<?xml version="1.0" encoding="UTF-8"?>
<cvrfdoc xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:cvrf="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf" xmlns:cvrf-common="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/common" xmlns:cvssv2="http://scap.nist.gov/schema/cvss-v2/1.0" xmlns:cvssv3="https://www.first.org/cvss/cvss-v3.0.xsd" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:ns0="http://purl.org/dc/elements/1.1/" xmlns:prod="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod" xmlns:scap-core="http://scap.nist.gov/schema/scap-core/1.0" xmlns:sch="http://purl.oclc.org/dsdl/schematron" xmlns:vuln="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf">
  <DocumentTitle xml:lang="en">Security update for containerd, docker and go</DocumentTitle>
  <DocumentType>SUSE Patch</DocumentType>
  <DocumentPublisher Type="Vendor">
    <ContactDetails>security@suse.de</ContactDetails>
    <IssuingAuthority>SUSE Security Team</IssuingAuthority>
  </DocumentPublisher>
  <DocumentTracking>
    <Identification>
      <ID>SUSE-SU-2018:4297-1</ID>
    </Identification>
    <Status>Final</Status>
    <Version>1</Version>
    <RevisionHistory>
      <Revision>
        <Number>1</Number>
        <Date>2018-12-28T17:39:11Z</Date>
        <Description>current</Description>
      </Revision>
    </RevisionHistory>
    <InitialReleaseDate>2018-12-28T17:39:11Z</InitialReleaseDate>
    <CurrentReleaseDate>2018-12-28T17:39:11Z</CurrentReleaseDate>
    <Generator>
      <Engine>cve-database/bin/generate-cvrf.pl</Engine>
      <Date>2017-02-24T01:00:00Z</Date>
    </Generator>
  </DocumentTracking>
  <DocumentNotes>
    <Note Title="Topic" Type="Summary" Ordinal="1" xml:lang="en">Security update for containerd, docker and go</Note>
    <Note Title="Details" Type="General" Ordinal="2" xml:lang="en">
This update for containerd, docker and go fixes the following issues:

containerd and docker:

- Add backport for building containerd (bsc#1102522, bsc#1113313)
- Upgrade to containerd v1.1.2, which is required for Docker v18.06.1-ce.
  (bsc#1102522)
- Enable seccomp support on SLE12 (fate#325877)
- Update to containerd v1.1.1, which is the required version for the Docker
  v18.06.0-ce upgrade. (bsc#1102522)
- Put containerd under the podruntime slice (bsc#1086185) 
- 3rd party registries used the default Docker certificate (bsc#1084533)
- Handle build breakage due to missing 'export GOPATH' (caused by resolution of
  boo#1119634). I believe Docker is one of the only packages with this problem.

go:
  
- golang: arbitrary command execution via VCS path (bsc#1081495, CVE-2018-7187)
- Make profile.d/go.sh no longer set GOROOT=, in order to make switching
  between versions no longer break. This ends up removing the need for go.sh
  entirely (because GOPATH is also set automatically) (boo#1119634)
- Fix a regression that broke go get for import path patterns containing '...'
  (bsc#1119706)

