layers.
--
You are receiving this mail because:
You are on the CC list for the bug.
8 years, 7 months
Broken dependencies: golang-github-prometheus-prometheus
by Fedora Koji Build System
golang-github-prometheus-prometheus has broken dependencies in the rawhide tree:
On x86_64:
golang-github-prometheus-prometheus-devel-0.15.0-1.fc24.noarch requires golang(gopkg.in/fsnotify.v1)
On i386:
golang-github-prometheus-prometheus-devel-0.15.0-1.fc24.noarch requires golang(gopkg.in/fsnotify.v1)
On armhfp:
golang-github-prometheus-prometheus-devel-0.15.0-1.fc24.noarch requires golang(gopkg.in/fsnotify.v1)
Please resolve this as soon as possible.
8 years, 7 months