VOOZH about

URL: https://nvd.nist.gov/vuln/detail/CVE-2019-5736

⇱ NVD - CVE-2019-5736

  1. Vulnerabilities

CVE-2019-5736 Detail

Modified After Enrichment

This CVE record has been updated after NVD enrichment efforts were completed. Enrichment data supplied by the NVD may require amendment due to these changes.

Description

runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a command as root within one of these types of containers: (1) a new container with an attacker-controlled image, or (2) an existing container, to which the attacker previously had write access, that can be attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/self/exe.


Metrics

 
NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.
CVSS 4.0 Severity and Vector Strings:

NVD assessment not yet provided.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [email protected].

URL Source(s) Tag(s)
http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00044.html CVE, MITRE Mailing List  Third Party Advisory 
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00074.html CVE, MITRE Mailing List  Third Party Advisory 
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00091.html CVE, MITRE Mailing List  Third Party Advisory 
http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00060.html CVE, MITRE Mailing List  Third Party Advisory 
http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00073.html CVE, MITRE Mailing List  Third Party Advisory 
http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00011.html CVE, MITRE Mailing List  Third Party Advisory 
http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00015.html CVE, MITRE Mailing List  Third Party Advisory 
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00084.html CVE, MITRE Mailing List  Third Party Advisory 
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00007.html CVE, MITRE Mailing List  Third Party Advisory 
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00029.html CVE, MITRE Mailing List  Third Party Advisory 
http://packetstormsecurity.com/files/163339/Docker-Container-Escape.html CVE, MITRE Exploit  Third Party Advisory  VDB Entry 
http://packetstormsecurity.com/files/165197/Docker-runc-Command-Execution-Proof-Of-Concept.html CVE, MITRE Third Party Advisory  VDB Entry 
http://www.openwall.com/lists/oss-security/2019/03/23/1 CVE, MITRE Mailing List  Third Party Advisory 
http://www.openwall.com/lists/oss-security/2019/06/28/2 CVE, MITRE Mailing List  Third Party Advisory 
http://www.openwall.com/lists/oss-security/2019/07/06/3 CVE, MITRE Mailing List  Third Party Advisory 
http://www.openwall.com/lists/oss-security/2019/07/06/4 CVE, MITRE Mailing List  Third Party Advisory 
http://www.openwall.com/lists/oss-security/2019/10/24/1 CVE, MITRE Mailing List  Third Party Advisory 
http://www.openwall.com/lists/oss-security/2019/10/29/3 CVE, MITRE Mailing List  Third Party Advisory 
http://www.openwall.com/lists/oss-security/2024/01/31/6 CVE, MITRE
http://www.openwall.com/lists/oss-security/2024/02/01/1 CVE, MITRE
http://www.openwall.com/lists/oss-security/2024/02/02/3 CVE, MITRE
http://www.securityfocus.com/bid/106976 CVE, MITRE Third Party Advisory  VDB Entry 
https://access.redhat.com/errata/RHSA-2019:0303 CVE, MITRE Third Party Advisory 
https://access.redhat.com/errata/RHSA-2019:0304 CVE, MITRE Third Party Advisory 
https://access.redhat.com/errata/RHSA-2019:0401 CVE, MITRE Third Party Advisory 
https://access.redhat.com/errata/RHSA-2019:0408 CVE, MITRE Third Party Advisory 
https://access.redhat.com/errata/RHSA-2019:0975 CVE, MITRE Third Party Advisory 
https://access.redhat.com/security/cve/cve-2019-5736 CVE, MITRE Third Party Advisory 
https://access.redhat.com/security/vulnerabilities/runcescape CVE, MITRE Third Party Advisory 
https://aws.amazon.com/security/security-bulletins/AWS-2019-002/ CVE, MITRE Third Party Advisory 
https://azure.microsoft.com/en-us/updates/cve-2019-5736-and-runc-vulnerability/ CVE, MITRE Patch  Third Party Advisory  Vendor Advisory 
https://azure.microsoft.com/en-us/updates/iot-edge-fix-cve-2019-5736/ CVE, MITRE Patch  Third Party Advisory  Vendor Advisory 
https://blog.dragonsector.pl/2019/02/cve-2019-5736-escape-from-docker-and.html CVE, MITRE Exploit  Mitigation  Third Party Advisory 
https://brauner.github.io/2019/02/12/privileged-containers.html CVE, MITRE Exploit  Technical Description  Third Party Advisory 
https://bugzilla.suse.com/show_bug.cgi?id=1121967 CVE, MITRE Issue Tracking  Patch  Third Party Advisory 
https://cloud.google.com/kubernetes-engine/docs/security-bulletins#february-11-2019-runc CVE, MITRE Third Party Advisory 
https://github.com/Frichetten/CVE-2019-5736-PoC CVE, MITRE Exploit  Third Party Advisory 
https://github.com/docker/docker-ce/releases/tag/v18.09.2 CVE, MITRE Release Notes  Third Party Advisory 
https://github.com/opencontainers/runc/commit/0a8e4117e7f715d5fbeef398405813ce8e88558b CVE, MITRE Patch  Third Party Advisory 
https://github.com/opencontainers/runc/commit/6635b4f0c6af3810594d2770f662f34ddc15b40d CVE, MITRE Patch  Third Party Advisory 
https://github.com/q3k/cve-2019-5736-poc CVE, MITRE Exploit  Third Party Advisory 
https://github.com/rancher/runc-cve CVE, MITRE Third Party Advisory 
https://kubernetes.io/blog/2019/02/11/runc-and-cve-2019-5736/ CVE, MITRE Third Party Advisory 
https://lists.apache.org/thread.html/24e54e3c6b2259e3903b6b8fe26896ac649c481ea99c5739468c92a3%40%3Cdev.dlab.apache.org%3E CVE, MITRE
https://lists.apache.org/thread.html/a258757af84c5074dc7bf932622020fd4f60cef65a84290380386706%40%3Cuser.mesos.apache.org%3E CVE, MITRE
https://lists.apache.org/thread.html/a585f64d14c31ab393b90c5f17e41d9765a1a17eec63856ce750af46%40%3Cdev.dlab.apache.org%3E CVE, MITRE
https://lists.apache.org/thread.html/acacf018c12636e41667e94ac0a1e9244e887eef2debdd474640aa6e%40%3Cdev.dlab.apache.org%3E CVE, MITRE
https://lists.apache.org/thread.html/b162dd624dc088cd634292f0402282a1d1d0ce853baeae8205bc033c%40%3Cdev.mesos.apache.org%3E CVE, MITRE
https://lists.apache.org/thread.html/rc494623986d76593873ce5a40dd69cb3629400d10750d5d7e96b8587%40%3Cdev.dlab.apache.org%3E CVE, MITRE
https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E CVE, MITRE
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DLC52IOJN6IQJWJ6CUI6AIUP6GVVG2QP/ CVE, MITRE
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EGZKRCKI3Y7FMADO2MENMT4TU24QGHFR/ CVE, MITRE
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SWFJGIPYAAAMVSWWI3QWYXGA3ZBU2H4W/ CVE, MITRE
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V6A4OSFM5GGOWW4ECELV5OHX2XRAUSPH/ CVE, MITRE
https://security.gentoo.org/glsa/202003-21 CVE, MITRE Third Party Advisory 
https://security.netapp.com/advisory/ntap-20190307-0008/ CVE, MITRE Third Party Advisory 
https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03410944 CVE, MITRE Third Party Advisory 
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03913en_us CVE, MITRE Permissions Required 
https://support.mesosphere.com/s/article/Known-Issue-Container-Runtime-Vulnerability-MSPH-2019-0003 CVE, MITRE Exploit  Patch  Third Party Advisory 
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190215-runc CVE, MITRE Third Party Advisory 
https://usn.ubuntu.com/4048-1/ CVE, MITRE Third Party Advisory 
https://www.exploit-db.com/exploits/46359/ CVE, MITRE Exploit  Third Party Advisory  VDB Entry 
https://www.exploit-db.com/exploits/46369/ CVE, MITRE Exploit  Third Party Advisory  VDB Entry 
https://www.openwall.com/lists/oss-security/2019/02/11/2 CVE, MITRE Mailing List  Patch  Third Party Advisory 
https://www.synology.com/security/advisory/Synology_SA_19_06 CVE, MITRE Third Party Advisory 
https://www.twistlock.com/2019/02/11/how-to-mitigate-cve-2019-5736-in-runc-and-docker/ CVE, MITRE Third Party Advisory 

