9

CVE-2019-16767

In EzMaster before 5.2.11 docker containers were executed with advanced privileges by default

The admin sys mode is now conditional and dedicated for the special case. By default, since ezmaster@5.2.11 no instance (container) is launched with advanced capabilities (not launched as root)
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Inist ≫ Ezmaster Version < 5.2.11
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.81% 0.52
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 7.2 1.2 5.9
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 9 8 10
AV:N/AC:L/Au:S/C:C/I:C/A:C
security-advisories@github.com 6.6 0.8 5.3
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:L
CWE-250 Execution with Unnecessary Privileges

The product performs an operation at a privilege level that is higher than the minimum level required, which creates new weaknesses or amplifies the consequences of other weaknesses.

https://github.com/Inist-CNRS/ezmaster/blob/master/CHANGELOG.md#ezmaster-5211
Third Party Advisory
https://github.com/Inist-CNRS/ezmaster/pull/51
Patch
Third Party Advisory
https://github.com/Inist-CNRS/ezmaster/security/advisories/GHSA-g654-5qjf-g6cx
Third Party Advisory