Approved changes feed: RSS · Atom
cpe:2.3:a:containers:crun:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Containers (c7fe62d8-6191-587d-bfe5-2030ff1846e8) |
|---|---|
| Product | Crun (41ecd392-2d17-5345-bccb-0e960104e2f6) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-30892 |
vulnerable | 2026-06-08 07:57:14.443552 |
Crun incorrectly parses `crun exec` option `-u`, leading to privilege escalation
NONE
crun is an open source OCI Container Runtime fully written in C. In versions 1.19 through 1.26, the `crun exec` option `-u` (`--user`) is incorrectly parsed. The value `1` is interpreted as UID 0 and GID 0 when it should have been UID 1 and GID 0. The process thus runs with higher privileges than expected. Version 1.27 patches the issue.
Published: 2026-03-25T23:57:01.741Z
Updated: 2026-03-26T18:10:16.318Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2025-24965 |
vulnerable | 2026-06-08 07:12:50.213915 |
.krun_config.json symlink attack creates or overwrites file on the host in crun
crun is an open source OCI Container Runtime fully written in C. In affected versions A malicious container image could trick the krun handler into escaping the root filesystem, allowing file creation or modification on the host. No special permissions are needed, only the ability for the current user to write to the target file. The problem is fixed in crun 1.20 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
Published: 2025-02-19T16:46:31.602Z
Updated: 2025-02-19T16:56:05.966Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.