High severity8.6NVD Advisory· Published Nov 13, 2019· Updated Jun 17, 2026

CVE-2019-18837

Description

An issue was discovered in crun before 0.10.5. With a crafted image, it doesn't correctly check whether a target is a symlink, resulting in access to files outside of the container. This occurs in libcrun/linux.c and libcrun/chroot_realpath.c.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Containers/Crunllm-fuzzy
Range: <0.10.5
crun/crunv5
Range: before 0.10.5
Crun Project/Crun
cpe:2.3:a:crun_project:crun:*:*:*:*:*:*:*:*
Range: <0.10.5
Fedoraproject/Fedora2 versions
cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*

Patches

Vulnerability mechanics

References

github.com/containers/crun/pull/173nvd
github.com/containers/crun/releases/tag/0.10.5nvd
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DTA5SJUAKQUK6HRY2CZVJUIZP5BO3EOG/nvd
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ITB2UNEGHXZUR3ATYHWPSK5LJB36N7AP/nvd

News mentions

No linked articles in our index yet.

cvss	0.559
epss	0.001
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000