Weakness Enumeration

CWE-ID CWE Name Source
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') 👁 cwe source acceptance level
NIST  

Known Affected Software Configurations Switch to CPE 2.2

CPEs loading, please wait.

Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.

Change History

60 change records found show changes

CVE Modified by MITRE 6/16/2026 10:38:07 PM

Action Type Old Value New Value
Added Affected 
[{"vendor":"n/a","product":"n/a","versions":[{"version":"n/a","status":"affected"}]}]

CVE Modified by CVE 11/20/2024 11:45:24 PM

Action Type Old Value New Value
Added Reference 
http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00044.html
Added Reference 
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00074.html
Added Reference 
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00091.html
Added Reference 
http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00060.html
Added Reference 
http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00073.html
Added Reference 
http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00011.html
Added Reference 
http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00015.html
Added Reference 
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00084.html
Added Reference 
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00007.html
Added Reference 
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00029.html
Added Reference 
http://packetstormsecurity.com/files/163339/Docker-Container-Escape.html
Added Reference 
http://packetstormsecurity.com/files/165197/Docker-runc-Command-Execution-Proof-Of-Concept.html
Added Reference 
http://www.openwall.com/lists/oss-security/2019/03/23/1
Added Reference 
http://www.openwall.com/lists/oss-security/2019/06/28/2
Added Reference 
http://www.openwall.com/lists/oss-security/2019/07/06/3
Added Reference 
http://www.openwall.com/lists/oss-security/2019/07/06/4
Added Reference 
http://www.openwall.com/lists/oss-security/2019/10/24/1
Added Reference 
http://www.openwall.com/lists/oss-security/2019/10/29/3
Added Reference 
http://www.openwall.com/lists/oss-security/2024/01/31/6
Added Reference 
http://www.openwall.com/lists/oss-security/2024/02/01/1
Added Reference 
http://www.openwall.com/lists/oss-security/2024/02/02/3
Added Reference 
http://www.securityfocus.com/bid/106976
Added Reference 
https://access.redhat.com/errata/RHSA-2019:0303
Added Reference 
https://access.redhat.com/errata/RHSA-2019:0304
Added Reference 
https://access.redhat.com/errata/RHSA-2019:0401
Added Reference 
https://access.redhat.com/errata/RHSA-2019:0408
Added Reference 
https://access.redhat.com/errata/RHSA-2019:0975
Added Reference 
https://access.redhat.com/security/cve/cve-2019-5736
Added Reference 
https://access.redhat.com/security/vulnerabilities/runcescape
Added Reference 
https://aws.amazon.com/security/security-bulletins/AWS-2019-002/
Added Reference 
https://azure.microsoft.com/en-us/updates/cve-2019-5736-and-runc-vulnerability/
Added Reference 
https://azure.microsoft.com/en-us/updates/iot-edge-fix-cve-2019-5736/
Added Reference 
https://blog.dragonsector.pl/2019/02/cve-2019-5736-escape-from-docker-and.html
Added Reference 
https://brauner.github.io/2019/02/12/privileged-containers.html
Added Reference 
https://bugzilla.suse.com/show_bug.cgi?id=1121967
Added Reference 
https://cloud.google.com/kubernetes-engine/docs/security-bulletins#february-11-2019-runc
Added Reference 
https://github.com/Frichetten/CVE-2019-5736-PoC
Added Reference 
https://github.com/docker/docker-ce/releases/tag/v18.09.2
Added Reference 
https://github.com/opencontainers/runc/commit/0a8e4117e7f715d5fbeef398405813ce8e88558b
Added Reference 
https://github.com/opencontainers/runc/commit/6635b4f0c6af3810594d2770f662f34ddc15b40d
Added Reference 
https://github.com/q3k/cve-2019-5736-poc
Added Reference 
https://github.com/rancher/runc-cve
Added Reference 
https://kubernetes.io/blog/2019/02/11/runc-and-cve-2019-5736/
Added Reference 
https://lists.apache.org/thread.html/24e54e3c6b2259e3903b6b8fe26896ac649c481ea99c5739468c92a3%40%3Cdev.dlab.apache.org%3E
Added Reference 
https://lists.apache.org/thread.html/a258757af84c5074dc7bf932622020fd4f60cef65a84290380386706%40%3Cuser.mesos.apache.org%3E
Added Reference 
https://lists.apache.org/thread.html/a585f64d14c31ab393b90c5f17e41d9765a1a17eec63856ce750af46%40%3Cdev.dlab.apache.org%3E
Added Reference 
https://lists.apache.org/thread.html/acacf018c12636e41667e94ac0a1e9244e887eef2debdd474640aa6e%40%3Cdev.dlab.apache.org%3E
Added Reference 
https://lists.apache.org/thread.html/b162dd624dc088cd634292f0402282a1d1d0ce853baeae8205bc033c%40%3Cdev.mesos.apache.org%3E
Added Reference 
https://lists.apache.org/thread.html/rc494623986d76593873ce5a40dd69cb3629400d10750d5d7e96b8587%40%3Cdev.dlab.apache.org%3E
Added Reference 
https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E
Added Reference 
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DLC52IOJN6IQJWJ6CUI6AIUP6GVVG2QP/
Added Reference 
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EGZKRCKI3Y7FMADO2MENMT4TU24QGHFR/
Added Reference 
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SWFJGIPYAAAMVSWWI3QWYXGA3ZBU2H4W/
Added Reference 
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V6A4OSFM5GGOWW4ECELV5OHX2XRAUSPH/
Added Reference 
https://security.gentoo.org/glsa/202003-21
Added Reference 
https://security.netapp.com/advisory/ntap-20190307-0008/
Added Reference 
https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03410944
Added Reference 
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03913en_us
Added Reference 
https://support.mesosphere.com/s/article/Known-Issue-Container-Runtime-Vulnerability-MSPH-2019-0003
Added Reference 
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190215-runc
Added Reference 
https://usn.ubuntu.com/4048-1/
Added Reference 
https://www.exploit-db.com/exploits/46359/
Added Reference 
https://www.exploit-db.com/exploits/46369/
Added Reference 
https://www.openwall.com/lists/oss-security/2019/02/11/2
Added Reference 
https://www.synology.com/security/advisory/Synology_SA_19_06
Added Reference 
https://www.twistlock.com/2019/02/11/how-to-mitigate-cve-2019-5736-in-runc-and-docker/

