Threats tagged 'ghsa-cwhr-hwj2-cjrp'

A vulnerability in crun versions 1.29.1 and earlier allows reopening /dev/null for stdio after pivot_root to follow a symlink, potentially attaching a host file to container stdio and changing its ownership. Default configurations that mount a fresh /dev are not affected. No fixed release was initially available, but Red Hat has released an update in crun 1.30-1.hum1 addressing this issue.