{"answers":{"affected":"It affects 19 products.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2019-5736 exists.","fix":"Upgrade to a fixed version.","what":"CVE-2019-5736 is a high-severity vulnerability in Canonical Ubuntu Linux, published on 11 Feb 2019. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for CVE-2019-5736 and fix it if it is affected.\n\nWhat it is: CVE-2019-5736 is a high-severity vulnerability in Canonical Ubuntu Linux, published on 11 Feb 2019. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2019-5736 exists.\n\nAffected product: Canonical Ubuntu Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2019-5736/ (Markdown: https://insights.sbomify.com/CVE-2019-5736/index.md)","id":"CVE-2019-5736","markdown":"https://insights.sbomify.com/CVE-2019-5736/index.md","name":"CVE-2019-5736","record":{"aliases":["ALPINE-CVE-2019-5736","ALSA-2019:0975","CLEANSTART-2026-BP85403","DEBIAN-CVE-2019-5736","GHSA-gxmr-w5mj-v8hh","MGASA-2019-0068","MGASA-2019-0087","RHSA-2019:0303","RHSA-2019:0304","RHSA-2019:0408","RHSA-2019:0975","RLSA-2019:0975","SUSE-SU-2019:0362-1","SUSE-SU-2019:0385-1","UBUNTU-CVE-2019-5736","openSUSE-SU-2019:0252-1","openSUSE-SU-2019:2245-1","openSUSE-SU-2019:2286-1"],"analysis":{"component_type":"container_or_infrastructure","fix_type":"upgrade","impacts":["privilege_escalation","code_execution"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"runc container runtime","requires_auth":"none","summary":"Attackers with container access can overwrite the host runc binary to gain root privileges on the host system.","user_interaction":"required","vuln_class":"privilege_escalation"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"mitre","cpe":[{"product":"mesos","vendor":"apache"},{"product":"ubuntu_linux","vendor":"canonical"},{"product":"dc\\/os","vendor":"d2iq"},{"product":"kubernetes_engine","vendor":"d2iq"},{"product":"docker","vendor":"docker"},{"product":"fedora","vendor":"fedoraproject"},{"product":"kubernetes_engine","vendor":"google"},{"product":"onesphere","vendor":"hp"},{"product":"lxc","vendor":"linuxcontainers"},{"product":"runc","vendor":"linuxfoundation"},{"product":"service_management_automation","vendor":"microfocus"},{"product":"hci_management_node","vendor":"netapp"},{"product":"solidfire","vendor":"netapp"},{"product":"backports_sle","vendor":"opensuse"},{"product":"leap","vendor":"opensuse"},{"product":"container_development_kit","vendor":"redhat"},{"product":"enterprise_linux","vendor":"redhat"},{"product":"enterprise_linux_server","vendor":"redhat"},{"product":"openshift","vendor":"redhat"}],"cvss":{"score":8.6,"severity":"high","source":"nvd","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H","version":"3.1"},"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"}],"description":"runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a command as root within one of these types of containers: (1) a new container with an attacker-controlled image, or (2) an existing container, to which the attacker previously had write access, that can be attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/self/exe.","ecosystems":["AlmaLinux:8","Red Hat:enterprise_linux:8::appstream","Red Hat:openshift:3.4::el7","Red Hat:openshift:3.5::el7","Red Hat:openshift:3.6::el7","Red Hat:openshift:3.7::el7","Red Hat:rhel_extras_other:7","Rocky Linux:8","SUSE:Linux