gitea-mirror/trivy
1
0
Fork 0
mirror of https://github.com/aquasecurity/trivy.git synced 2025-12-12 15:50:15 -08:00
Code Issues Packages Projects Releases Wiki Activity
Files
aca31dffb36328d17f6d3a3bd1184cfcd36ffc07
trivy/integration/testdata/ubuntu-1804.json.golden
Teppei Fukuda aca31dffb3 detector: Add LayerID to detect vulns (#419) 
* detector/alpine: Add LayerID to detect vulns

Signed-off-by: Simarpreet Singh <simar@linux.com>

* amazon: Add LayerID to DetectedVulns

Signed-off-by: Simarpreet Singh <simar@linux.com>

* debian: Add LayerID to DetectVulns + tests

Signed-off-by: Simarpreet Singh <simar@linux.com>

* oracle: Add LayerID to DetectVulns + tests

Signed-off-by: Simarpreet Singh <simar@linux.com>

* photon: Add LayerID to DetectVulns + tests

Signed-off-by: Simarpreet Singh <simar@linux.com>

* redhat: Add LayerID to DetectVulns + tests

Signed-off-by: Simarpreet Singh <simar@linux.com>

* suse: Add LayerID to DetectVulns + tests

Signed-off-by: Simarpreet Singh <simar@linux.com>

* ubuntu: Add LayerID to DetectVulns + tests

Signed-off-by: Simarpreet Singh <simar@linux.com>

* integration: Fix integration tests to include LayerID

Signed-off-by: Simarpreet Singh <simar@linux.com>

* fix(rpc): add layer_id

* fix(rpc): insert layer_id to the struct

* fix(extractor): add cleanup function

* fix(library): add layer ID to detected vulnerabilities

* test: update mocks

* chore(mod): point to the feature branch of fanal

* mod: Point to fanal/master

Signed-off-by: Simarpreet Singh <simar@linux.com>

* scan_test: Include LayerID as part of the assertion

Signed-off-by: Simarpreet Singh <simar@linux.com>

* docker_engine_test.go: Update an error message to conform with fanal/master.

