CLSA-2026-1789985660
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu18.04els/CLSA-2026-1789985660.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1789985660
- Upstream
- Published
- 2026-09-21T15:55:29Z
- Modified
- 2026-10-26T09:32:03Z
- Summary
- Fix CVE(s): CVE-2019-12439
- Details
-
- SECURITY UPDATE: DoS / symlink attack via the attacker-precreatable
pivot_root mount point
- debian/patches/CVE-2019-12439.patch: mount the root tmpfs on /tmp itself in main() (bubblewrap.c) instead of creating /run/user/$UID/.bubblewrap or /tmp/.bubblewrap-$UID, which another local user can pre-create as a non-directory or as a symlink they control
- debian/patches/CVE-2019-12439-test.patch: upstream regression test for the above, asserting the pivot_root scaffolding (/tmp/oldroot, /tmp/newroot) stays invisible inside the container (tests/test-run.sh)
- CVE-2019-12439
- SECURITY UPDATE: DoS / symlink attack via the attacker-precreatable
pivot_root mount point
- References