module: github.com/opencontainers/runc
package: github.com/opencontainers/runc/libcontainer/user
versions:
  - fixed: v0.1.0
description: |
  GetExecUser in the github.com/opencontainers/runc/libcontainer/user package will
  improperly interpret numeric UIDs as usernames. If the method is used without
  verifying that usernames are formatted as expected, it may allow a user to
  gain unexpected privileges.
cves:
  - CVE-2016-3697
symbols:
  - GetExecUser
links:
  pr: https://github.com/opencontainers/runc/pull/708
  commit: https://github.com/opencontainers/runc/commit/69af385de62ea68e2e608335cffbb0f4aa3db091
  context:
    - https://github.com/docker/docker/issues/21436
    - http://rhn.redhat.com/errata/RHSA-2016-1034.html
    - http://rhn.redhat.com/errata/RHSA-2016-2634.html
    - https://security.gentoo.org/glsa/201612-28