Signed-off-by: Simarpreet Singh <simar@linux.com>

Co-authored-by: Teppei Fukuda <knqyf263@gmail.com>
2020-03-04 19:55:16 +02:00

994 lines
65 KiB
Plaintext
Raw Blame History

[
{
"Target": "testdata/fixtures/ubuntu-1804.tar.gz (ubuntu 18.04)",
"Vulnerabilities": [
{
"VulnerabilityID": "CVE-2018-7738",
"PkgName": "bsdutils",
"InstalledVersion": "2.31.1-0.4ubuntu3.3",
"LayerID": "sha256:6cebf3abed5fac58d2e792ce8461454e92c245d5312c42118f02e231a73b317f",
"Title": "util-linux: Shell command injection in unescaped bash-completed mount point names",
"Description": "In util-linux before 2.32-rc1, bash-completion/umount allows local users to gain privileges by embedding shell commands in a mountpoint name, which is mishandled during a umount command (within Bash) by a different user, as demonstrated by logging in as root and entering umount followed by a tab character for autocompletion.",
"Severity": "HIGH",
"References": [
"http://www.securityfocus.com/bid/103367",
"https://bugs.debian.org/892179",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7738",
"https://github.com/karelzak/util-linux/commit/75f03badd7ed9f1dd951863d75e756883d3acc55",
"https://github.com/karelzak/util-linux/issues/539",
"https://www.debian.org/security/2018/dsa-4134"
]
},
{
"VulnerabilityID": "CVE-2016-2781",
"PkgName": "coreutils",
"InstalledVersion": "8.28-1ubuntu1",
"LayerID": "sha256:6cebf3abed5fac58d2e792ce8461454e92c245d5312c42118f02e231a73b317f",
"Title": "coreutils: Non-privileged session can escape to the parent session in chroot",
"Description": "chroot in GNU coreutils, when used with --userspec, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the terminal's input buffer.",
"Severity": "LOW",
"References": [
"http://www.openwall.com/lists/oss-security/2016/02/28/2",
"http://www.openwall.com/lists/oss-security/2016/02/28/3"
]
},
{
"VulnerabilityID": "CVE-2017-8283",
"PkgName": "dpkg",
"InstalledVersion": "1.19.0.5ubuntu2.1",
"LayerID": "sha256:6cebf3abed5fac58d2e792ce8461454e92c245d5312c42118f02e231a73b317f",
"Description": "dpkg-source in dpkg 1.3.0 through 1.18.23 is able to use a non-GNU patch program and does not offer a protection mechanism for blank-indented diff hunks, which allows remote attackers to conduct directory traversal attacks via a crafted Debian source package, as demonstrated by use of dpkg-source on NetBSD.",
"Severity": "HIGH",
"References": [
"http://www.openwall.com/lists/oss-security/2017/04/20/2",
"http://www.securityfocus.com/bid/98064",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8283"
]
},
{
"VulnerabilityID": "CVE-2019-5094",
"PkgName": "e2fsprogs",
"InstalledVersion": "1.44.1-1ubuntu1.1",
"FixedVersion": "1.44.1-1ubuntu1.2",
"LayerID": "sha256:6cebf3abed5fac58d2e792ce8461454e92c245d5312c42118f02e231a73b317f",
"Description": "An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially crafted ext4 partition can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.",
"Severity": "MEDIUM",
"References": [
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5094",
"https://lists.debian.org/debian-lts-announce/2019/09/msg00029.html",
"https://seclists.org/bugtraq/2019/Sep/58",
"https://talosintelligence.com/vulnerability_reports/TALOS-2019-0887",
"https://usn.ubuntu.com/4142-2/",
"https://www.debian.org/security/2019/dsa-4535"
]
},
{
"VulnerabilityID": "CVE-2018-7738",
"PkgName": "fdisk",
"InstalledVersion": "2.31.1-0.4ubuntu3.3",
"LayerID": "sha256:6cebf3abed5fac58d2e792ce8461454e92c245d5312c42118f02e231a73b317f",
"Title": "util-linux: Shell command injection in unescaped bash-completed mount point names",
"Description": "In util-linux before 2.32-rc1, bash-completion/umount allows local users to gain privileges by embedding shell commands in a mountpoint name, which is mishandled during a umount command (within Bash) by a different user, as demonstrated by logging in as root and entering umount followed by a tab character for autocompletion.",
"Severity": "HIGH",
"References": [
"http://www.securityfocus.com/bid/103367",
"https://bugs.debian.org/892179",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7738",
"https://github.com/karelzak/util-linux/commit/75f03badd7ed9f1dd951863d75e756883d3acc55",
"https://github.com/karelzak/util-linux/issues/539",
"https://www.debian.org/security/2018/dsa-4134"
]
},
{
"VulnerabilityID": "CVE-2019-13050",
"PkgName": "gpgv",
"InstalledVersion": "2.2.4-1ubuntu1.2",
"LayerID": "sha256:6cebf3abed5fac58d2e792ce8461454e92c245d5312c42118f02e231a73b317f",
"Title": "GnuPG: interaction between the sks-keyserver code and GnuPG allows for a Certificate Spamming Attack which leads to persistent DoS",
"Description": "Interaction between the sks-keyserver code through 1.2.0 of the SKS keyserver network, and GnuPG through 2.2.16, makes it risky to have a GnuPG keyserver configuration line referring to a host on the SKS keyserver network. Retrieving data from this network may cause a persistent denial of service, because of a Certificate Spamming Attack.",
"Severity": "MEDIUM",
"References": [
"https://access.redhat.com/articles/4264021",
"https://gist.github.com/rjhansen/67ab921ffb4084c865b3618d6955275f",
"https://lists.gnupg.org/pipermail/gnupg-announce/2019q3/000439.html",
"https://twitter.com/lambdafu/status/1147162583969009664"
]
},
{
"VulnerabilityID": "CVE-2018-7738",
"PkgName": "libblkid1",
"InstalledVersion": "2.31.1-0.4ubuntu3.3",
"LayerID": "sha256:6cebf3abed5fac58d2e792ce8461454e92c245d5312c42118f02e231a73b317f",
"Title": "util-linux: Shell command injection in unescaped bash-completed mount point names",
"Description": "In util-linux before 2.32-rc1, bash-completion/umount allows local users to gain privileges by embedding shell commands in a mountpoint name, which is mishandled during a umount command (within Bash) by a different user, as demonstrated by logging in as root and entering umount followed by a tab character for autocompletion.",
"Severity": "HIGH",
"References": [
"http://www.securityfocus.com/bid/103367",
"https://bugs.debian.org/892179",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7738",
"https://github.com/karelzak/util-linux/commit/75f03badd7ed9f1dd951863d75e756883d3acc55",
"https://github.com/karelzak/util-linux/issues/539",
"https://www.debian.org/security/2018/dsa-4134"
]
},
{
"VulnerabilityID": "CVE-2018-11236",
"PkgName": "libc-bin",
"InstalledVersion": "2.27-3ubuntu1",
"LayerID": "sha256:6cebf3abed5fac58d2e792ce8461454e92c245d5312c42118f02e231a73b317f",
"Title": "glibc: Integer overflow in stdlib/canonicalize.c on 32-bit architectures leading to stack-based buffer overflow",
"Description": "stdlib/canonicalize.c in the GNU C Library (aka glibc or libc6) 2.27 and earlier, when processing very long pathname arguments to the realpath function, could encounter an integer overflow on 32-bit architectures, leading to a stack-based buffer overflow and, potentially, arbitrary code execution.",
"Severity": "HIGH",
"References": [
"http://www.securityfocus.com/bid/104255",
"https://access.redhat.com/errata/RHBA-2019:0327",
"https://access.redhat.com/errata/RHSA-2018:3092",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11236",
"https://security.netapp.com/advisory/ntap-20190329-0001/",
"https://security.netapp.com/advisory/ntap-20190401-0001/",
"https://sourceware.org/bugzilla/show_bug.cgi?id=22786",
"https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=5460617d1567657621107d895ee2dd83bc1f88f2",
"https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"
]
},
{
"VulnerabilityID": "CVE-2019-9169",
"PkgName": "libc-bin",
"InstalledVersion": "2.27-3ubuntu1",
"LayerID": "sha256:6cebf3abed5fac58d2e792ce8461454e92c245d5312c42118f02e231a73b317f",
"Title": "glibc: regular-expression match via proceed_next_node in posix/regexec.c leads to heap-based buffer over-read",
"Description": "In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer over-read via an attempted case-insensitive regular-expression match.",
"Severity": "HIGH",
"References": [
"http://www.securityfocus.com/bid/107160",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9169",