Enterprise Module for Containers 12","SUSE:Linux Enterprise Module for Containers 15","SUSE:OpenStack Cloud 6-LTSS","SUSE:Package Hub 15 SP1","openSUSE:Leap 15.1"],"exploits":{"exploitdb":2,"first_seen":"2019-01-01","github_poc":28,"max_poc_stars":659,"metasploit":1,"nuclei":0,"refs":[{"date":"2019-02-13T05:26:32Z","kind":"github_poc","ref":"https://github.com/Frichetten/CVE-2019-5736-PoC","stars":659,"title":"PoC for CVE-2019-5736"},{"date":"2019-02-12T22:07:47Z","kind":"github_poc","ref":"https://github.com/q3k/cve-2019-5736-poc","stars":211,"title":"Unweaponized Proof of Concept for CVE-2019-5736 (Docker escape)"},{"date":"2019-02-20T12:23:13Z","kind":"github_poc","ref":"https://github.com/twistlock/RunC-CVE-2019-5736","stars":86,"title":"CVE-2019-5736 POCs"},{"date":"2019-02-14T02:30:12Z","kind":"github_poc","ref":"https://github.com/jas502n/CVE-2019-5736","stars":14,"title":"runc容器逃逸漏洞预警"},{"date":"2019-02-15T09:22:27Z","kind":"github_poc","ref":"https://github.com/agppp/cve-2019-5736-poc","stars":7,"title":"getshell test"},{"date":"2019-12-12T16:57:13Z","kind":"github_poc","ref":"https://github.com/epsteina16/Docker-Escape-Miner","stars":3,"title":"Code sample for using exploit CVE-2019-5736 to mine bitcoin with no association to original container or user."},{"date":"2019-02-14T08:37:25Z","kind":"github_poc","ref":"https://github.com/likekabin/CVE-2019-5736","stars":1,"title":null},{"date":"2019-02-19T15:34:18Z","kind":"github_poc","ref":"https://github.com/b3d3c/poc-cve-2019-5736","stars":1,"title":null}],"tier":"weaponised"},"has_fix":true,"headline":"Privilege escalation in n/a","id":"CVE-2019-5736","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":"canonical:ubuntu_linux","products":["canonical:ubuntu_linux","fedoraproject:fedora","netapp:hci_management_node","netapp:solidfire","opensuse:backports_sle","opensuse:leap","redhat:enterprise_linux","redhat:enterprise_linux_server","redhat:openshift"],"type":"privilege_escalation","year":"2019"},"n_packages":94,"n_references":66,"next":{"headline":"Denial of service in Node.js","id":"CVE-2019-5737"},"packages":[{"ecosystem":"AlmaLinux:8","fixed":["1:0.1.15-2.git2d0b8a3.module_el8.3.0+2044+12421f43"],"introduced":["0"],"last_affected":[],"package":"oci-systemd-hook","purl":"pkg:rpm/almalinux/oci-systemd-hook","source":"ALSA-2019:0975"},{"ecosystem":"AlmaLinux:8","fixed":["1:0.1.15-2.git2d0b8a3.module_el8.4.0+2496+12421f43"],"introduced":["0"],"last_affected":[],"package":"oci-systemd-hook","purl":"pkg:rpm/almalinux/oci-systemd-hook","source":"ALSA-2019:0975"},{"ecosystem":"AlmaLinux:8","fixed":["1:0.1.15-2.git2d0b8a3.module_el8.5.0+119+9a9ec082"],"introduced":["0"],"last_affected":[],"package":"oci-systemd-hook","purl":"pkg:rpm/almalinux/oci-systemd-hook","source":"ALSA-2019:0975"},{"ecosystem":"AlmaLinux:8","fixed":["2:2.3.4-2.git87f9237.module_el8.3.0+2044+12421f43"],"introduced":["0"],"last_affected":[],"package":"oci-umount","purl":"pkg:rpm/almalinux/oci-umount","source":"ALSA-2019:0975"},{"ecosystem":"AlmaLinux:8","fixed":["2:2.3.4-2.git87f9237.module_el8.4.0+2496+12421f43"],"introduced":["0"],"last_affected":[],"package":"oci-umount","purl":"pkg:rpm/almalinux/oci-umount","source":"ALSA-2019:0975"},{"ecosystem":"AlmaLinux:8","fixed":["2:2.3.4-2.git87f9237.module_el8.5.0+119+9a9ec082"],"introduced":["0"],"last_affected":[],"package":"oci-umount","purl":