CVE Modified by MITRE 5/14/2024 2:03:19 AM

Action Type Old Value New Value

CVE Modified by MITRE 2/02/2024 7:15:48 AM

Action Type Old Value New Value
Added Reference 
MITRE http://www.openwall.com/lists/oss-security/2024/02/02/3 [No types assigned]

CVE Modified by MITRE 2/01/2024 1:15:52 AM

Action Type Old Value New Value
Added Reference 
MITRE http://www.openwall.com/lists/oss-security/2024/02/01/1 [No types assigned]

CVE Modified by MITRE 1/31/2024 4:15:08 PM

Action Type Old Value New Value
Added Reference 
MITRE http://www.openwall.com/lists/oss-security/2024/01/31/6 [No types assigned]

CVE Modified by MITRE 11/06/2023 10:11:54 PM

Action Type Old Value New Value
Added Reference 
MITRE https://lists.apache.org/thread.html/24e54e3c6b2259e3903b6b8fe26896ac649c481ea99c5739468c92a3%40%3Cdev.dlab.apache.org%3E [No types assigned]
Added Reference 
MITRE https://lists.apache.org/thread.html/a258757af84c5074dc7bf932622020fd4f60cef65a84290380386706%40%3Cuser.mesos.apache.org%3E [No types assigned]
Added Reference 
MITRE https://lists.apache.org/thread.html/a585f64d14c31ab393b90c5f17e41d9765a1a17eec63856ce750af46%40%3Cdev.dlab.apache.org%3E [No types assigned]
Added Reference 
MITRE https://lists.apache.org/thread.html/acacf018c12636e41667e94ac0a1e9244e887eef2debdd474640aa6e%40%3Cdev.dlab.apache.org%3E [No types assigned]
Added Reference 
MITRE https://lists.apache.org/thread.html/b162dd624dc088cd634292f0402282a1d1d0ce853baeae8205bc033c%40%3Cdev.mesos.apache.org%3E [No types assigned]
Added Reference 
MITRE https://lists.apache.org/thread.html/rc494623986d76593873ce5a40dd69cb3629400d10750d5d7e96b8587%40%3Cdev.dlab.apache.org%3E [No types assigned]
Added Reference 
MITRE https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E [No types assigned]
Added Reference 
MITRE https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DLC52IOJN6IQJWJ6CUI6AIUP6GVVG2QP/ [No types assigned]
Added Reference 
MITRE https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EGZKRCKI3Y7FMADO2MENMT4TU24QGHFR/ [No types assigned]
Added Reference 
MITRE https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SWFJGIPYAAAMVSWWI3QWYXGA3ZBU2H4W/ [No types assigned]
Added Reference 
MITRE https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V6A4OSFM5GGOWW4ECELV5OHX2XRAUSPH/ [No types assigned]
Removed Reference 
MITRE https://lists.apache.org/thread.html/24e54e3c6b2259e3903b6b8fe26896ac649c481ea99c5739468c92a3@%3Cdev.dlab.apache.org%3E
Removed Reference 
MITRE https://lists.apache.org/thread.html/a258757af84c5074dc7bf932622020fd4f60cef65a84290380386706@%3Cuser.mesos.apache.org%3E
Removed Reference 
MITRE https://lists.apache.org/thread.html/a585f64d14c31ab393b90c5f17e41d9765a1a17eec63856ce750af46@%3Cdev.dlab.apache.org%3E
Removed Reference 
MITRE https://lists.apache.org/thread.html/acacf018c12636e41667e94ac0a1e9244e887eef2debdd474640aa6e@%3Cdev.dlab.apache.org%3E
Removed Reference 
MITRE https://lists.apache.org/thread.html/b162dd624dc088cd634292f0402282a1d1d0ce853baeae8205bc033c@%3Cdev.mesos.apache.org%3E
Removed Reference 
MITRE https://lists.apache.org/thread.html/rc494623986d76593873ce5a40dd69cb3629400d10750d5d7e96b8587@%3Cdev.dlab.apache.org%3E
Removed Reference 
MITRE https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2@%3Cissues.geode.apache.org%3E
Removed Reference 
MITRE https://lists.fedoraproject.org/archives/list/[email protected]/message/DLC52IOJN6IQJWJ6CUI6AIUP6GVVG2QP/
Removed Reference 
MITRE https://lists.fedoraproject.org/archives/list/[email protected]/message/EGZKRCKI3Y7FMADO2MENMT4TU24QGHFR/
Removed Reference 
MITRE https://lists.fedoraproject.org/archives/list/[email protected]/message/SWFJGIPYAAAMVSWWI3QWYXGA3ZBU2H4W/
Removed Reference 
MITRE https://lists.fedoraproject.org/archives/list/[email protected]/message/V6A4OSFM5GGOWW4ECELV5OHX2XRAUSPH/

Modified Analysis by NIST 12/16/2021 1:38:05 PM

Action Type Old Value New Value
Changed Reference Type 
http://packetstormsecurity.com/files/163339/Docker-Container-Escape.html No Types Assigned


 
http://packetstormsecurity.com/files/163339/Docker-Container-Escape.html Exploit, Third Party Advisory, VDB Entry
Changed Reference Type 
http://packetstormsecurity.com/files/165197/Docker-runc-Command-Execution-Proof-Of-Concept.html No Types Assigned


 
http://packetstormsecurity.com/files/165197/Docker-runc-Command-Execution-Proof-Of-Concept.html Third Party Advisory, VDB Entry

CVE Modified by MITRE 12/08/2021 1:15:18 PM

Action Type Old Value New Value
Added Reference 
http://packetstormsecurity.com/files/165197/Docker-runc-Command-Execution-Proof-Of-Concept.html [No Types Assigned]

CVE Modified by MITRE 7/01/2021 4:15:08 PM

Action Type Old Value New Value
Added Reference 
http://packetstormsecurity.com/files/163339/Docker-Container-Escape.html [No Types Assigned]

Reanalysis by NIST 4/13/2021 11:34:04 AM

Action Type Old Value New Value
Changed CPE Configuration 
OR
 *cpe:2.3:a:mesosphere:kubernetes_engine:*:*:*:*:*:*:*:* versions up to (excluding) 2.2.0-1.13.3
 *cpe:2.3:o:mesosphere:dc\/os:*:*:*:*:*:*:*:* versions up to (excluding) 1.10.10
 *cpe:2.3:o:mesosphere:dc\/os:*:*:*:*:*:*:*:* versions from (including) 1.10.11 up to (excluding) 1.11.9
 *cpe:2.3:o:mesosphere:dc\/os:*:*:*:*:*:*:*:* versions from (including) 1.11.10 up to (excluding) 1.12.1


 
OR
 *cpe:2.3:a:d2iq:kubernetes_engine:*:*:*:*:*:*:*:* versions up to (excluding) 2.2.0-1.13.3
 *cpe:2.3:o:d2iq:dc\/os:*:*:*:*:*:*:*:* versions up to (excluding) 1.10.10
 *cpe:2.3:o:d2iq:dc\/os:*:*:*:*:*:*:*:* versions from (including) 1.10.11 up to (excluding) 1.11.9
 *cpe:2.3:o:d2iq:dc\/os:*:*:*:*:*:*:*:* versions from (including) 1.11.10 up to (excluding) 1.12.1

