{"action":"Upgrade github.com/opencontainers/runc to 1.0.0-rc95 or later.","affected":[{"fixed":"1.0.0-rc95","introduced":"0"}],"component":"github.com/opencontainers/runc","cve_ids":["CVE-2021-30465"],"ecosystem":"Go","epss":0.10245,"exploited":false,"fixed_versions":["1.0.0-rc95"],"ghsa_id":"GHSA-c3xm-pvg7-gh7r","id":"tcs_01M5KFX9N6HGA703P93SVC0GF6","modified_at":"2026-02-04T02:21:49.205668Z","published_at":"2024-08-21T15:29:08Z","references":["https://osv.dev/vulnerability/GO-2022-0914","https://github.com/opencontainers/runc/security/advisories/GHSA-c3xm-pvg7-gh7r","https://github.com/opencontainers/runc/commit/0ca91f44f1664da834bc61115a849b56d22f595f","http://www.openwall.com/lists/oss-security/2021/05/19/2","https://bugzilla.opensuse.org/show_bug.cgi?id=1185405","https://github.com/opencontainers/runc/releases","https://lists.debian.org/debian-lts-announce/2023/03/msg00023.html","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/35ZW6NBZSBH5PWIT7JU4HXOXGFVDCOHH","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4HOARVIT47RULTTFWAU7XBG4WY6TDDHV","https://security.gentoo.org/glsa/202107-26","https://security.netapp.com/advisory/ntap-20210708-0003"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"GO-2022-0914","url":"https://osv.dev/vulnerability/GO-2022-0914"}],"summary":"Mount destinations can be swapped via symlink-exchange to cause mounts outside the rootfs in github.com/opencontainers/runc"}