"pkg:rpm/almalinux/oci-umount","source":"ALSA-2019:0975"},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","fixed":["0:1.5-3.gite94b4f9.module+el8.0.0+2958+4e823551"],"introduced":["0"],"last_affected":[],"package":"buildah","purl":"pkg:rpm/redhat/buildah","source":"RHSA-2019:0975"},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","fixed":["0:1.5-3.gite94b4f9.module+el8.0.0+2958+4e823551"],"introduced":["0"],"last_affected":[],"package":"buildah-debuginfo","purl":"pkg:rpm/redhat/buildah-debuginfo","source":"RHSA-2019:0975"},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","fixed":["0:1.5-3.gite94b4f9.module+el8.0.0+2958+4e823551"],"introduced":["0"],"last_affected":[],"package":"buildah-debugsource","purl":"pkg:rpm/redhat/buildah-debugsource","source":"RHSA-2019:0975"},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","fixed":["2:2.94-1.git1e99f1d.module+el8.0.0+2958+4e823551"],"introduced":["0"],"last_affected":[],"package":"container-selinux","purl":"pkg:rpm/redhat/container-selinux","source":"RHSA-2019:0975"},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","fixed":["0:0.7.4-3.git9ebe139.module+el8.0.0+2958+4e823551"],"introduced":["0"],"last_affected":[],"package":"containernetworking-plugins","purl":"pkg:rpm/redhat/containernetworking-plugins","source":"RHSA-2019:0975"},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","fixed":["0:0.7.4-3.git9ebe139.module+el8.0.0+2958+4e823551"],"introduced":["0"],"last_affected":[],"package":"containernetworking-plugins-debuginfo","purl":"pkg:rpm/redhat/containernetworking-plugins-debuginfo","source":"RHSA-2019:0975"},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","fixed":["0:0.7.4-3.git9ebe139.module+el8.0.0+2958+4e823551"],"introduced":["0"],"last_affected":[],"package":"containernetworking-plugins-debugsource","purl":"pkg:rpm/redhat/containernetworking-plugins-debugsource","source":"RHSA-2019:0975"},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","fixed":["1:0.1.32-3.git1715c90.module+el8.0.0+2958+4e823551"],"introduced":["0"],"last_affected":[],"package":"containers-common","purl":"pkg:rpm/redhat/containers-common","source":"RHSA-2019:0975"},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","fixed":["0:0.3-2.module+el8.0.0+2958+4e823551"],"introduced":["0"],"last_affected":[],"package":"fuse-overlayfs","purl":"pkg:rpm/redhat/fuse-overlayfs","source":"RHSA-2019:0975"},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","fixed":["0:0.3-2.module+el8.0.0+2958+4e823551"],"introduced":["0"],"last_affected":[],"package":"fuse-overlayfs-debuginfo","purl":"pkg:rpm/redhat/fuse-overlayfs-debuginfo","source":"RHSA-2019:0975"},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","fixed":["0:0.3-2.module+el8.0.0+2958+4e823551"],"introduced":["0"],"last_affected":[],"package":"fuse-overlayfs-debugsource","purl":"pkg:rpm/redhat/fuse-overlayfs-debugsource","source":"RHSA-2019:0975"},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","fixed":["1:0.1.15-2.git2d0b8a3.module+el8.0.0+2958+4e823551"],"introduced":["0"],"last_affected":[],"package":"oci-systemd-hook","purl":"pkg:rpm/redhat/oci-systemd-hook","source":"RHSA-2019:0975"},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","fixed":["1:0.1.15-2.git2d0b8a3.module+el8.0.0+2958+4e823551"],"introduced":["0"],"last_affected":[],"package":"oci-systemd-hook-debuginfo","purl":"pkg:rpm/redhat/oci-systemd-hook-debuginfo","source":"RHSA-2019:0975"},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","fixed":["1:0.1.15-2.git2d0b8a3.module+el8.0.0+2958+4e823551"],"introduced":["0"],"last_affected":[],"package":"oci-systemd-hook-debugsource","purl":"pkg:rpm/redhat/oci-systemd-hook-debugsource","source":"RHSA-2019:0975"},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","fixed":["2:2.3.4-2.git87f9237.module+el8.0.0+2958+4e823551"],"introduced":["0"],"last_affected":[],"package":"oci-umount","purl":"pkg:rpm/redhat/oci-umount","source":"RHSA-2019:0975"},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","fixed":["2:2.3.4-2.git87f9237.module+el8.0.0+2958+4e823551"],"introduced":["0"],"last_affected":[],"package":"oci-umount-debuginfo","purl":"pkg:rpm/redhat/oci-umount-debuginfo","source":"RHSA-2019:0975"},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","fixed":["2:2.3.4-2.git87f9237.module+el8.0.0+2958+4e823551"],"introduced":["0"],"last_affected":[],"package":"oci-umount-debugsource","purl":"pkg:rpm/redhat/oci-umount-debugsource","source":"RHSA-2019:0975"},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","fixed":["0:1.0.0-2.git921f98f.module+el8.0.0+2958+4e823551"],"introduced":["0"],"last_affected":[],"package":"podman","purl":"pkg:rpm/redhat/podman","source":"RHSA-2019:0975"},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","fixed":["0:1.0.0-2.git921f98f.module+el8.0.0+2958+4e823551"],"introduced":["0"],"last_affected":[],"package":"podman-debuginfo","purl":"pkg:rpm/redhat/podman-debuginfo","source":"RHSA-2019:0975"},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","fixed":["0:1.0.0-2.git921f98f.module+el8.0.0+2958+4e823551"],"introduced":["0"],"last_affected":[],"package":"podman-debugsource","purl":"pkg:rpm/redhat/podman-debugsource","source":"RHSA-2019:0975"},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","fixed":["0:1.0.0-2.git921f98f.module+el8.0.0+2958+4e823551"],"introduced":["0"],"last_affected":[],"package":"podman-docker","purl":"pkg:rpm/redhat/podman-docker","source":"RHSA-2019:0975"},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","fixed":["0:1.0.0-55.rc5.dev.git2abd837.module+el8.0.0+3049+59fd2bba"],"introduced":["0"],"last_affected":[],"package":"runc","purl":"pkg:rpm/redhat/runc","source":"RHSA-2019:0975"},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","fixed":["0:1.0.0-55.rc5.dev.git2abd837.module+el8.0.0+3049+59fd2bba"],"introduced":["0"],"last_affected":[],"package":"runc-debuginfo","purl":"pkg:rpm/redhat/runc-debuginfo","source":"RHSA-2019:0975"},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","fixed":["0:1.0.0-55.rc5.dev.git2abd837.module+el8.0.0+3049+59fd2bba"],"introduced":["0"],"last_affected":[],"package":"runc-debugsource","purl":"pkg:rpm/redhat/runc-debugsource","source":"RHSA-2019:0975"},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","fixed":["1:0.1.32-3.git1715c90.module+el8.0.0+2958+4e823551"],"introduced":["0"],"last_affected":[],"package":"skopeo","purl":"pkg:rpm/redhat/skopeo","source":"RHSA-2019:0975"},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","fixed":["1:0.1.32-3.git1715c90.module+el8.0.0+2958+4e823551"],"introduced":["0"],"last_affected":[],"package":"skopeo-debuginfo","purl":"pkg:rpm/redhat/skopeo-debuginfo","source":"RHSA-2019:0975"},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