Reanalysis by NIST 11/16/2020 3:46:40 PM

Action Type Old Value New Value
Changed CPE Configuration 
OR
 *cpe:2.3:a:linuxcontainers:lxc:-:*:*:*:*:*:*:*


 
OR
 *cpe:2.3:a:linuxcontainers:lxc:*:*:*:*:*:*:*:* versions up to (excluding) 3.2.0
Changed Reference Type 
https://azure.microsoft.com/en-us/updates/cve-2019-5736-and-runc-vulnerability/ Third Party Advisory


 
https://azure.microsoft.com/en-us/updates/cve-2019-5736-and-runc-vulnerability/ Patch, Third Party Advisory, Vendor Advisory
Changed Reference Type 
https://azure.microsoft.com/en-us/updates/iot-edge-fix-cve-2019-5736/ Third Party Advisory


 
https://azure.microsoft.com/en-us/updates/iot-edge-fix-cve-2019-5736/ Patch, Third Party Advisory, Vendor Advisory

Modified Analysis by NIST 10/23/2020 10:33:13 AM

Action Type Old Value New Value
Added CVSS V3.1 
NIST AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Removed CVSS V3 
NIST AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Added CWE 
NIST CWE-78
Removed CWE 
NIST CWE-216
Changed CPE Configuration 
OR
 *cpe:2.3:a:apache:mesos:*:*:*:*:*:*:*:* versions from (including) 1.4.0 up to (including) 1.7.0


 
OR
 *cpe:2.3:a:apache:mesos:*:*:*:*:*:*:*:* versions from (including) 1.4.0 up to (excluding) 1.4.3
 *cpe:2.3:a:apache:mesos:*:*:*:*:*:*:*:* versions from (including) 1.5.0 up to (excluding) 1.5.3
 *cpe:2.3:a:apache:mesos:*:*:*:*:*:*:*:* versions from (including) 1.6.0 up to (excluding) 1.6.2
 *cpe:2.3:a:apache:mesos:*:*:*:*:*:*:*:* versions from (including) 1.7.0 up to (excluding) 1.7.2
Changed CPE Configuration 
OR
 *cpe:2.3:a:opencontainers:runc:1.0:rc1:*:*:*:*:*:*
 *cpe:2.3:a:opencontainers:runc:1.0:rc2:*:*:*:*:*:*
 *cpe:2.3:a:opencontainers:runc:1.0:rc3:*:*:*:*:*:*
 *cpe:2.3:a:opencontainers:runc:1.0:rc4:*:*:*:*:*:*
 *cpe:2.3:a:opencontainers:runc:1.0:rc5:*:*:*:*:*:*
 *cpe:2.3:a:opencontainers:runc:1.0:rc6:*:*:*:*:*:*


 
OR
 *cpe:2.3:a:linuxfoundation:runc:*:*:*:*:*:*:*:* versions up to (including) 0.1.1
 *cpe:2.3:a:linuxfoundation:runc:1.0.0:rc1:*:*:*:*:*:*
 *cpe:2.3:a:linuxfoundation:runc:1.0.0:rc2:*:*:*:*:*:*
 *cpe:2.3:a:linuxfoundation:runc:1.0.0:rc3:*:*:*:*:*:*
 *cpe:2.3:a:linuxfoundation:runc:1.0.0:rc4:*:*:*:*:*:*
 *cpe:2.3:a:linuxfoundation:runc:1.0.0:rc5:*:*:*:*:*:*
 *cpe:2.3:a:linuxfoundation:runc:1.0.0:rc6:*:*:*:*:*:*
Changed CPE Configuration 
OR
 *cpe:2.3:a:netapp:element_software_management:-:*:*:*:*:*:*:*


 
OR
 *cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*
 *cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*
Changed CPE Configuration 
OR
 *cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*
 *cpe:2.3:o:opensuse:leap:42.3:*:*:*:*:*:*:*


 
OR
 *cpe:2.3:a:opensuse:backports_sle:15.0:-:*:*:*:*:*:*
 *cpe:2.3:a:opensuse:backports_sle:15.0:sp1:*:*:*:*:*:*
 *cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*
 *cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
 *cpe:2.3:o:opensuse:leap:42.3:*:*:*:*:*:*:*
Changed CPE Configuration 
OR
 *cpe:2.3:a:redhat:openshift:3.4:*:*:*:*:*:*:*
 *cpe:2.3:a:redhat:openshift:3.5:*:*:*:*:*:*:*
 *cpe:2.3:a:redhat:openshift:3.6:*:*:*:*:*:*:*
 *cpe:2.3:a:redhat:openshift:3.7:*:*:*:*:*:*:*
 *cpe:2.3:a:redhat:openshift:3.9:*:*:*:enterprise:*:*:*
 *cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
 *cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*


 
OR
 *cpe:2.3:a:redhat:container_development_kit:3.7:*:*:*:*:*:*:*
 *cpe:2.3:a:redhat:openshift:3.4:*:*:*:*:*:*:*
 *cpe:2.3:a:redhat:openshift:3.5:*:*:*:*:*:*:*
 *cpe:2.3:a:redhat:openshift:3.6:*:*:*:*:*:*:*
 *cpe:2.3:a:redhat:openshift:3.7:*:*:*:*:*:*:*
 *cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
 *cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
Added CPE Configuration 
OR
 *cpe:2.3:a:microfocus:service_management_automation:2018.02:*:*:*:*:*:*:*
 *cpe:2.3:a:microfocus:service_management_automation:2018.05:*:*:*:*:*:*:*
 *cpe:2.3:a:microfocus:service_management_automation:2018.08:*:*:*:*:*:*:*
 *cpe:2.3:a:microfocus:service_management_automation:2018.11:*:*:*:*:*:*:*
Added CPE Configuration 
OR
 *cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*
 *cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
 *cpe:2.3:o:canonical:ubuntu_linux:18.10:*:*:*:*:*:*:*
 *cpe:2.3:o:canonical:ubuntu_linux:19.04:*:*:*:*:*:*:*
Removed CPE Configuration 
OR
 *cpe:2.3:a:opencontainers:runc:*:*:*:*:*:*:*:* versions up to (including) 1.0
Changed Reference Type 
http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00060.html No Types Assigned


 
http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00060.html Mailing List, Third Party Advisory
Changed Reference Type 
http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00073.html No Types Assigned


 
http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00073.html Mailing List, Third Party Advisory
Changed Reference Type 
http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00011.html No Types Assigned


 
http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00011.html Mailing List, Third Party Advisory
Changed Reference Type 
http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00015.html No Types Assigned


 
http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00015.html Mailing List, Third Party Advisory
Changed Reference Type 
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00084.html No Types Assigned


 
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00084.html Mailing List, Third Party Advisory
Changed Reference Type 
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00007.html No Types Assigned


 
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00007.html Mailing List, Third Party Advisory
Changed Reference Type 
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00029.html No Types Assigned


