PT-2020-13964 · Open Container Initiative+1 · Runc+1

Published 2020-07-13 · Updated 2023-02-12 · CVE-2020-14298

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions docker version 1.13.1-108.git4ef4b30.el7

Description This issue could allow a malicious or compromised container to compromise the container host and other containers running on the same host. The problem arose due to an incorrect version of runc being included, which was missing a previously fixed issue.

Recommendations For docker version 1.13.1-108.git4ef4b30.el7, update to a version that includes the correct fix for the issue, as earlier and later versions are not affected.

Fix

Weakness Enumeration

CWE-273

Related Identifiers

CVE-2020-14298

RHSA-2020:2653

Affected Products

Docker

Runc

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2020-14298 · Security Note
• https://osv.dev/vulnerability/CVE-2020-14298 · Vendor Advisory
• https://access.redhat.com/security/vulnerabilities/runcescape · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-5736 · Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2020-14298 · Vendor Advisory
• https://access.redhat.com/errata/RHBA-2020:0427 · Vendor Advisory
• https://t.me/cvenotify/4983 · Telegram Post