"https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34140",
"https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34142",
"https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10278",
"https://security.netapp.com/advisory/ntap-20190315-0002/",
"https://sourceware.org/bugzilla/show_bug.cgi?id=24114",
"https://sourceware.org/git/gitweb.cgi?p=glibc.git;a=commit;h=583dd860d5b833037175247230a328f0050dbfe9",
"https://support.f5.com/csp/article/K54823184"
]
},
{
"VulnerabilityID": "CVE-2009-5155",
"PkgName": "libc-bin",
"InstalledVersion": "2.27-3ubuntu1",
"LayerID": "sha256:6cebf3abed5fac58d2e792ce8461454e92c245d5312c42118f02e231a73b317f",
"Title": "glibc: parse_reg_exp in posix/regcomp.c misparses alternatives leading to denial of service or trigger incorrect result",
"Description": "In the GNU C Library (aka glibc or libc6) before 2.28, parse_reg_exp in posix/regcomp.c misparses alternatives, which allows attackers to cause a denial of service (assertion failure and application exit) or trigger an incorrect result by attempting a regular-expression match.",
"Severity": "MEDIUM",
"References": [
"http://git.savannah.gnu.org/cgit/gnulib.git/commit/?id=5513b40999149090987a0341c018d05d3eea1272",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-5155",
"https://debbugs.gnu.org/cgi/bugreport.cgi?bug=22793",
"https://debbugs.gnu.org/cgi/bugreport.cgi?bug=32806",
"https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34238",
"https://security.netapp.com/advisory/ntap-20190315-0002/",
"https://sourceware.org/bugzilla/show_bug.cgi?id=11053",
"https://sourceware.org/bugzilla/show_bug.cgi?id=18986",
"https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=eb04c21373e2a2885f3d52ff192b0499afe3c672",
"https://support.f5.com/csp/article/K64119434"
]
},
{
"VulnerabilityID": "CVE-2015-8985",
"PkgName": "libc-bin",
"InstalledVersion": "2.27-3ubuntu1",
"LayerID": "sha256:6cebf3abed5fac58d2e792ce8461454e92c245d5312c42118f02e231a73b317f",
"Title": "glibc: potential denial of service in pop_fail_stack()",
"Description": "The pop_fail_stack function in the GNU C Library (aka glibc or libc6) allows context-dependent attackers to cause a denial of service (assertion failure and application crash) via vectors related to extended regular expression processing.",
"Severity": "MEDIUM",
"References": [
"http://www.openwall.com/lists/oss-security/2017/02/14/9",
"http://www.securityfocus.com/bid/76916",
"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=779392",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8985",
"https://security.gentoo.org/glsa/201908-06"
]
},
{
"VulnerabilityID": "CVE-2016-10228",
"PkgName": "libc-bin",
"InstalledVersion": "2.27-3ubuntu1",
"LayerID": "sha256:6cebf3abed5fac58d2e792ce8461454e92c245d5312c42118f02e231a73b317f",
"Title": "glibc: iconv program can hang when invoked with the -c option",
"Description": "The iconv program in the GNU C Library (aka glibc or libc6) 2.25 and earlier, when invoked with the -c option, enters an infinite loop when processing invalid multi-byte input sequences, leading to a denial of service.",
"Severity": "MEDIUM",
"References": [
"http://openwall.com/lists/oss-security/2017/03/01/10",
"http://www.securityfocus.com/bid/96525",
"https://sourceware.org/bugzilla/show_bug.cgi?id=19519"
]
},
{
"VulnerabilityID": "CVE-2016-10739",
"PkgName": "libc-bin",
"InstalledVersion": "2.27-3ubuntu1",
"LayerID": "sha256:6cebf3abed5fac58d2e792ce8461454e92c245d5312c42118f02e231a73b317f",
"Title": "glibc: getaddrinfo should reject IP addresses with trailing characters",
"Description": "In the GNU C Library (aka glibc or libc6) through 2.28, the getaddrinfo function would successfully parse a string that contained an IPv4 address followed by whitespace and arbitrary characters, which could lead applications to incorrectly assume that it had parsed a valid string, without the possibility of embedded HTTP headers or other potentially dangerous substrings.",
"Severity": "MEDIUM",
"References": [
"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00082.html",
"http://www.securityfocus.com/bid/106672",
"https://access.redhat.com/errata/RHSA-2019:2118",
"https://bugzilla.redhat.com/show_bug.cgi?id=1347549",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10739",
"https://sourceware.org/bugzilla/show_bug.cgi?id=20018"
]
},
{
"VulnerabilityID": "CVE-2018-11237",
"PkgName": "libc-bin",
"InstalledVersion": "2.27-3ubuntu1",
"LayerID": "sha256:6cebf3abed5fac58d2e792ce8461454e92c245d5312c42118f02e231a73b317f",
"Title": "glibc: Buffer overflow in __mempcpy_avx512_no_vzeroupper",
"Description": "An AVX-512-optimized implementation of the mempcpy function in the GNU C Library (aka glibc or libc6) 2.27 and earlier may write data beyond the target buffer, leading to a buffer overflow in __mempcpy_avx512_no_vzeroupper.",
"Severity": "MEDIUM",
"References": [
"http://www.securityfocus.com/bid/104256",
"https://access.redhat.com/errata/RHBA-2019:0327",
"https://access.redhat.com/errata/RHSA-2018:3092",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11237",
"https://security.netapp.com/advisory/ntap-20190329-0001/",
"https://security.netapp.com/advisory/ntap-20190401-0001/",
"https://sourceware.org/bugzilla/show_bug.cgi?id=23196",
"https://www.exploit-db.com/exploits/44750/",
"https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"
]
},
{
"VulnerabilityID": "CVE-2018-19591",
"PkgName": "libc-bin",
"InstalledVersion": "2.27-3ubuntu1",
"LayerID": "sha256:6cebf3abed5fac58d2e792ce8461454e92c245d5312c42118f02e231a73b317f",
"Title": "glibc: file descriptor leak in if_nametoindex() in sysdeps/unix/sysv/linux/if_index.c",
"Description": "In the GNU C Library (aka glibc or libc6) through 2.28, attempting to resolve a crafted hostname via getaddrinfo() leads to the allocation of a socket descriptor that is not closed. This is related to the if_nametoindex() function.",
"Severity": "MEDIUM",
"References": [
"http://www.securityfocus.com/bid/106037",
"http://www.securitytracker.com/id/1042174",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19591",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BO7WHN52GFMC5F2I2232GFIPSSXWFV7G/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M52KE4YR3GNMHQUOS3DKAGZD5TQ5D5UH/",
"https://security.gentoo.org/glsa/201903-09",
"https://security.netapp.com/advisory/ntap-20190321-0003/",
"https://sourceware.org/bugzilla/show_bug.cgi?id=23927",
"https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=NEWS;hb=HEAD",
"https://sourceware.org/git/gitweb.cgi?p=glibc.git;a=commitdiff;h=d527c860f5a3f0ed687bd03f0cb464612dc23408"
]
},
{
"VulnerabilityID": "CVE-2018-20796",
"PkgName": "libc-bin",
"InstalledVersion": "2.27-3ubuntu1",
"LayerID": "sha256:6cebf3abed5fac58d2e792ce8461454e92c245d5312c42118f02e231a73b317f",
"Title": "glibc: uncontrolled recursion in function check_dst_limits_calc_pos_1 in posix/regexec.c",
"Description": "In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\\227|)(\\\\1\\\\1|t1|\\\\\\2537)+' in grep.",
"Severity": "MEDIUM",
"References": [
"http://www.securityfocus.com/bid/107160",
"https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34141",
"https://lists.gnu.org/archive/html/bug-gnulib/2019-01/msg00108.html",
"https://security.netapp.com/advisory/ntap-20190315-0002/"
]
},
{
"VulnerabilityID": "CVE-2019-9192",
"PkgName": "libc-bin",
"InstalledVersion": "2.27-3ubuntu1",
"LayerID": "sha256:6cebf3abed5fac58d2e792ce8461454e92c245d5312c42118f02e231a73b317f",
"Title": "glibc: uncontrolled recursion in function check_dst_limits_calc_pos_1 in posix/regexec.c",
"Description": "** DISPUTED ** In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(|)(\\\\1\\\\1)*' in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted pattern.",
"Severity": "MEDIUM",
"References": [
"https://sourceware.org/bugzilla/show_bug.cgi?id=24269"
]
},
{
"VulnerabilityID": "CVE-2019-7309",
"PkgName": "libc-bin",
"InstalledVersion": "2.27-3ubuntu1",
"LayerID": "sha256:6cebf3abed5fac58d2e792ce8461454e92c245d5312c42118f02e231a73b317f",