 
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00029.html Mailing List, Third Party Advisory
Changed Reference Type 
http://www.openwall.com/lists/oss-security/2019/06/28/2 No Types Assigned


 
http://www.openwall.com/lists/oss-security/2019/06/28/2 Mailing List, Third Party Advisory
Changed Reference Type 
http://www.openwall.com/lists/oss-security/2019/07/06/3 No Types Assigned


 
http://www.openwall.com/lists/oss-security/2019/07/06/3 Mailing List, Third Party Advisory
Changed Reference Type 
http://www.openwall.com/lists/oss-security/2019/07/06/4 No Types Assigned


 
http://www.openwall.com/lists/oss-security/2019/07/06/4 Mailing List, Third Party Advisory
Changed Reference Type 
http://www.openwall.com/lists/oss-security/2019/10/24/1 No Types Assigned


 
http://www.openwall.com/lists/oss-security/2019/10/24/1 Mailing List, Third Party Advisory
Changed Reference Type 
http://www.openwall.com/lists/oss-security/2019/10/29/3 No Types Assigned


 
http://www.openwall.com/lists/oss-security/2019/10/29/3 Mailing List, Third Party Advisory
Changed Reference Type 
https://bugzilla.suse.com/show_bug.cgi?id=1121967 Issue Tracking, Third Party Advisory


 
https://bugzilla.suse.com/show_bug.cgi?id=1121967 Issue Tracking, Patch, Third Party Advisory
Changed Reference Type 
https://github.com/Frichetten/CVE-2019-5736-PoC Third Party Advisory


 
https://github.com/Frichetten/CVE-2019-5736-PoC Exploit, Third Party Advisory
Changed Reference Type 
https://github.com/docker/docker-ce/releases/tag/v18.09.2 Release Notes, Third Party Advisory, Vendor Advisory


 
https://github.com/docker/docker-ce/releases/tag/v18.09.2 Release Notes, Third Party Advisory
Changed Reference Type 
https://github.com/q3k/cve-2019-5736-poc Third Party Advisory


 
https://github.com/q3k/cve-2019-5736-poc Exploit, Third Party Advisory
Changed Reference Type 
https://lists.apache.org/thread.html/24e54e3c6b2259e3903b6b8fe26896ac649c481ea99c5739468c92a3@%3Cdev.dlab.apache.org%3E No Types Assigned


 
https://lists.apache.org/thread.html/24e54e3c6b2259e3903b6b8fe26896ac649c481ea99c5739468c92a3@%3Cdev.dlab.apache.org%3E Mailing List, Third Party Advisory
Changed Reference Type 
https://lists.apache.org/thread.html/a585f64d14c31ab393b90c5f17e41d9765a1a17eec63856ce750af46@%3Cdev.dlab.apache.org%3E No Types Assigned


 
https://lists.apache.org/thread.html/a585f64d14c31ab393b90c5f17e41d9765a1a17eec63856ce750af46@%3Cdev.dlab.apache.org%3E Mailing List, Third Party Advisory
Changed Reference Type 
https://lists.apache.org/thread.html/acacf018c12636e41667e94ac0a1e9244e887eef2debdd474640aa6e@%3Cdev.dlab.apache.org%3E No Types Assigned


 
https://lists.apache.org/thread.html/acacf018c12636e41667e94ac0a1e9244e887eef2debdd474640aa6e@%3Cdev.dlab.apache.org%3E Mailing List, Third Party Advisory
Changed Reference Type 
https://lists.apache.org/thread.html/rc494623986d76593873ce5a40dd69cb3629400d10750d5d7e96b8587@%3Cdev.dlab.apache.org%3E No Types Assigned


 
https://lists.apache.org/thread.html/rc494623986d76593873ce5a40dd69cb3629400d10750d5d7e96b8587@%3Cdev.dlab.apache.org%3E Mailing List, Third Party Advisory
Changed Reference Type 
https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2@%3Cissues.geode.apache.org%3E No Types Assigned


 
https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2@%3Cissues.geode.apache.org%3E Mailing List, Third Party Advisory
Changed Reference Type 
https://lists.fedoraproject.org/archives/list/[email protected]/message/DLC52IOJN6IQJWJ6CUI6AIUP6GVVG2QP/ No Types Assigned


 
https://lists.fedoraproject.org/archives/list/[email protected]/message/DLC52IOJN6IQJWJ6CUI6AIUP6GVVG2QP/ Third Party Advisory
Changed Reference Type 
https://lists.fedoraproject.org/archives/list/[email protected]/message/EGZKRCKI3Y7FMADO2MENMT4TU24QGHFR/ No Types Assigned


 
https://lists.fedoraproject.org/archives/list/[email protected]/message/EGZKRCKI3Y7FMADO2MENMT4TU24QGHFR/ Third Party Advisory
Changed Reference Type 
https://security.gentoo.org/glsa/202003-21 No Types Assigned


 
https://security.gentoo.org/glsa/202003-21 Third Party Advisory
Changed Reference Type 
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03913en_us Third Party Advisory


 
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03913en_us Permissions Required
Changed Reference Type 
https://usn.ubuntu.com/4048-1/ No Types Assigned


 
https://usn.ubuntu.com/4048-1/ Third Party Advisory

CVE Modified by MITRE 8/31/2020 10:15:16 AM

Action Type Old Value New Value
Added Reference 
https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2@%3Cissues.geode.apache.org%3E [No Types Assigned]

CVE Modified by MITRE 5/25/2020 12:15:11 PM

Action Type Old Value New Value
Added Reference 
https://lists.apache.org/thread.html/rc494623986d76593873ce5a40dd69cb3629400d10750d5d7e96b8587@%3Cdev.dlab.apache.org%3E [No Types Assigned]

CVE Modified by MITRE 3/15/2020 2:15:11 AM

Action Type Old Value New Value
Added Reference 
https://security.gentoo.org/glsa/202003-21 [No Types Assigned]

CVE Modified by MITRE 10/29/2019 8:15:12 PM

Action Type Old Value New Value
Added Reference 
http://www.openwall.com/lists/oss-security/2019/10/29/3 [No Types Assigned]

CVE Modified by MITRE 10/24/2019 8:15:12 AM

Action Type Old Value New Value
Added Reference 
http://www.openwall.com/lists/oss-security/2019/10/24/1 [No Types Assigned]

CVE Modified by MITRE 10/07/2019 5:15:13 PM

Action Type Old Value New Value
Added Reference 
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00029.html [No Types Assigned]

CVE Modified by MITRE 10/03/2019 2:15:11 PM

Action Type Old Value New Value
Added Reference 
http://lists.opensuse.org/opensuse-security-announce/2019-10/msg00007.html [No Types Assigned]

CVE Modified by MITRE 9/23/2019 11:15:11 AM

Action Type Old Value New Value
Added Reference 
https://lists.apache.org/thread.html/24e54e3c6b2259e3903b6b8fe26896ac649c481ea99c5739468c92a3@%3Cdev.dlab.apache.org%3E [No Types Assigned]

CVE Modified by MITRE 9/06/2019 11:15:12 AM

Action Type Old Value New Value
Added Reference 
https://lists.fedoraproject.org/archives/list/[email protected]/message/DLC52IOJN6IQJWJ6CUI6AIUP6GVVG2QP/ [No Types Assigned]
Added Reference 
https://lists.fedoraproject.org/archives/list/[email protected]/message/EGZKRCKI3Y7FMADO2MENMT4TU24QGHFR/ [No Types Assigned]

CVE Modified by MITRE 8/30/2019 5:15:21 AM

Action Type Old Value New Value
Added Reference 
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00084.html [No Types Assigned]

CVE Modified by MITRE 7/08/2019 2:15:12 PM

Action Type Old Value New Value
Added Reference 
https://usn.ubuntu.com/4048-1/ [No Types Assigned]