","fixed":["1:0.1.32-3.git1715c90.module+el8.0.0+2958+4e823551"],"introduced":["0"],"last_affected":[],"package":"skopeo-debugsource","purl":"pkg:rpm/redhat/skopeo-debugsource","source":"RHSA-2019:0975"},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","fixed":["0:0.1-2.dev.gitc4e1bc5.module+el8.0.0+2958+4e823551"],"introduced":["0"],"last_affected":[],"package":"slirp4netns","purl":"pkg:rpm/redhat/slirp4netns","source":"RHSA-2019:0975"},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","fixed":["0:0.1-2.dev.gitc4e1bc5.module+el8.0.0+2958+4e823551"],"introduced":["0"],"last_affected":[],"package":"slirp4netns-debuginfo","purl":"pkg:rpm/redhat/slirp4netns-debuginfo","source":"RHSA-2019:0975"},{"ecosystem":"Red Hat:enterprise_linux:8::appstream","fixed":["0:0.1-2.dev.gitc4e1bc5.module+el8.0.0+2958+4e823551"],"introduced":["0"],"last_affected":[],"package":"slirp4netns-debugsource","purl":"pkg:rpm/redhat/slirp4netns-debugsource","source":"RHSA-2019:0975"},{"ecosystem":"Red Hat:openshift:3.4::el7","fixed":["2:1.12.6-79.git5680db5.el7"],"introduced":["0"],"last_affected":[],"package":"docker","purl":"pkg:rpm/redhat/docker","source":"RHSA-2019:0408"},{"ecosystem":"Red Hat:openshift:3.4::el7","fixed":["2:1.12.6-79.git5680db5.el7"],"introduced":["0"],"last_affected":[],"package":"docker-client","purl":"pkg:rpm/redhat/docker-client","source":"RHSA-2019:0408"},{"ecosystem":"Red Hat:openshift:3.4::el7","fixed":["2:1.12.6-79.git5680db5.el7"],"introduced":["0"],"last_affected":[],"package":"docker-common","purl":"pkg:rpm/redhat/docker-common","source":"RHSA-2019:0408"},{"ecosystem":"Red Hat:openshift:3.4::el7","fixed":["2:1.12.6-79.git5680db5.el7"],"introduced":["0"],"last_affected":[],"package":"docker-debuginfo","purl":"pkg:rpm/redhat/docker-debuginfo","source":"RHSA-2019:0408"}],"prev":{"headline":"DO NOT USE THIS CANDIDATE NUMBER.","id":"CVE-2019-5735"},"products":["n/a"],"published":"2019-02-11","related":[{"cvss_score":7.8,"headline":"Docker image code execution with Apache Mesos","id":"CVE-2019-0204","kev_date_added":null,"published":"2019-03-25"},{"cvss_score":7.5,"headline":"Stack Overflow in Apache Mesos","id":"CVE-2018-11793","kev_date_added":null,"published":"2019-03-05"},{"cvss_score":7.5,"headline":"Crash when decoding malformed HTTP requests or malformed JSON payload","id":"CVE-2018-1330","kev_date_added":null,"published":"2018-09-13"},{"cvss_score":7.5,"headline":"Denial of service in Apache Mesos","id":"CVE-2017-7687","kev_date_added":null,"published":"2017-09-28"},{"cvss_score":7.5,"headline":"Use after free in Apache Mesos","id":"CVE-2017-9790","kev_date_added":null,"published":"2017-09-28"},{"cvss_score":6.5,"headline":"Improper authorization vulnerability in Jenkins Mesos Plugin","id":"CVE-2018-1000420","kev_date_added":null,"published":"2019-01-09"}],"sources":[{"class":"attribution","licence":"MIT","name":"AlmaLinux","prefix":"ALSA"},{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"Red Hat","prefix":"RHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"},{"class":"open","licence":"CC0","name":"PoC-in-GitHub"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2024-08-04","vendors":["n/a"]},"summary":"Attackers with container access can overwrite the host runc binary to gain root privileges on the host system.","url":"https://insights.sbomify.com/CVE-2019-5736/"}