"Title": "glibc: memcmp function incorrectly returns zero",
"Description": "In the GNU C Library (aka glibc or libc6) through 2.29, the memcmp function for the x32 architecture can incorrectly return zero (indicating that the inputs are equal) because the RDX most significant bit is mishandled.",
"Severity": "LOW",
"References": [
"http://www.securityfocus.com/bid/106835",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-7309",
"https://sourceware.org/bugzilla/show_bug.cgi?id=24155",
"https://sourceware.org/ml/libc-alpha/2019-02/msg00041.html"
]
},
{
"VulnerabilityID": "CVE-2018-11236",
"PkgName": "libc6",
"InstalledVersion": "2.27-3ubuntu1",
"LayerID": "sha256:6cebf3abed5fac58d2e792ce8461454e92c245d5312c42118f02e231a73b317f",
"Title": "glibc: Integer overflow in stdlib/canonicalize.c on 32-bit architectures leading to stack-based buffer overflow",
"Description": "stdlib/canonicalize.c in the GNU C Library (aka glibc or libc6) 2.27 and earlier, when processing very long pathname arguments to the realpath function, could encounter an integer overflow on 32-bit architectures, leading to a stack-based buffer overflow and, potentially, arbitrary code execution.",
"Severity": "HIGH",
"References": [
"http://www.securityfocus.com/bid/104255",
"https://access.redhat.com/errata/RHBA-2019:0327",
"https://access.redhat.com/errata/RHSA-2018:3092",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11236",
"https://security.netapp.com/advisory/ntap-20190329-0001/",
"https://security.netapp.com/advisory/ntap-20190401-0001/",
"https://sourceware.org/bugzilla/show_bug.cgi?id=22786",
"https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=5460617d1567657621107d895ee2dd83bc1f88f2",
"https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"
]
},
{
"VulnerabilityID": "CVE-2019-9169",
"PkgName": "libc6",
"InstalledVersion": "2.27-3ubuntu1",
"LayerID": "sha256:6cebf3abed5fac58d2e792ce8461454e92c245d5312c42118f02e231a73b317f",
"Title": "glibc: regular-expression match via proceed_next_node in posix/regexec.c leads to heap-based buffer over-read",
"Description": "In the GNU C Library (aka glibc or libc6) through 2.29, proceed_next_node in posix/regexec.c has a heap-based buffer over-read via an attempted case-insensitive regular-expression match.",
"Severity": "HIGH",
"References": [
"http://www.securityfocus.com/bid/107160",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9169",
"https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34140",
"https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34142",
"https://kc.mcafee.com/corporate/index?page=content\u0026id=SB10278",
"https://security.netapp.com/advisory/ntap-20190315-0002/",
"https://sourceware.org/bugzilla/show_bug.cgi?id=24114",
"https://sourceware.org/git/gitweb.cgi?p=glibc.git;a=commit;h=583dd860d5b833037175247230a328f0050dbfe9",
"https://support.f5.com/csp/article/K54823184"
]
},
{
"VulnerabilityID": "CVE-2009-5155",
"PkgName": "libc6",
"InstalledVersion": "2.27-3ubuntu1",
"LayerID": "sha256:6cebf3abed5fac58d2e792ce8461454e92c245d5312c42118f02e231a73b317f",
"Title": "glibc: parse_reg_exp in posix/regcomp.c misparses alternatives leading to denial of service or trigger incorrect result",
"Description": "In the GNU C Library (aka glibc or libc6) before 2.28, parse_reg_exp in posix/regcomp.c misparses alternatives, which allows attackers to cause a denial of service (assertion failure and application exit) or trigger an incorrect result by attempting a regular-expression match.",
"Severity": "MEDIUM",
"References": [
"http://git.savannah.gnu.org/cgit/gnulib.git/commit/?id=5513b40999149090987a0341c018d05d3eea1272",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-5155",
"https://debbugs.gnu.org/cgi/bugreport.cgi?bug=22793",
"https://debbugs.gnu.org/cgi/bugreport.cgi?bug=32806",
"https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34238",
"https://security.netapp.com/advisory/ntap-20190315-0002/",
"https://sourceware.org/bugzilla/show_bug.cgi?id=11053",
"https://sourceware.org/bugzilla/show_bug.cgi?id=18986",
"https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=eb04c21373e2a2885f3d52ff192b0499afe3c672",
"https://support.f5.com/csp/article/K64119434"
]
},
{
"VulnerabilityID": "CVE-2015-8985",
"PkgName": "libc6",
"InstalledVersion": "2.27-3ubuntu1",
"LayerID": "sha256:6cebf3abed5fac58d2e792ce8461454e92c245d5312c42118f02e231a73b317f",
"Title": "glibc: potential denial of service in pop_fail_stack()",
"Description": "The pop_fail_stack function in the GNU C Library (aka glibc or libc6) allows context-dependent attackers to cause a denial of service (assertion failure and application crash) via vectors related to extended regular expression processing.",
"Severity": "MEDIUM",
"References": [
"http://www.openwall.com/lists/oss-security/2017/02/14/9",
"http://www.securityfocus.com/bid/76916",
"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=779392",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8985",
"https://security.gentoo.org/glsa/201908-06"
]
},
{
"VulnerabilityID": "CVE-2016-10228",
"PkgName": "libc6",
"InstalledVersion": "2.27-3ubuntu1",
"LayerID": "sha256:6cebf3abed5fac58d2e792ce8461454e92c245d5312c42118f02e231a73b317f",
"Title": "glibc: iconv program can hang when invoked with the -c option",
"Description": "The iconv program in the GNU C Library (aka glibc or libc6) 2.25 and earlier, when invoked with the -c option, enters an infinite loop when processing invalid multi-byte input sequences, leading to a denial of service.",
"Severity": "MEDIUM",
"References": [
"http://openwall.com/lists/oss-security/2017/03/01/10",
"http://www.securityfocus.com/bid/96525",
"https://sourceware.org/bugzilla/show_bug.cgi?id=19519"
]
},
{
"VulnerabilityID": "CVE-2016-10739",
"PkgName": "libc6",
"InstalledVersion": "2.27-3ubuntu1",
"LayerID": "sha256:6cebf3abed5fac58d2e792ce8461454e92c245d5312c42118f02e231a73b317f",
"Title": "glibc: getaddrinfo should reject IP addresses with trailing characters",
"Description": "In the GNU C Library (aka glibc or libc6) through 2.28, the getaddrinfo function would successfully parse a string that contained an IPv4 address followed by whitespace and arbitrary characters, which could lead applications to incorrectly assume that it had parsed a valid string, without the possibility of embedded HTTP headers or other potentially dangerous substrings.",
"Severity": "MEDIUM",
"References": [
"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00082.html",
"http://www.securityfocus.com/bid/106672",
"https://access.redhat.com/errata/RHSA-2019:2118",
"https://bugzilla.redhat.com/show_bug.cgi?id=1347549",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10739",
"https://sourceware.org/bugzilla/show_bug.cgi?id=20018"
]
},
{
"VulnerabilityID": "CVE-2018-11237",
"PkgName": "libc6",
"InstalledVersion": "2.27-3ubuntu1",
"LayerID": "sha256:6cebf3abed5fac58d2e792ce8461454e92c245d5312c42118f02e231a73b317f",
"Title": "glibc: Buffer overflow in __mempcpy_avx512_no_vzeroupper",
"Description": "An AVX-512-optimized implementation of the mempcpy function in the GNU C Library (aka glibc or libc6) 2.27 and earlier may write data beyond the target buffer, leading to a buffer overflow in __mempcpy_avx512_no_vzeroupper.",
"Severity": "MEDIUM",
"References": [
"http://www.securityfocus.com/bid/104256",
"https://access.redhat.com/errata/RHBA-2019:0327",
"https://access.redhat.com/errata/RHSA-2018:3092",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11237",
"https://security.netapp.com/advisory/ntap-20190329-0001/",
"https://security.netapp.com/advisory/ntap-20190401-0001/",
"https://sourceware.org/bugzilla/show_bug.cgi?id=23196",
"https://www.exploit-db.com/exploits/44750/",
"https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html"
]
},
{
"VulnerabilityID": "CVE-2018-19591",
"PkgName": "libc6",
"InstalledVersion": "2.27-3ubuntu1",
"LayerID": "sha256:6cebf3abed5fac58d2e792ce8461454e92c245d5312c42118f02e231a73b317f",
"Title": "glibc: file descriptor leak in if_nametoindex() in sysdeps/unix/sysv/linux/if_index.c",