CVE Modified by MITRE 7/06/2019 8:15:11 PM

Action Type Old Value New Value
Added Reference 
http://www.openwall.com/lists/oss-security/2019/07/06/3 [No Types Assigned]
Added Reference 
http://www.openwall.com/lists/oss-security/2019/07/06/4 [No Types Assigned]

CVE Modified by MITRE 6/28/2019 5:15:12 PM

Action Type Old Value New Value
Added Reference 
http://www.openwall.com/lists/oss-security/2019/06/28/2 [No Types Assigned]

CVE Modified by MITRE 6/03/2019 2:29:01 PM

Action Type Old Value New Value
Added Reference 
http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00015.html [No Types Assigned]

CVE Modified by MITRE 6/03/2019 11:29:08 AM

Action Type Old Value New Value
Added Reference 
http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00011.html [No Types Assigned]

CVE Modified by MITRE 5/31/2019 5:29:02 PM

Action Type Old Value New Value
Added Reference 
http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00073.html [No Types Assigned]

CVE Modified by MITRE 5/27/2019 8:29:00 AM

Action Type Old Value New Value
Added Reference 
http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00060.html [No Types Assigned]

CVE Modified by MITRE 5/24/2019 1:29:02 PM

Action Type Old Value New Value
Added Reference 
https://lists.apache.org/thread.html/a585f64d14c31ab393b90c5f17e41d9765a1a17eec63856ce750af46@%3Cdev.dlab.apache.org%3E [No Types Assigned]
Added Reference 
https://lists.apache.org/thread.html/acacf018c12636e41667e94ac0a1e9244e887eef2debdd474640aa6e@%3Cdev.dlab.apache.org%3E [No Types Assigned]

Modified Analysis by NIST 5/13/2019 2:12:20 PM

Action Type Old Value New Value
Added CPE Configuration 
OR
 *cpe:2.3:o:fedoraproject:fedora:29:*:*:*:*:*:*:*
 *cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*
Changed Reference Type 
http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00044.html No Types Assigned


 
http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00044.html Mailing List, Third Party Advisory
Changed Reference Type 
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00074.html No Types Assigned


 
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00074.html Mailing List, Third Party Advisory
Changed Reference Type 
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00091.html No Types Assigned


 
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00091.html Mailing List, Third Party Advisory
Changed Reference Type 
https://access.redhat.com/errata/RHSA-2019:0975 No Types Assigned


 
https://access.redhat.com/errata/RHSA-2019:0975 Third Party Advisory
Changed Reference Type 
https://azure.microsoft.com/en-us/updates/cve-2019-5736-and-runc-vulnerability/ No Types Assigned


 
https://azure.microsoft.com/en-us/updates/cve-2019-5736-and-runc-vulnerability/ Third Party Advisory
Changed Reference Type 
https://azure.microsoft.com/en-us/updates/iot-edge-fix-cve-2019-5736/ No Types Assigned


 
https://azure.microsoft.com/en-us/updates/iot-edge-fix-cve-2019-5736/ Third Party Advisory
Changed Reference Type 
https://lists.fedoraproject.org/archives/list/[email protected]/message/SWFJGIPYAAAMVSWWI3QWYXGA3ZBU2H4W/ No Types Assigned


 
https://lists.fedoraproject.org/archives/list/[email protected]/message/SWFJGIPYAAAMVSWWI3QWYXGA3ZBU2H4W/ Third Party Advisory
Changed Reference Type 
https://lists.fedoraproject.org/archives/list/[email protected]/message/V6A4OSFM5GGOWW4ECELV5OHX2XRAUSPH/ No Types Assigned


 
https://lists.fedoraproject.org/archives/list/[email protected]/message/V6A4OSFM5GGOWW4ECELV5OHX2XRAUSPH/ Third Party Advisory
Changed Reference Type 
https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03410944 No Types Assigned


 
https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03410944 Third Party Advisory

CVE Modified by MITRE 5/08/2019 5:29:02 PM

Action Type Old Value New Value
Added Reference 
https://azure.microsoft.com/en-us/updates/cve-2019-5736-and-runc-vulnerability/ [No Types Assigned]
Added Reference 
https://azure.microsoft.com/en-us/updates/iot-edge-fix-cve-2019-5736/ [No Types Assigned]

CVE Modified by MITRE 5/07/2019 3:29:09 AM

Action Type Old Value New Value
Added Reference 
https://access.redhat.com/errata/RHSA-2019:0975 [No Types Assigned]

CVE Modified by MITRE 5/05/2019 1:29:00 PM

Action Type Old Value New Value
Added Reference 
https://softwaresupport.softwaregrp.com/document/-/facetsearch/document/KM03410944 [No Types Assigned]

CVE Modified by MITRE 5/03/2019 2:29:00 AM

Action Type Old Value New Value
Added Reference 
https://lists.fedoraproject.org/archives/list/[email protected]/message/SWFJGIPYAAAMVSWWI3QWYXGA3ZBU2H4W/ [No Types Assigned]

CVE Modified by MITRE 5/02/2019 11:29:01 PM

Action Type Old Value New Value
Added Reference 
https://lists.fedoraproject.org/archives/list/[email protected]/message/V6A4OSFM5GGOWW4ECELV5OHX2XRAUSPH/ [No Types Assigned]

CVE Modified by MITRE 4/25/2019 6:29:01 PM

Action Type Old Value New Value
Added Reference 
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00091.html [No Types Assigned]

CVE Modified by MITRE 4/17/2019 5:29:03 PM

Action Type Old Value New Value
Added Reference 
http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00074.html [No Types Assigned]

CVE Modified by MITRE 3/29/2019 9:29:01 PM

Action Type Old Value New Value
Added Reference 
http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00044.html [No Types Assigned]

Modified Analysis by NIST 3/28/2019 9:32:53 PM

Action Type Old Value New Value
Added CPE Configuration 
OR
 *cpe:2.3:a:apache:mesos:*:*:*:*:*:*:*:* versions from (including) 1.4.0 up to (including) 1.7.0
Added CPE Configuration 
OR
 *cpe:2.3:a:mesosphere:kubernetes_engine:*:*:*:*:*:*:*:* versions up to (excluding) 2.2.0-1.13.3
 *cpe:2.3:o:mesosphere:dc\/os:*:*:*:*:*:*:*:* versions up to (excluding) 1.10.10
 *cpe:2.3:o:mesosphere:dc\/os:*:*:*:*:*:*:*:* versions from (including) 1.10.11 up to (excluding) 1.11.9
 *cpe:2.3:o:mesosphere:dc\/os:*:*:*:*:*:*:*:* versions from (including) 1.11.10 up to (excluding) 1.12.1
Added CPE Configuration 
OR
 *cpe:2.3:a:netapp:element_software_management:-:*:*:*:*:*:*:*
Added CPE Configuration 
OR
 *cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*
 *cpe:2.3:o:opensuse:leap:42.3:*:*:*:*:*:*:*
Changed Reference Type 
http://www.openwall.com/lists/oss-security/2019/03/23/1 No Types Assigned


 
http://www.openwall.com/lists/oss-security/2019/03/23/1 Mailing List, Third Party Advisory
Changed Reference Type 
https://blog.dragonsector.pl/2019/02/cve-2019-5736-escape-from-docker-and.html No Types Assigned


 
https://blog.dragonsector.pl/2019/02/cve-2019-5736-escape-from-docker-and.html Exploit, Mitigation, Third Party Advisory
Changed Reference Type 
https://bugzilla.suse.com/show_bug.cgi?id=1121967 No Types Assigned


