Container
Monthly
Unbounded memory buffering in Apple's container runtime exposes host systems running versions prior to 1.2.0 to remote denial-of-service attacks via any published TCP port. The forwarding proxy that bridges client connections to backend containers accumulates client-supplied data without any cap on size or time, meaning a remote unauthenticated attacker can deliberately hold a connection open - sending data slowly or stalling backend establishment - until host memory is exhausted. No public exploit has been identified at time of analysis and EPSS is very low (0.14%, 4th percentile), but the attack is conceptually simple and requires no authentication.
Path traversal in Apple's open-source container runtime (versions before 1.2.0) enables a malicious builder peer to request host files by crafted names that resolve outside the build context, leaking arbitrary host filesystem contents. The CVSS vector (AV:N/AC:L/PR:L) indicates network-accessible exploitation by a low-privileged builder peer with no user interaction required. No active exploitation has been identified (no CISA KEV listing), and SSVC rates exploitation as none and automatability as no, reducing immediate operational urgency.
Path traversal in the ArchiveReader.extractContents() function used by container image load operations allows local attackers to write arbitrary files to any user-writable location on the system by crafting malicious archives with relative pathnames. Public exploit code exists for this vulnerability, and affected users cannot currently patch as fixes are only available in container 0.8.0 and containerization 0.21.0. The vulnerability requires local access and user interaction but carries high severity due to potential for file overwrite and system compromise.
Unbounded memory buffering in Apple's container runtime exposes host systems running versions prior to 1.2.0 to remote denial-of-service attacks via any published TCP port. The forwarding proxy that bridges client connections to backend containers accumulates client-supplied data without any cap on size or time, meaning a remote unauthenticated attacker can deliberately hold a connection open - sending data slowly or stalling backend establishment - until host memory is exhausted. No public exploit has been identified at time of analysis and EPSS is very low (0.14%, 4th percentile), but the attack is conceptually simple and requires no authentication.
Path traversal in Apple's open-source container runtime (versions before 1.2.0) enables a malicious builder peer to request host files by crafted names that resolve outside the build context, leaking arbitrary host filesystem contents. The CVSS vector (AV:N/AC:L/PR:L) indicates network-accessible exploitation by a low-privileged builder peer with no user interaction required. No active exploitation has been identified (no CISA KEV listing), and SSVC rates exploitation as none and automatability as no, reducing immediate operational urgency.
Path traversal in the ArchiveReader.extractContents() function used by container image load operations allows local attackers to write arbitrary files to any user-writable location on the system by crafting malicious archives with relative pathnames. Public exploit code exists for this vulnerability, and affected users cannot currently patch as fixes are only available in container 0.8.0 and containerization 0.21.0. The vulnerability requires local access and user interaction but carries high severity due to potential for file overwrite and system compromise.