CVE-2020-2026

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2020-2026

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-2026.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2020-2026

Aliases

GHSA-877x-32pm-p28x

Published

2020-06-10T18:15:11Z

Modified

2026-10-20T10:52:08Z

Severity

8.8 (High) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CVSS Calculator

Summary

[none]

Details

A malicious guest compromised before a container creation (e.g. a malicious guest image or a guest running multiple containers) can trick the kata runtime into mounting the untrusted container filesystem on any host path, potentially allowing for code execution on the host. This issue affects: Kata Containers 1.11 versions earlier than 1.11.1; Kata Containers 1.10 versions earlier than 1.10.5; Kata Containers 1.9 and earlier versions.

Database specific

{
    "unresolved_ranges":  [
        {
            "cpes":  [
                "cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*"
            ],
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "introduced":  "31"
                        },
                        {
                            "last_affected":  "31"
                        }
                    ],
                    "source":  "CPE_STRING"
                }
            ],
            "vendor_product":  "fedoraproject:fedora"
        }
    ]
}

References

Affected packages

Git / github.com/kata-containers/runtime

Affected ranges

Type

GIT

Repo

https://github.com/kata-containers/runtime

Events

Introduced

Last Affected

8ff5bdc5386a35f4779661c2f214b28b614bb276

Introduced

ebe9677f23b574c5defacf57456d221d8ce901f2

Fixed

ecb69a3f67ec97d071e17b95cbe3d06d270bf982

Introduced

23e554b316aa994c6f48c9b1bd84060629fd6361

Fixed

984ccea48a1badd2863a68f91c8d95e229898095

Database specific

Show details

{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:katacontainers:runtime:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "last_affected":  "1.9"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:katacontainers:runtime:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.10"
                },
                {
                    "fixed":  "1.10.5"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:katacontainers:runtime:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.11"
                },
                {
                    "fixed":  "1.11.1"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "original_tag":  "1.10.5",
            "range":  [
                {
                    "fixed":  "ecb69a3f67ec97d071e17b95cbe3d06d270bf982"
                }
            ],
            "source":  "REFERENCES_TAG"
        },
        {
            "original_tag":  "1.11.1",
            "range":  [
                {
                    "fixed":  "984ccea48a1badd2863a68f91c8d95e229898095"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

0.*

0.0.1

0.2.0

0.3.0

1.*

1.0.0

1.1.0

1.10.0

1.10.1

1.10.2

1.10.3

1.10.4

1.11.0

1.2.0

1.3.0

1.3.0-rc0

1.3.0-rc1

1.4.0

1.5.0

1.5.0-rc1

1.5.0-rc2

1.6.0-rc1

1.6.0-rc2

1.7.0

1.7.0-alpha0

1.7.0-alpha1

1.7.0-rc1

1.8.0-alpha0

1.8.0-alpha1

1.8.0-alpha2

1.8.0-rc0

1.9.0

1.9.0-alpha0

1.9.0-alpha1

1.9.0-alpha2

1.9.0-rc0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-2026.json"