"Description": "In the GNU C Library (aka glibc or libc6) through 2.28, attempting to resolve a crafted hostname via getaddrinfo() leads to the allocation of a socket descriptor that is not closed. This is related to the if_nametoindex() function.",
"Severity": "MEDIUM",
"References": [
"http://www.securityfocus.com/bid/106037",
"http://www.securitytracker.com/id/1042174",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19591",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BO7WHN52GFMC5F2I2232GFIPSSXWFV7G/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/M52KE4YR3GNMHQUOS3DKAGZD5TQ5D5UH/",
"https://security.gentoo.org/glsa/201903-09",
"https://security.netapp.com/advisory/ntap-20190321-0003/",
"https://sourceware.org/bugzilla/show_bug.cgi?id=23927",
"https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=NEWS;hb=HEAD",
"https://sourceware.org/git/gitweb.cgi?p=glibc.git;a=commitdiff;h=d527c860f5a3f0ed687bd03f0cb464612dc23408"
]
},
{
"VulnerabilityID": "CVE-2018-20796",
"PkgName": "libc6",
"InstalledVersion": "2.27-3ubuntu1",
"LayerID": "sha256:6cebf3abed5fac58d2e792ce8461454e92c245d5312c42118f02e231a73b317f",
"Title": "glibc: uncontrolled recursion in function check_dst_limits_calc_pos_1 in posix/regexec.c",
"Description": "In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\\227|)(\\\\1\\\\1|t1|\\\\\\2537)+' in grep.",
"Severity": "MEDIUM",
"References": [
"http://www.securityfocus.com/bid/107160",
"https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34141",
"https://lists.gnu.org/archive/html/bug-gnulib/2019-01/msg00108.html",
"https://security.netapp.com/advisory/ntap-20190315-0002/"
]
},
{
"VulnerabilityID": "CVE-2019-9192",
"PkgName": "libc6",
"InstalledVersion": "2.27-3ubuntu1",
"LayerID": "sha256:6cebf3abed5fac58d2e792ce8461454e92c245d5312c42118f02e231a73b317f",
"Title": "glibc: uncontrolled recursion in function check_dst_limits_calc_pos_1 in posix/regexec.c",
"Description": "** DISPUTED ** In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(|)(\\\\1\\\\1)*' in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted pattern.",
"Severity": "MEDIUM",
"References": [
"https://sourceware.org/bugzilla/show_bug.cgi?id=24269"
]
},
{
"VulnerabilityID": "CVE-2019-7309",
"PkgName": "libc6",
"InstalledVersion": "2.27-3ubuntu1",
"LayerID": "sha256:6cebf3abed5fac58d2e792ce8461454e92c245d5312c42118f02e231a73b317f",
"Title": "glibc: memcmp function incorrectly returns zero",
"Description": "In the GNU C Library (aka glibc or libc6) through 2.29, the memcmp function for the x32 architecture can incorrectly return zero (indicating that the inputs are equal) because the RDX most significant bit is mishandled.",
"Severity": "LOW",
"References": [
"http://www.securityfocus.com/bid/106835",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-7309",
"https://sourceware.org/bugzilla/show_bug.cgi?id=24155",
"https://sourceware.org/ml/libc-alpha/2019-02/msg00041.html"
]
},
{
"VulnerabilityID": "CVE-2019-5094",
"PkgName": "libcom-err2",
"InstalledVersion": "1.44.1-1ubuntu1.1",
"FixedVersion": "1.44.1-1ubuntu1.2",
"LayerID": "sha256:6cebf3abed5fac58d2e792ce8461454e92c245d5312c42118f02e231a73b317f",
"Description": "An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially crafted ext4 partition can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.",
"Severity": "MEDIUM",
"References": [
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5094",
"https://lists.debian.org/debian-lts-announce/2019/09/msg00029.html",
"https://seclists.org/bugtraq/2019/Sep/58",
"https://talosintelligence.com/vulnerability_reports/TALOS-2019-0887",
"https://usn.ubuntu.com/4142-2/",
"https://www.debian.org/security/2019/dsa-4535"
]
},
{
"VulnerabilityID": "CVE-2019-5094",
"PkgName": "libext2fs2",
"InstalledVersion": "1.44.1-1ubuntu1.1",
"FixedVersion": "1.44.1-1ubuntu1.2",
"LayerID": "sha256:6cebf3abed5fac58d2e792ce8461454e92c245d5312c42118f02e231a73b317f",
"Description": "An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially crafted ext4 partition can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.",
"Severity": "MEDIUM",
"References": [
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5094",
"https://lists.debian.org/debian-lts-announce/2019/09/msg00029.html",
"https://seclists.org/bugtraq/2019/Sep/58",
"https://talosintelligence.com/vulnerability_reports/TALOS-2019-0887",
"https://usn.ubuntu.com/4142-2/",
"https://www.debian.org/security/2019/dsa-4535"
]
},
{
"VulnerabilityID": "CVE-2018-7738",
"PkgName": "libfdisk1",
"InstalledVersion": "2.31.1-0.4ubuntu3.3",
"LayerID": "sha256:6cebf3abed5fac58d2e792ce8461454e92c245d5312c42118f02e231a73b317f",
"Title": "util-linux: Shell command injection in unescaped bash-completed mount point names",
"Description": "In util-linux before 2.32-rc1, bash-completion/umount allows local users to gain privileges by embedding shell commands in a mountpoint name, which is mishandled during a umount command (within Bash) by a different user, as demonstrated by logging in as root and entering umount followed by a tab character for autocompletion.",
"Severity": "HIGH",
"References": [
"http://www.securityfocus.com/bid/103367",
"https://bugs.debian.org/892179",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7738",
"https://github.com/karelzak/util-linux/commit/75f03badd7ed9f1dd951863d75e756883d3acc55",
"https://github.com/karelzak/util-linux/issues/539",
"https://www.debian.org/security/2018/dsa-4134"
]
},
{
"VulnerabilityID": "CVE-2019-12904",
"PkgName": "libgcrypt20",
"InstalledVersion": "1.8.1-4ubuntu1.1",
"LayerID": "sha256:6cebf3abed5fac58d2e792ce8461454e92c245d5312c42118f02e231a73b317f",
"Title": "Libgcrypt: physical addresses being available to other processes leads to a flush-and-reload side-channel attack",
"Description": "In Libgcrypt 1.8.4, the C implementation of AES is vulnerable to a flush-and-reload side-channel attack because physical addresses are available to other processes. (The C implementation is used on platforms where an assembly-language implementation is unavailable.)",
"Severity": "MEDIUM",
"References": [
"http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00049.html",
"https://dev.gnupg.org/T4541",
"https://github.com/gpg/libgcrypt/commit/a4c561aab1014c3630bc88faf6f5246fee16b020",
"https://github.com/gpg/libgcrypt/commit/daedbbb5541cd8ecda1459d3b843ea4d92788762",
"https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-12904.html"
]
},
{
"VulnerabilityID": "CVE-2019-13627",
"PkgName": "libgcrypt20",
"InstalledVersion": "1.8.1-4ubuntu1.1",
"LayerID": "sha256:6cebf3abed5fac58d2e792ce8461454e92c245d5312c42118f02e231a73b317f",
"Description": "It was discovered that there was a ECDSA timing attack in the libgcrypt20 cryptographic library. Version affected: 1.8.4-5, 1.7.6-2+deb9u3, and 1.6.3-2+deb8u4. Versions fixed: 1.8.5-2 and 1.6.3-2+deb8u7.",
"Severity": "MEDIUM",
"References": [
"http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00060.html",
"http://www.openwall.com/lists/oss-security/2019/10/02/2",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13627",
"https://github.com/gpg/libgcrypt/releases/tag/libgcrypt-1.8.5",
"https://lists.debian.org/debian-lts-announce/2019/09/msg00024.html",
"https://minerva.crocs.fi.muni.cz/",
"https://security-tracker.debian.org/tracker/CVE-2019-13627"
]
},
{
"VulnerabilityID": "CVE-2018-16868",
"PkgName": "libgnutls30",
"InstalledVersion": "3.5.18-1ubuntu1.1",
"LayerID": "sha256:6cebf3abed5fac58d2e792ce8461454e92c245d5312c42118f02e231a73b317f",
"Title": "gnutls: Bleichenbacher-like side channel leakage in PKCS#1 v1.5 verification and padding oracle verification",
"Description": "A Bleichenbacher type side-channel based padding oracle attack was found in the way gnutls handles verification of RSA decrypted PKCS#1 v1.5 data. An attacker who is able to run process on the same physical core as the victim process, could use this to extract plaintext or in some cases downgrade any TLS connections to a vulnerable server.",
"Severity": "LOW",
"References": [