Additionally, the package go1.10 has been added.
</Note>
    <Note Title="Terms of Use" Type="Legal Disclaimer" Ordinal="3" xml:lang="en">The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).</Note>
    <Note Title="Patchnames" Type="Details" Ordinal="4" xml:lang="en">SUSE-SLE-Module-Containers-15-2018-3064,SUSE-SLE-Module-Development-Tools-OBS-15-2018-3064</Note>
  </DocumentNotes>
  <DocumentDistribution xml:lang="en">Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0)</DocumentDistribution>
  <DocumentReferences>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/update/announcement/2018/suse-su-20184297-1/</URL>
      <Description>Link for SUSE-SU-2018:4297-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://lists.suse.com/pipermail/sle-security-updates/2018-December/005006.html</URL>
      <Description>E-Mail link for SUSE-SU-2018:4297-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/security/rating/</URL>
      <Description>SUSE Security Ratings</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1047218</URL>
      <Description>SUSE Bug 1047218</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1074971</URL>
      <Description>SUSE Bug 1074971</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1080978</URL>
      <Description>SUSE Bug 1080978</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1081495</URL>
      <Description>SUSE Bug 1081495</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1084533</URL>
      <Description>SUSE Bug 1084533</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1086185</URL>
      <Description>SUSE Bug 1086185</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1094680</URL>
      <Description>SUSE Bug 1094680</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1095817</URL>
      <Description>SUSE Bug 1095817</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1098017</URL>
      <Description>SUSE Bug 1098017</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1102522</URL>
      <Description>SUSE Bug 1102522</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1104821</URL>
      <Description>SUSE Bug 1104821</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1105000</URL>
      <Description>SUSE Bug 1105000</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1108038</URL>
      <Description>SUSE Bug 1108038</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1113313</URL>
      <Description>SUSE Bug 1113313</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1113978</URL>
      <Description>SUSE Bug 1113978</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1114209</URL>
      <Description>SUSE Bug 1114209</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1118897</URL>
      <Description>SUSE Bug 1118897</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1118898</URL>
      <Description>SUSE Bug 1118898</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1118899</URL>
      <Description>SUSE Bug 1118899</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1119634</URL>
      <Description>SUSE Bug 1119634</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1119706</URL>
      <Description>SUSE Bug 1119706</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2018-16873/</URL>
      <Description>SUSE CVE CVE-2018-16873 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2018-16874/</URL>
      <Description>SUSE CVE CVE-2018-16874 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2018-16875/</URL>
      <Description>SUSE CVE CVE-2018-16875 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2018-7187/</URL>
      <Description>SUSE CVE CVE-2018-7187 page</Description>
    </Reference>
  </DocumentReferences>
  <ProductTree xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod">
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Module for Containers 15">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Module for Containers 15">
        <FullProductName ProductID="SUSE Linux Enterprise Module for Containers 15" CPE="cpe:/o:suse:sle-module-containers:15">SUSE Linux Enterprise Module for Containers 15</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Version" Name="containerd-1.1.2-5.3.4">
      <FullProductName ProductID="containerd-1.1.2-5.3.4">containerd-1.1.2-5.3.4</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="docker-18.06.1_ce-6.8.2">
      <FullProductName ProductID="docker-18.06.1_ce-6.8.2">docker-18.06.1_ce-6.8.2</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="docker-bash-completion-18.06.1_ce-6.8.2">
      <FullProductName ProductID="docker-bash-completion-18.06.1_ce-6.8.2">docker-bash-completion-18.06.1_ce-6.8.2</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="docker-libnetwork-0.7.0.1+gitr2664_3ac297bc7fd0-4.3.5">
      <FullProductName ProductID="docker-libnetwork-0.7.0.1+gitr2664_3ac297bc7fd0-4.3.5">docker-libnetwork-0.7.0.1+gitr2664_3ac297bc7fd0-4.3.5</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="docker-runc-1.0.0rc5+gitr3562_69663f0bd4b6-6.3.4">
      <FullProductName ProductID="docker-runc-1.0.0rc5+gitr3562_69663f0bd4b6-6.3.4">docker-runc-1.0.0rc5+gitr3562_69663f0bd4b6-6.3.4</FullProductName>
    </Branch>
    <Relationship ProductReference="containerd-1.1.2-5.3.4" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Module for Containers 15">
      <FullProductName ProductID="SUSE Linux Enterprise Module for Containers 15:containerd-1.1.2-5.3.4">containerd-1.1.2-5.3.4 as a component of SUSE Linux Enterprise Module for Containers 15</FullProductName>
    </Relationship>
    <Relationship ProductReference="docker-18.06.1_ce-6.8.2" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Module for Containers 15">
      <FullProductName ProductID="SUSE Linux Enterprise Module for Containers 15:docker-18.06.1_ce-6.8.2">docker-18.06.1_ce-6.8.2 as a component of SUSE Linux Enterprise Module for Containers 15</FullProductName>
    </Relationship>
    <Relationship ProductReference="docker-bash-completion-18.06.1_ce-6.8.2" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Module for Containers 15">
      <FullProductName ProductID="SUSE Linux Enterprise Module for Containers 15:docker-bash-completion-18.06.1_ce-6.8.2">docker-bash-completion-18.06.1_ce-6.8.2 as a component of SUSE Linux Enterprise Module for Containers 15</FullProductName>
    </Relationship>
    <Relationship ProductReference="docker-libnetwork-0.7.0.1+gitr2664_3ac297bc7fd0-4.3.5" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Module for Containers 15">
      <FullProductName ProductID="SUSE Linux Enterprise Module for Containers 15:docker-libnetwork-0.7.0.1+gitr2664_3ac297bc7fd0-4.3.5">docker-libnetwork-0.7.0.1+gitr2664_3ac297bc7fd0-4.3.5 as a component of SUSE Linux Enterprise Module for Containers 15</FullProductName>
    </Relationship>
    <Relationship ProductReference="docker-runc-1.0.0rc5+gitr3562_69663f0bd4b6-6.3.4" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Module for Containers 15">
      <FullProductName ProductID="SUSE Linux Enterprise Module for Containers 15:docker-runc-1.0.0rc5+gitr3562_69663f0bd4b6-6.3.4">docker-runc-1.0.0rc5+gitr3562_69663f0bd4b6-6.3.4 as a component of SUSE Linux Enterprise Module for Containers 15</FullProductName>
    </Relationship>
