{
  "schema_version": "1.3.1",
  "id": "GO-2021-0085",
  "modified": "0001-01-01T00:00:00Z",
  "published": "2021-04-14T20:04:52Z",
  "aliases": [
    "CVE-2019-16884",
    "GHSA-fgv8-vj5c-2ppq"
  ],
  "summary": "Authorization bypass in github.com/opencontainers/runc",
  "details": "AppArmor restrictions may be bypassed due to improper validation of mount targets, allowing a malicious image to mount volumes over e.g. /proc.",
  "affected": [
    {
      "package": {
        "name": "github.com/opencontainers/runc",
        "ecosystem": "Go"
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.0.0-rc8.0.20190930145003-cad42f6e0932"
            }
          ]
        }
      ],
      "ecosystem_specific": {
        "imports": [
          {
            "path": "github.com/opencontainers/runc/libcontainer/apparmor",
            "symbols": [
              "ApplyProfile"
            ]
          },
          {
            "path": "github.com/opencontainers/runc/libcontainer/utils",
            "symbols": [
              "CloseExecFrom"
            ]
          }
        ]
      }
    },
    {
      "package": {
        "name": "github.com/opencontainers/selinux",
        "ecosystem": "Go"
      },
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.3.1-0.20190929122143-5215b1806f52"
            }
          ]
        }
      ],
      "ecosystem_specific": {
        "imports": [
          {
            "path": "github.com/opencontainers/selinux/go-selinux",
            "symbols": [
              "readCon",
              "writeCon"
            ]
          }
        ]
      }
    }
  ],
  "references": [
    {
      "type": "FIX",
      "url": "https://github.com/opencontainers/runc/pull/2130"
    },
    {
      "type": "FIX",
      "url": "https://github.com/opencontainers/runc/commit/cad42f6e0932db0ce08c3a3d9e89e6063ec283e4"
    },
    {
      "type": "FIX",
      "url": "https://github.com/opencontainers/selinux/commit/03b517dc4fd57245b1cf506e8ba7b817b6d309da"
    },
    {
      "type": "WEB",
      "url": "https://github.com/opencontainers/runc/issues/2128"
    }
  ],
  "credits": [
    {
      "name": "Leopold Schabel"
    }
  ],
  "database_specific": {
    "url": "https://pkg.go.dev/vuln/GO-2021-0085"
  }
}