"http://cat.eyalro.net/",
"http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00017.html",
"http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00068.html",
"http://www.securityfocus.com/bid/106080",
"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16868",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16868"
]
},
{
"VulnerabilityID": "CVE-2018-16869",
"PkgName": "libhogweed4",
"InstalledVersion": "3.4-1",
"LayerID": "sha256:6cebf3abed5fac58d2e792ce8461454e92c245d5312c42118f02e231a73b317f",
"Title": "nettle: Leaky data conversion exposing a manager oracle",
"Description": "A Bleichenbacher type side-channel based padding oracle attack was found in the way nettle handles endian conversion of RSA decrypted PKCS#1 v1.5 data. An attacker who is able to run a process on the same physical core as the victim process, could use this flaw extract plaintext or in some cases downgrade any TLS connections to a vulnerable server.",
"Severity": "LOW",
"References": [
"http://cat.eyalro.net/",
"http://www.securityfocus.com/bid/106092",
"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16869",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16869"
]
},
{
"VulnerabilityID": "CVE-2018-7738",
"PkgName": "libmount1",
"InstalledVersion": "2.31.1-0.4ubuntu3.3",
"LayerID": "sha256:6cebf3abed5fac58d2e792ce8461454e92c245d5312c42118f02e231a73b317f",
"Title": "util-linux: Shell command injection in unescaped bash-completed mount point names",
"Description": "In util-linux before 2.32-rc1, bash-completion/umount allows local users to gain privileges by embedding shell commands in a mountpoint name, which is mishandled during a umount command (within Bash) by a different user, as demonstrated by logging in as root and entering umount followed by a tab character for autocompletion.",
"Severity": "HIGH",
"References": [
"http://www.securityfocus.com/bid/103367",
"https://bugs.debian.org/892179",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7738",
"https://github.com/karelzak/util-linux/commit/75f03badd7ed9f1dd951863d75e756883d3acc55",
"https://github.com/karelzak/util-linux/issues/539",
"https://www.debian.org/security/2018/dsa-4134"
]
},
{
"VulnerabilityID": "CVE-2018-16869",
"PkgName": "libnettle6",
"InstalledVersion": "3.4-1",
"LayerID": "sha256:6cebf3abed5fac58d2e792ce8461454e92c245d5312c42118f02e231a73b317f",
"Title": "nettle: Leaky data conversion exposing a manager oracle",
"Description": "A Bleichenbacher type side-channel based padding oracle attack was found in the way nettle handles endian conversion of RSA decrypted PKCS#1 v1.5 data. An attacker who is able to run a process on the same physical core as the victim process, could use this flaw extract plaintext or in some cases downgrade any TLS connections to a vulnerable server.",
"Severity": "LOW",
"References": [
"http://cat.eyalro.net/",
"http://www.securityfocus.com/bid/106092",
"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16869",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16869"
]
},
{
"VulnerabilityID": "CVE-2017-11164",
"PkgName": "libpcre3",
"InstalledVersion": "2:8.39-9",
"LayerID": "sha256:6cebf3abed5fac58d2e792ce8461454e92c245d5312c42118f02e231a73b317f",
"Title": "pcre: OP_KETRMAX feature in the match function in pcre_exec.c",
"Description": "In PCRE 8.41, the OP_KETRMAX feature in the match function in pcre_exec.c allows stack exhaustion (uncontrolled recursion) when processing a crafted regular expression.",
"Severity": "HIGH",
"References": [
"http://openwall.com/lists/oss-security/2017/07/11/3",
"http://www.securityfocus.com/bid/99575"
]
},
{
"VulnerabilityID": "CVE-2017-7245",
"PkgName": "libpcre3",
"InstalledVersion": "2:8.39-9",
"LayerID": "sha256:6cebf3abed5fac58d2e792ce8461454e92c245d5312c42118f02e231a73b317f",
"Title": "pcre: stack-based buffer overflow write in pcre32_copy_substring",
"Description": "Stack-based buffer overflow in the pcre32_copy_substring function in pcre_get.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (WRITE of size 4) or possibly have unspecified other impact via a crafted file.",
"Severity": "MEDIUM",
"References": [
"http://www.securityfocus.com/bid/97067",
"https://access.redhat.com/errata/RHSA-2018:2486",
"https://blogs.gentoo.org/ago/2017/03/20/libpcre-two-stack-based-buffer-overflow-write-in-pcre32_copy_substring-pcre_get-c/",
"https://security.gentoo.org/glsa/201710-25"
]
},
{
"VulnerabilityID": "CVE-2017-7246",
"PkgName": "libpcre3",
"InstalledVersion": "2:8.39-9",
"LayerID": "sha256:6cebf3abed5fac58d2e792ce8461454e92c245d5312c42118f02e231a73b317f",
"Title": "pcre: stack-based buffer overflow write in pcre32_copy_substring",
"Description": "Stack-based buffer overflow in the pcre32_copy_substring function in pcre_get.c in libpcre1 in PCRE 8.40 allows remote attackers to cause a denial of service (WRITE of size 268) or possibly have unspecified other impact via a crafted file.",
"Severity": "MEDIUM",
"References": [
"http://www.securityfocus.com/bid/97067",
"https://access.redhat.com/errata/RHSA-2018:2486",
"https://blogs.gentoo.org/ago/2017/03/20/libpcre-two-stack-based-buffer-overflow-write-in-pcre32_copy_substring-pcre_get-c/",
"https://security.gentoo.org/glsa/201710-25"
]
},
{
"VulnerabilityID": "CVE-2018-7738",
"PkgName": "libsmartcols1",
"InstalledVersion": "2.31.1-0.4ubuntu3.3",
"LayerID": "sha256:6cebf3abed5fac58d2e792ce8461454e92c245d5312c42118f02e231a73b317f",
"Title": "util-linux: Shell command injection in unescaped bash-completed mount point names",
"Description": "In util-linux before 2.32-rc1, bash-completion/umount allows local users to gain privileges by embedding shell commands in a mountpoint name, which is mishandled during a umount command (within Bash) by a different user, as demonstrated by logging in as root and entering umount followed by a tab character for autocompletion.",
"Severity": "HIGH",
"References": [
"http://www.securityfocus.com/bid/103367",
"https://bugs.debian.org/892179",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7738",
"https://github.com/karelzak/util-linux/commit/75f03badd7ed9f1dd951863d75e756883d3acc55",
"https://github.com/karelzak/util-linux/issues/539",
"https://www.debian.org/security/2018/dsa-4134"
]
},
{
"VulnerabilityID": "CVE-2019-5094",
"PkgName": "libss2",
"InstalledVersion": "1.44.1-1ubuntu1.1",
"FixedVersion": "1.44.1-1ubuntu1.2",
"LayerID": "sha256:6cebf3abed5fac58d2e792ce8461454e92c245d5312c42118f02e231a73b317f",
"Description": "An exploitable code execution vulnerability exists in the quota file functionality of E2fsprogs 1.45.3. A specially crafted ext4 partition can cause an out-of-bounds write on the heap, resulting in code execution. An attacker can corrupt a partition to trigger this vulnerability.",
"Severity": "MEDIUM",
"References": [
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5094",
"https://lists.debian.org/debian-lts-announce/2019/09/msg00029.html",
"https://seclists.org/bugtraq/2019/Sep/58",
"https://talosintelligence.com/vulnerability_reports/TALOS-2019-0887",
"https://usn.ubuntu.com/4142-2/",
"https://www.debian.org/security/2019/dsa-4535"
]
},
{
"VulnerabilityID": "CVE-2018-20839",
"PkgName": "libsystemd0",
"InstalledVersion": "237-3ubuntu10.25",
"LayerID": "sha256:6cebf3abed5fac58d2e792ce8461454e92c245d5312c42118f02e231a73b317f",
"Title": "systemd: mishandling of the current keyboard mode check leading to passwords being disclosed in cleartext to attacker",
"Description": "systemd 242 changes the VT1 mode upon a logout, which allows attackers to read cleartext passwords in certain circumstances, such as watching a shutdown, or using Ctrl-Alt-F1 and Ctrl-Alt-F2. This occurs because the KDGKBMODE (aka current keyboard mode) check is mishandled.",
"Severity": "MEDIUM",
"References": [
"http://www.securityfocus.com/bid/108389",
"https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1803993",
"https://github.com/systemd/systemd/commit/9725f1a10f80f5e0ae7d9b60547458622aeb322f",
"https://github.com/systemd/systemd/pull/12378",
"https://security.netapp.com/advisory/ntap-20190530-0002/"
