Command Injection Affecting github.com/opencontainers/runc/libcontainer package, versions *
Snyk CVSS
Attack Complexity
Low
Privileges Required
High
Confidentiality
High
Integrity
High
Availability
High
Threat Intelligence
EPSS
0.04% (10th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-GOLANG-GITHUBCOMOPENCONTAINERSRUNCLIBCONTAINER-6672882
- published 24 Apr 2024
- disclosed 22 Apr 2024
- credit Akihiro Suda, Cédric Clerget
Introduced: 22 Apr 2024
New CVE-2024-3154 Open this link in a new tabHow to fix?
A fix was pushed into the master
branch but not yet published.
Overview
github.com/opencontainers/runc/libcontainer is a package for a modern container runtime.
Affected versions of this package are vulnerable to Command Injection via a Pod annotation. Any user who can create a pod with an arbitrary annotation may perform an arbitrary action on the host system.