 
https://bugzilla.suse.com/show_bug.cgi?id=1121967 Issue Tracking, Third Party Advisory
Changed Reference Type 
https://lists.apache.org/thread.html/a258757af84c5074dc7bf932622020fd4f60cef65a84290380386706@%3Cuser.mesos.apache.org%3E No Types Assigned


 
https://lists.apache.org/thread.html/a258757af84c5074dc7bf932622020fd4f60cef65a84290380386706@%3Cuser.mesos.apache.org%3E Mailing List, Third Party Advisory
Changed Reference Type 
https://lists.apache.org/thread.html/b162dd624dc088cd634292f0402282a1d1d0ce853baeae8205bc033c@%3Cdev.mesos.apache.org%3E No Types Assigned


 
https://lists.apache.org/thread.html/b162dd624dc088cd634292f0402282a1d1d0ce853baeae8205bc033c@%3Cdev.mesos.apache.org%3E Mailing List, Third Party Advisory
Changed Reference Type 
https://security.netapp.com/advisory/ntap-20190307-0008/ No Types Assigned


 
https://security.netapp.com/advisory/ntap-20190307-0008/ Third Party Advisory
Changed Reference Type 
https://support.mesosphere.com/s/article/Known-Issue-Container-Runtime-Vulnerability-MSPH-2019-0003 No Types Assigned


 
https://support.mesosphere.com/s/article/Known-Issue-Container-Runtime-Vulnerability-MSPH-2019-0003 Exploit, Patch, Third Party Advisory

CVE Modified by MITRE 3/27/2019 4:29:04 PM

Action Type Old Value New Value
Added Reference 
https://support.mesosphere.com/s/article/Known-Issue-Container-Runtime-Vulnerability-MSPH-2019-0003 [No Types Assigned]

CVE Modified by MITRE 3/25/2019 12:29:04 PM

Action Type Old Value New Value
Added Reference 
https://blog.dragonsector.pl/2019/02/cve-2019-5736-escape-from-docker-and.html [No Types Assigned]
Added Reference 
https://bugzilla.suse.com/show_bug.cgi?id=1121967 [No Types Assigned]

CVE Modified by MITRE 3/23/2019 2:29:00 PM

Action Type Old Value New Value
Added Reference 
http://www.openwall.com/lists/oss-security/2019/03/23/1 [No Types Assigned]

CVE Modified by MITRE 3/23/2019 12:29:00 PM

Action Type Old Value New Value
Added Reference 
https://lists.apache.org/thread.html/a258757af84c5074dc7bf932622020fd4f60cef65a84290380386706@%3Cuser.mesos.apache.org%3E [No Types Assigned]
Added Reference 
https://lists.apache.org/thread.html/b162dd624dc088cd634292f0402282a1d1d0ce853baeae8205bc033c@%3Cdev.mesos.apache.org%3E [No Types Assigned]

CVE Modified by MITRE 3/08/2019 6:29:07 AM

Action Type Old Value New Value
Added Reference 
https://security.netapp.com/advisory/ntap-20190307-0008/ [No Types Assigned]

Modified Analysis by NIST 3/04/2019 10:39:35 AM

Action Type Old Value New Value
Added CPE Configuration 
OR
 *cpe:2.3:a:hp:onesphere:-:*:*:*:*:*:*:*
Changed Reference Type 
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03913en_us No Types Assigned


 
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03913en_us Third Party Advisory

CVE Modified by MITRE 3/02/2019 6:29:03 AM

Action Type Old Value New Value
Added Reference 
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbhf03913en_us [No Types Assigned]

Modified Analysis by NIST 2/27/2019 9:39:24 AM

Action Type Old Value New Value
Changed CPE Configuration 
OR
 *cpe:2.3:a:docker:docker:*:*:*:*:*:*:*:* versions up to (including) 18.09.2


 
OR
 *cpe:2.3:a:docker:docker:*:*:*:*:*:*:*:* versions up to (excluding) 18.09.2
Changed CPE Configuration 
OR
 *cpe:2.3:a:redhat:openshift:3.9:*:*:*:enterprise:*:*:*
 *cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
 *cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*


 
OR
 *cpe:2.3:a:redhat:openshift:3.4:*:*:*:*:*:*:*
 *cpe:2.3:a:redhat:openshift:3.5:*:*:*:*:*:*:*
 *cpe:2.3:a:redhat:openshift:3.6:*:*:*:*:*:*:*
 *cpe:2.3:a:redhat:openshift:3.7:*:*:*:*:*:*:*
 *cpe:2.3:a:redhat:openshift:3.9:*:*:*:enterprise:*:*:*
 *cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
 *cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
Changed Reference Type 
http://www.securityfocus.com/bid/106976 Third Party Advisory


 
http://www.securityfocus.com/bid/106976 Third Party Advisory, VDB Entry
Changed Reference Type 
https://access.redhat.com/errata/RHSA-2019:0401 No Types Assigned


 
https://access.redhat.com/errata/RHSA-2019:0401 Third Party Advisory
Changed Reference Type 
https://access.redhat.com/errata/RHSA-2019:0408 No Types Assigned


 
https://access.redhat.com/errata/RHSA-2019:0408 Third Party Advisory
Changed Reference Type 
https://www.exploit-db.com/exploits/46359/ Exploit, Third Party Advisory


 
https://www.exploit-db.com/exploits/46359/ Exploit, Third Party Advisory, VDB Entry
Changed Reference Type 
https://www.exploit-db.com/exploits/46369/ Exploit, Third Party Advisory


 
https://www.exploit-db.com/exploits/46369/ Exploit, Third Party Advisory, VDB Entry
Changed Reference Type 
https://www.synology.com/security/advisory/Synology_SA_19_06 No Types Assigned


 
https://www.synology.com/security/advisory/Synology_SA_19_06 Third Party Advisory

CVE Modified by MITRE 2/27/2019 6:29:04 AM

Action Type Old Value New Value
Added Reference 
https://access.redhat.com/errata/RHSA-2019:0408 [No Types Assigned]

CVE Modified by MITRE 2/26/2019 6:29:01 AM

Action Type Old Value New Value
Added Reference 
https://access.redhat.com/errata/RHSA-2019:0401 [No Types Assigned]

CVE Modified by MITRE 2/23/2019 6:29:00 AM

Action Type Old Value New Value
Added Reference 
https://www.synology.com/security/advisory/Synology_SA_19_06 [No Types Assigned]