]
},
{
"VulnerabilityID": "CVE-2019-3843",
"PkgName": "libsystemd0",
"InstalledVersion": "237-3ubuntu10.25",
"LayerID": "sha256:6cebf3abed5fac58d2e792ce8461454e92c245d5312c42118f02e231a73b317f",
"Title": "systemd: services with DynamicUser can create SUID/SGID binaries",
"Description": "It was discovered that a systemd service that uses DynamicUser property can create a SUID/SGID binary that would be allowed to run as the transient service UID/GID even after the service is terminated. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future, when the UID/GID will be recycled.",
"Severity": "MEDIUM",
"References": [
"http://www.securityfocus.com/bid/108116",
"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3843",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5JXQAKSTMABZ46EVCRMW62DHWYHTTFES/",
"https://security.netapp.com/advisory/ntap-20190619-0002/"
]
},
{
"VulnerabilityID": "CVE-2019-3844",
"PkgName": "libsystemd0",
"InstalledVersion": "237-3ubuntu10.25",
"LayerID": "sha256:6cebf3abed5fac58d2e792ce8461454e92c245d5312c42118f02e231a73b317f",
"Title": "systemd: services with DynamicUser can get new privileges and create SGID binaries",
"Description": "It was discovered that a systemd service that uses DynamicUser property can get new privileges through the execution of SUID binaries, which would allow to create binaries owned by the service transient group with the setgid bit set. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future, when the GID will be recycled.",
"Severity": "MEDIUM",
"References": [
"http://www.securityfocus.com/bid/108096",
"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3844",
"https://security.netapp.com/advisory/ntap-20190619-0002/"
]
},
{
"VulnerabilityID": "CVE-2019-15718",
"PkgName": "libsystemd0",
"InstalledVersion": "237-3ubuntu10.25",
"FixedVersion": "237-3ubuntu10.28",
"LayerID": "sha256:6cebf3abed5fac58d2e792ce8461454e92c245d5312c42118f02e231a73b317f",
"Title": "systemd: systemd-resolved allows unprivileged users to configure DNS",
"Description": "In systemd 240, bus_open_system_watch_bind_with_description in shared/bus-util.c (as used by systemd-resolved to connect to the system D-Bus instance), calls sd_bus_set_trusted, which disables access controls for incoming D-Bus messages. An unprivileged user can exploit this by executing D-Bus methods that should be restricted to privileged users, in order to change the system's DNS resolver settings.",
"Severity": "LOW",
"References": [
"http://www.openwall.com/lists/oss-security/2019/09/03/1",
"https://bugzilla.redhat.com/show_bug.cgi?id=1746057",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BRE5IS24XTF5WNZGH2L7GSQJKARBOEGL/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HIKGKXZ5OEGOEYURHLJHEMFYNLEGAW5B/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U2WNHRJW4XI6H5YMDG4BUFGPAXWUMUVG/"
]
},
{
"VulnerabilityID": "CVE-2018-1000654",
"PkgName": "libtasn1-6",
"InstalledVersion": "4.13-2",
"LayerID": "sha256:6cebf3abed5fac58d2e792ce8461454e92c245d5312c42118f02e231a73b317f",
"Title": "libtasn1: Infinite loop in _asn1_expand_object_id(ptree) leads to memory exhaustion",
"Description": "GNU Libtasn1-4.13 libtasn1-4.13 version libtasn1-4.13, libtasn1-4.12 contains a DoS, specifically CPU usage will reach 100% when running asn1Paser against the POC due to an issue in _asn1_expand_object_id(p_tree), after a long time, the program will be killed. This attack appears to be exploitable via parsing a crafted file.",
"Severity": "HIGH",
"References": [
"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00009.html",
"http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00018.html",
"http://www.securityfocus.com/bid/105151",
"https://gitlab.com/gnutls/libtasn1/issues/4"
]
},
{
"VulnerabilityID": "CVE-2018-20839",
"PkgName": "libudev1",
"InstalledVersion": "237-3ubuntu10.25",
"LayerID": "sha256:6cebf3abed5fac58d2e792ce8461454e92c245d5312c42118f02e231a73b317f",
"Title": "systemd: mishandling of the current keyboard mode check leading to passwords being disclosed in cleartext to attacker",
"Description": "systemd 242 changes the VT1 mode upon a logout, which allows attackers to read cleartext passwords in certain circumstances, such as watching a shutdown, or using Ctrl-Alt-F1 and Ctrl-Alt-F2. This occurs because the KDGKBMODE (aka current keyboard mode) check is mishandled.",
"Severity": "MEDIUM",
"References": [
"http://www.securityfocus.com/bid/108389",
"https://bugs.launchpad.net/ubuntu/+source/systemd/+bug/1803993",
"https://github.com/systemd/systemd/commit/9725f1a10f80f5e0ae7d9b60547458622aeb322f",
"https://github.com/systemd/systemd/pull/12378",
"https://security.netapp.com/advisory/ntap-20190530-0002/"
]
},
{
"VulnerabilityID": "CVE-2019-3843",
"PkgName": "libudev1",
"InstalledVersion": "237-3ubuntu10.25",
"LayerID": "sha256:6cebf3abed5fac58d2e792ce8461454e92c245d5312c42118f02e231a73b317f",
"Title": "systemd: services with DynamicUser can create SUID/SGID binaries",
"Description": "It was discovered that a systemd service that uses DynamicUser property can create a SUID/SGID binary that would be allowed to run as the transient service UID/GID even after the service is terminated. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future, when the UID/GID will be recycled.",
"Severity": "MEDIUM",
"References": [
"http://www.securityfocus.com/bid/108116",
"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3843",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/5JXQAKSTMABZ46EVCRMW62DHWYHTTFES/",
"https://security.netapp.com/advisory/ntap-20190619-0002/"
]
},
{
"VulnerabilityID": "CVE-2019-3844",
"PkgName": "libudev1",
"InstalledVersion": "237-3ubuntu10.25",
"LayerID": "sha256:6cebf3abed5fac58d2e792ce8461454e92c245d5312c42118f02e231a73b317f",
"Title": "systemd: services with DynamicUser can get new privileges and create SGID binaries",
"Description": "It was discovered that a systemd service that uses DynamicUser property can get new privileges through the execution of SUID binaries, which would allow to create binaries owned by the service transient group with the setgid bit set. A local attacker may use this flaw to access resources that will be owned by a potentially different service in the future, when the GID will be recycled.",
"Severity": "MEDIUM",
"References": [
"http://www.securityfocus.com/bid/108096",
"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3844",
"https://security.netapp.com/advisory/ntap-20190619-0002/"
]
},
{
"VulnerabilityID": "CVE-2019-15718",
"PkgName": "libudev1",
"InstalledVersion": "237-3ubuntu10.25",
"FixedVersion": "237-3ubuntu10.28",
"LayerID": "sha256:6cebf3abed5fac58d2e792ce8461454e92c245d5312c42118f02e231a73b317f",
"Title": "systemd: systemd-resolved allows unprivileged users to configure DNS",
"Description": "In systemd 240, bus_open_system_watch_bind_with_description in shared/bus-util.c (as used by systemd-resolved to connect to the system D-Bus instance), calls sd_bus_set_trusted, which disables access controls for incoming D-Bus messages. An unprivileged user can exploit this by executing D-Bus methods that should be restricted to privileged users, in order to change the system's DNS resolver settings.",
"Severity": "LOW",
"References": [
"http://www.openwall.com/lists/oss-security/2019/09/03/1",
"https://bugzilla.redhat.com/show_bug.cgi?id=1746057",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BRE5IS24XTF5WNZGH2L7GSQJKARBOEGL/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HIKGKXZ5OEGOEYURHLJHEMFYNLEGAW5B/",
"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/U2WNHRJW4XI6H5YMDG4BUFGPAXWUMUVG/"
]
},
{
"VulnerabilityID": "CVE-2018-7738",
"PkgName": "libuuid1",
"InstalledVersion": "2.31.1-0.4ubuntu3.3",
"LayerID": "sha256:6cebf3abed5fac58d2e792ce8461454e92c245d5312c42118f02e231a73b317f",
"Title": "util-linux: Shell command injection in unescaped bash-completed mount point names",
