CVE-2020-14298
Fixed in a distro release EPSS <1%
The version of docker as released for Red Hat Enterprise Linux 7 Extras via RHBA-2020:0053 advisory included an incorrect version of runc missing the fix for CVE-2019-5736, which was previously fixed via RHSA-2019:0304. This issue could allow a malicious or compromised container to compromise the container host and other containers running on the same host. This issue only affects docker version 1.13.1-108.git4ef4b30.el7, shipped in Red Hat Enterprise Linux 7 Extras. Both earlier and later versions are not affected.
Products: docker, redhat openshift_container_platform, redhat enterprise_linux_server
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat rhel extras other 7 | docker | 2:1.13.1-162.git64e9980.el7_8 |
| Red Hat rhel extras other 7 | docker-client | 2:1.13.1-162.git64e9980.el7_8 |
| Red Hat rhel extras other 7 | docker-common | 2:1.13.1-162.git64e9980.el7_8 |
| Red Hat rhel extras other 7 | docker-debuginfo | 2:1.13.1-162.git64e9980.el7_8 |
| Red Hat rhel extras other 7 | docker-logrotate | 2:1.13.1-162.git64e9980.el7_8 |
| Red Hat rhel extras other 7 | docker-lvm-plugin | 2:1.13.1-162.git64e9980.el7_8 |
| Red Hat rhel extras other 7 | docker-novolume-plugin | 2:1.13.1-162.git64e9980.el7_8 |
| Red Hat rhel extras other 7 | docker-rhel-push-plugin | 2:1.13.1-162.git64e9980.el7_8 |
| Red Hat rhel extras other 7 | docker-v1.10-migrator | 2:1.13.1-162.git64e9980.el7_8 |