Initial Analysis by NIST 2/19/2019 4:34:53 PM

Action Type Old Value New Value
Added CVSS V3 
AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Added CVSS V2 
(AV:N/AC:M/Au:N/C:C/I:C/A:C)
Added CWE 
CWE-216
Added CPE Configuration 
OR
 *cpe:2.3:a:docker:docker:*:*:*:*:*:*:*:* versions up to (including) 18.09.2
Added CPE Configuration 
OR
 *cpe:2.3:a:google:kubernetes_engine:-:*:*:*:*:*:*:*
Added CPE Configuration 
OR
 *cpe:2.3:a:linuxcontainers:lxc:-:*:*:*:*:*:*:*
Added CPE Configuration 
OR
 *cpe:2.3:a:opencontainers:runc:*:*:*:*:*:*:*:* versions up to (including) 1.0
Added CPE Configuration 
OR
 *cpe:2.3:a:opencontainers:runc:1.0:rc1:*:*:*:*:*:*
 *cpe:2.3:a:opencontainers:runc:1.0:rc2:*:*:*:*:*:*
 *cpe:2.3:a:opencontainers:runc:1.0:rc3:*:*:*:*:*:*
 *cpe:2.3:a:opencontainers:runc:1.0:rc4:*:*:*:*:*:*
 *cpe:2.3:a:opencontainers:runc:1.0:rc5:*:*:*:*:*:*
 *cpe:2.3:a:opencontainers:runc:1.0:rc6:*:*:*:*:*:*
Added CPE Configuration 
OR
 *cpe:2.3:a:redhat:openshift:3.9:*:*:*:enterprise:*:*:*
 *cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
 *cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
Changed Reference Type 
http://www.securityfocus.com/bid/106976 No Types Assigned


 
http://www.securityfocus.com/bid/106976 Third Party Advisory
Changed Reference Type 
https://access.redhat.com/errata/RHSA-2019:0303 No Types Assigned


 
https://access.redhat.com/errata/RHSA-2019:0303 Third Party Advisory
Changed Reference Type 
https://access.redhat.com/errata/RHSA-2019:0304 No Types Assigned


 
https://access.redhat.com/errata/RHSA-2019:0304 Third Party Advisory
Changed Reference Type 
https://access.redhat.com/security/cve/cve-2019-5736 No Types Assigned


 
https://access.redhat.com/security/cve/cve-2019-5736 Third Party Advisory
Changed Reference Type 
https://access.redhat.com/security/vulnerabilities/runcescape No Types Assigned


 
https://access.redhat.com/security/vulnerabilities/runcescape Third Party Advisory
Changed Reference Type 
https://aws.amazon.com/security/security-bulletins/AWS-2019-002/ No Types Assigned


 
https://aws.amazon.com/security/security-bulletins/AWS-2019-002/ Third Party Advisory
Changed Reference Type 
https://brauner.github.io/2019/02/12/privileged-containers.html No Types Assigned


 
https://brauner.github.io/2019/02/12/privileged-containers.html Exploit, Technical Description, Third Party Advisory
Changed Reference Type 
https://cloud.google.com/kubernetes-engine/docs/security-bulletins#february-11-2019-runc No Types Assigned


 
https://cloud.google.com/kubernetes-engine/docs/security-bulletins#february-11-2019-runc Third Party Advisory
Changed Reference Type 
https://github.com/Frichetten/CVE-2019-5736-PoC No Types Assigned


 
https://github.com/Frichetten/CVE-2019-5736-PoC Third Party Advisory
Changed Reference Type 
https://github.com/docker/docker-ce/releases/tag/v18.09.2 No Types Assigned


 
https://github.com/docker/docker-ce/releases/tag/v18.09.2 Release Notes, Third Party Advisory, Vendor Advisory
Changed Reference Type 
https://github.com/opencontainers/runc/commit/0a8e4117e7f715d5fbeef398405813ce8e88558b No Types Assigned


 
https://github.com/opencontainers/runc/commit/0a8e4117e7f715d5fbeef398405813ce8e88558b Patch, Third Party Advisory
Changed Reference Type 
https://github.com/opencontainers/runc/commit/6635b4f0c6af3810594d2770f662f34ddc15b40d No Types Assigned


 
https://github.com/opencontainers/runc/commit/6635b4f0c6af3810594d2770f662f34ddc15b40d Patch, Third Party Advisory
Changed Reference Type 
https://github.com/q3k/cve-2019-5736-poc No Types Assigned


 
https://github.com/q3k/cve-2019-5736-poc Third Party Advisory
Changed Reference Type 
https://github.com/rancher/runc-cve No Types Assigned


 
https://github.com/rancher/runc-cve Third Party Advisory
Changed Reference Type 
https://kubernetes.io/blog/2019/02/11/runc-and-cve-2019-5736/ No Types Assigned


 
https://kubernetes.io/blog/2019/02/11/runc-and-cve-2019-5736/ Third Party Advisory
Changed Reference Type 
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190215-runc No Types Assigned


 
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190215-runc Third Party Advisory
Changed Reference Type 
https://www.exploit-db.com/exploits/46359/ No Types Assigned


 
https://www.exploit-db.com/exploits/46359/ Exploit, Third Party Advisory
Changed Reference Type 
https://www.exploit-db.com/exploits/46369/ No Types Assigned


 
https://www.exploit-db.com/exploits/46369/ Exploit, Third Party Advisory
Changed Reference Type 
https://www.openwall.com/lists/oss-security/2019/02/11/2 No Types Assigned


 
https://www.openwall.com/lists/oss-security/2019/02/11/2 Mailing List, Patch, Third Party Advisory
Changed Reference Type 
https://www.twistlock.com/2019/02/11/how-to-mitigate-cve-2019-5736-in-runc-and-docker/ No Types Assigned


 
https://www.twistlock.com/2019/02/11/how-to-mitigate-cve-2019-5736-in-runc-and-docker/ Third Party Advisory
Added CVSS V2 Metadata 
Victim must voluntarily interact with attack mechanism

CVE Modified by MITRE 2/18/2019 11:29:00 AM

Action Type Old Value New Value
Added Reference 
https://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20190215-runc [No Types Assigned]

CVE Modified by MITRE 2/16/2019 4:29:00 PM

Action Type Old Value New Value
Added Reference 
https://github.com/Frichetten/CVE-2019-5736-PoC [No Types Assigned]
Added Reference 
https://github.com/q3k/cve-2019-5736-poc [No Types Assigned]

CVE Modified by MITRE 2/15/2019 6:29:00 AM

Action Type Old Value New Value
Added Reference 
https://www.exploit-db.com/exploits/46369/ [No Types Assigned]

CVE Modified by MITRE 2/13/2019 6:30:09 AM

Action Type Old Value New Value
Added Reference 
http://www.securityfocus.com/bid/106976 [No Types Assigned]
Added Reference 
https://www.exploit-db.com/exploits/46359/ [No Types Assigned]

CVE Modified by MITRE 2/12/2019 7:29:00 PM

Action Type Old Value New Value
Added Reference 
https://kubernetes.io/blog/2019/02/11/runc-and-cve-2019-5736/ [No Types Assigned]

CVE Modified by MITRE 2/12/2019 6:29:03 AM

Action Type Old Value New Value
Added Reference 
https://access.redhat.com/errata/RHSA-2019:0303 [No Types Assigned]
Added Reference 
https://access.redhat.com/errata/RHSA-2019:0304 [No Types Assigned]

CVE Modified by MITRE 2/11/2019 11:29:00 PM

Action Type Old Value New Value
Added Reference 
https://aws.amazon.com/security/security-bulletins/AWS-2019-002/ [No Types Assigned]
Added Reference 
https://brauner.github.io/2019/02/12/privileged-containers.html [No Types Assigned]
Added Reference 
https://cloud.google.com/kubernetes-engine/docs/security-bulletins#february-11-2019-runc [No Types Assigned]
Added Reference 
https://github.com/rancher/runc-cve [No Types Assigned]
Added Reference 
https://www.twistlock.com/2019/02/11/how-to-mitigate-cve-2019-5736-in-runc-and-docker/ [No Types Assigned]

Quick Info

CVE Dictionary Entry:
CVE-2019-5736
NVD Published Date:
02/11/2019
NVD Last Modified:
06/16/2026
Source:
MITRE