"Description": "In util-linux before 2.32-rc1, bash-completion/umount allows local users to gain privileges by embedding shell commands in a mountpoint name, which is mishandled during a umount command (within Bash) by a different user, as demonstrated by logging in as root and entering umount followed by a tab character for autocompletion.",
"Severity": "HIGH",
"References": [
"http://www.securityfocus.com/bid/103367",
"https://bugs.debian.org/892179",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7738",
"https://github.com/karelzak/util-linux/commit/75f03badd7ed9f1dd951863d75e756883d3acc55",
"https://github.com/karelzak/util-linux/issues/539",
"https://www.debian.org/security/2018/dsa-4134"
]
},
{
"VulnerabilityID": "CVE-2019-11922",
"PkgName": "libzstd1",
"InstalledVersion": "1.3.3+dfsg-2ubuntu1",
"FixedVersion": "1.3.3+dfsg-2ubuntu1.1",
"LayerID": "sha256:6cebf3abed5fac58d2e792ce8461454e92c245d5312c42118f02e231a73b317f",
"Description": "A race condition in the one-pass compression functions of Zstandard prior to version 1.3.8 could allow an attacker to write bytes out of bounds if an output buffer smaller than the recommended size was used.",
"Severity": "MEDIUM",
"References": [
"http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00008.html",
"http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00062.html",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11922",
"https://github.com/facebook/zstd/pull/1404/commits/3e5cdf1b6a85843e991d7d10f6a2567c15580da0",
"https://www.facebook.com/security/advisories/cve-2019-11922"
]
},
{
"VulnerabilityID": "CVE-2018-7169",
"PkgName": "login",
"InstalledVersion": "1:4.5-1ubuntu2",
"LayerID": "sha256:6cebf3abed5fac58d2e792ce8461454e92c245d5312c42118f02e231a73b317f",
"Title": "shadow-utils: newgidmap allows unprivileged user to drop supplementary groups potentially allowing privilege escalation",
"Description": "An issue was discovered in shadow 4.5. newgidmap (in shadow-utils) is setuid and allows an unprivileged user to be placed in a user namespace where setgroups(2) is permitted. This allows an attacker to remove themselves from a supplementary group, which may allow access to certain filesystem paths if the administrator has used \"group blacklisting\" (e.g., chmod g-rwx) to restrict access to paths. This flaw effectively reverts a security feature in the kernel (in particular, the /proc/self/setgroups knob) to prevent this sort of privilege escalation.",
"Severity": "MEDIUM",
"References": [
"https://bugs.launchpad.net/ubuntu/+source/shadow/+bug/1729357",
"https://security.gentoo.org/glsa/201805-09"
]
},
{
"VulnerabilityID": "CVE-2013-4235",
"PkgName": "login",
"InstalledVersion": "1:4.5-1ubuntu2",
"LayerID": "sha256:6cebf3abed5fac58d2e792ce8461454e92c245d5312c42118f02e231a73b317f",
"Title": "shadow-utils: TOCTOU race conditions by copying and removing directory trees",
"Description": "A TOCTOU race condition was discovered in shadow-utils. A local attacker with write privileges in a directory removed or copied by usermod/userdel could potentially exploit this flaw, when the administrator invokes usermod/userdel, to delete or modify other files on the system.",
"Severity": "LOW"
},
{
"VulnerabilityID": "CVE-2018-7738",
"PkgName": "mount",
"InstalledVersion": "2.31.1-0.4ubuntu3.3",
"LayerID": "sha256:6cebf3abed5fac58d2e792ce8461454e92c245d5312c42118f02e231a73b317f",
"Title": "util-linux: Shell command injection in unescaped bash-completed mount point names",
"Description": "In util-linux before 2.32-rc1, bash-completion/umount allows local users to gain privileges by embedding shell commands in a mountpoint name, which is mishandled during a umount command (within Bash) by a different user, as demonstrated by logging in as root and entering umount followed by a tab character for autocompletion.",
"Severity": "HIGH",
"References": [
"http://www.securityfocus.com/bid/103367",
"https://bugs.debian.org/892179",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7738",
"https://github.com/karelzak/util-linux/commit/75f03badd7ed9f1dd951863d75e756883d3acc55",
"https://github.com/karelzak/util-linux/issues/539",
"https://www.debian.org/security/2018/dsa-4134"
]
},
{
"VulnerabilityID": "CVE-2018-7169",
"PkgName": "passwd",
"InstalledVersion": "1:4.5-1ubuntu2",
"LayerID": "sha256:6cebf3abed5fac58d2e792ce8461454e92c245d5312c42118f02e231a73b317f",
"Title": "shadow-utils: newgidmap allows unprivileged user to drop supplementary groups potentially allowing privilege escalation",
"Description": "An issue was discovered in shadow 4.5. newgidmap (in shadow-utils) is setuid and allows an unprivileged user to be placed in a user namespace where setgroups(2) is permitted. This allows an attacker to remove themselves from a supplementary group, which may allow access to certain filesystem paths if the administrator has used \"group blacklisting\" (e.g., chmod g-rwx) to restrict access to paths. This flaw effectively reverts a security feature in the kernel (in particular, the /proc/self/setgroups knob) to prevent this sort of privilege escalation.",
"Severity": "MEDIUM",
"References": [
"https://bugs.launchpad.net/ubuntu/+source/shadow/+bug/1729357",
"https://security.gentoo.org/glsa/201805-09"
]
},
{
"VulnerabilityID": "CVE-2013-4235",
"PkgName": "passwd",
"InstalledVersion": "1:4.5-1ubuntu2",
"LayerID": "sha256:6cebf3abed5fac58d2e792ce8461454e92c245d5312c42118f02e231a73b317f",
"Title": "shadow-utils: TOCTOU race conditions by copying and removing directory trees",
"Description": "A TOCTOU race condition was discovered in shadow-utils. A local attacker with write privileges in a directory removed or copied by usermod/userdel could potentially exploit this flaw, when the administrator invokes usermod/userdel, to delete or modify other files on the system.",
"Severity": "LOW"
},
{
"VulnerabilityID": "CVE-2018-20482",
"PkgName": "tar",
"InstalledVersion": "1.29b-2ubuntu0.1",
"LayerID": "sha256:6cebf3abed5fac58d2e792ce8461454e92c245d5312c42118f02e231a73b317f",
"Title": "tar: Infinite read loop in sparse_dump_region function in sparse.c",
"Description": "GNU Tar through 1.30, when --sparse is used, mishandles file shrinkage during read access, which allows local users to cause a denial of service (infinite read loop in sparse_dump_region in sparse.c) by modifying a file that is supposed to be archived by a different user's process (e.g., a system backup running as root).",
"Severity": "LOW",
"References": [
"http://git.savannah.gnu.org/cgit/tar.git/commit/?id=c15c42ccd1e2377945fd0414eca1a49294bff454",
"http://lists.gnu.org/archive/html/bug-tar/2018-12/msg00023.html",
"http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00077.html",
"http://www.securityfocus.com/bid/106354",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20482",
"https://lists.debian.org/debian-lts-announce/2018/12/msg00023.html",
"https://news.ycombinator.com/item?id=18745431",
"https://security.gentoo.org/glsa/201903-05",
"https://twitter.com/thatcks/status/1076166645708668928",
"https://utcc.utoronto.ca/~cks/space/blog/sysadmin/TarFindingTruncateBug"
]
},
{
"VulnerabilityID": "CVE-2018-7738",
"PkgName": "util-linux",
"InstalledVersion": "2.31.1-0.4ubuntu3.3",
"LayerID": "sha256:6cebf3abed5fac58d2e792ce8461454e92c245d5312c42118f02e231a73b317f",
"Title": "util-linux: Shell command injection in unescaped bash-completed mount point names",
"Description": "In util-linux before 2.32-rc1, bash-completion/umount allows local users to gain privileges by embedding shell commands in a mountpoint name, which is mishandled during a umount command (within Bash) by a different user, as demonstrated by logging in as root and entering umount followed by a tab character for autocompletion.",
"Severity": "HIGH",
"References": [
"http://www.securityfocus.com/bid/103367",
"https://bugs.debian.org/892179",
"https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7738",
"https://github.com/karelzak/util-linux/commit/75f03badd7ed9f1dd951863d75e756883d3acc55",
"https://github.com/karelzak/util-linux/issues/539",
"https://www.debian.org/security/2018/dsa-4134"
]
}
]
}
]
Reference in New Issue View Git Blame Copy Permalink