  </ProductTree>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="1">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to remote code execution when executed with the -u flag and the import path of a malicious Go package, or a package that imports it directly or indirectly. Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction is documented at https://golang.org/cmd/go/#hdr-Module_aware_go_get). Using custom domains, it's possible to arrange things so that a Git repository is cloned to a folder named ".git" by using a vanity import path that ends with "/.git". If the Git repository root contains a "HEAD" file, a "config" file, an "objects" directory, a "refs" directory, with some work to ensure the proper ordering of operations, "go get -u" can be tricked into considering the parent directory as a repository root, and running Git commands on it. That will use the "config" file in the original Git repository root for its configuration, and if that config file contains malicious commands, they will execute on the system running "go get -u".</Note>
    </Notes>
    <CVE>CVE-2018-16873</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Linux Enterprise Module for Containers 15:containerd-1.1.2-5.3.4</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Containers 15:docker-18.06.1_ce-6.8.2</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Containers 15:docker-bash-completion-18.06.1_ce-6.8.2</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Containers 15:docker-libnetwork-0.7.0.1+gitr2664_3ac297bc7fd0-4.3.5</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Containers 15:docker-runc-1.0.0rc5+gitr3562_69663f0bd4b6-6.3.4</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>important</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>6.8</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:N/C:P/I:P/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>7.5</BaseScoreV3>
        <VectorV3>CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2018/suse-su-20184297-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2018-16873.html</URL>
        <Description>CVE-2018-16873</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1118897</URL>
        <Description>SUSE Bug 1118897</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1118898</URL>
        <Description>SUSE Bug 1118898</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1118899</URL>
        <Description>SUSE Bug 1118899</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="2">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">In Go before 1.10.6 and 1.11.x before 1.11.3, the "go get" command is vulnerable to directory traversal when executed with the import path of a malicious Go package which contains curly braces (both '{' and '}' characters). Specifically, it is only vulnerable in GOPATH mode, but not in module mode (the distinction is documented at https://golang.org/cmd/go/#hdr-Module_aware_go_get). The attacker can cause an arbitrary filesystem write, which can lead to code execution.</Note>
    </Notes>
    <CVE>CVE-2018-16874</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Linux Enterprise Module for Containers 15:containerd-1.1.2-5.3.4</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Containers 15:docker-18.06.1_ce-6.8.2</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Containers 15:docker-bash-completion-18.06.1_ce-6.8.2</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Containers 15:docker-libnetwork-0.7.0.1+gitr2664_3ac297bc7fd0-4.3.5</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Containers 15:docker-runc-1.0.0rc5+gitr3562_69663f0bd4b6-6.3.4</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>6.8</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:N/C:P/I:P/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>6.8</BaseScoreV3>
        <VectorV3>CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2018/suse-su-20184297-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2018-16874.html</URL>
        <Description>CVE-2018-16874</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1118897</URL>
        <Description>SUSE Bug 1118897</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1118898</URL>
        <Description>SUSE Bug 1118898</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1118899</URL>
        <Description>SUSE Bug 1118899</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="3">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">The crypto/x509 package of Go before 1.10.6 and 1.11.x before 1.11.3 does not limit the amount of work performed for each chain verification, which might allow attackers to craft pathological inputs leading to a CPU denial of service. Go TLS servers accepting client certificates and TLS clients are affected.</Note>
    </Notes>
    <CVE>CVE-2018-16875</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Linux Enterprise Module for Containers 15:containerd-1.1.2-5.3.4</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Containers 15:docker-18.06.1_ce-6.8.2</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Containers 15:docker-bash-completion-18.06.1_ce-6.8.2</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Containers 15:docker-libnetwork-0.7.0.1+gitr2664_3ac297bc7fd0-4.3.5</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Containers 15:docker-runc-1.0.0rc5+gitr3562_69663f0bd4b6-6.3.4</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>7.8</BaseScoreV2>
        <VectorV2>AV:N/AC:L/Au:N/C:N/I:N/A:C</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>5.9</BaseScoreV3>
        <VectorV3>CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2018/suse-su-20184297-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2018-16875.html</URL>
        <Description>CVE-2018-16875</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1118897</URL>
        <Description>SUSE Bug 1118897</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1118898</URL>
        <Description>SUSE Bug 1118898</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1118899</URL>
        <Description>SUSE Bug 1118899</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="4">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">The "go get" implementation in Go 1.9.4, when the -insecure command-line option is used, does not validate the import path (get/vcs.go only checks for "://" anywhere in the string), which allows remote attackers to execute arbitrary OS commands via a crafted web site.</Note>
    </Notes>
    <CVE>CVE-2018-7187</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Linux Enterprise Module for Containers 15:containerd-1.1.2-5.3.4</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Containers 15:docker-18.06.1_ce-6.8.2</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Containers 15:docker-bash-completion-18.06.1_ce-6.8.2</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Containers 15:docker-libnetwork-0.7.0.1+gitr2664_3ac297bc7fd0-4.3.5</ProductID>
        <ProductID>SUSE Linux Enterprise Module for Containers 15:docker-runc-1.0.0rc5+gitr3562_69663f0bd4b6-6.3.4</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>9.3</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:N/C:C/I:C/A:C</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>8.8</BaseScoreV3>
        <VectorV3>CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2018/suse-su-20184297-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2018-7187.html</URL>
        <Description>CVE-2018-7187</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1080006</URL>
        <Description>SUSE Bug 1080006</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1081495</URL>
        <Description>SUSE Bug 1081495</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
</cvrfdoc>
