Detections
Analytics
Alpine: multiple bubblewrap packages: security update to 0.4.1-r0
high Tenable Self-Hosted Container Security Plugin ID 423728
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- Bubblewrap (bwrap) before version 0.4.1, if installed in setuid mode and the kernel supports unprivileged
user namespaces, then the `bwrap --userns2` option can be used to make the setuid process keep running as
root while being traceable. This can in turn be used to gain root permissions. Note that this only affects
the combination of bubblewrap in setuid mode (which is typically used when unprivileged user namespaces
are not supported) and the support of unprivileged user namespaces. Known to be affected are: * Debian
testing/unstable, if unprivileged user namespaces enabled (not default) * Debian buster-backports, if
unprivileged user namespaces enabled (not default) * Arch if using `linux-hardened`, if unprivileged user
namespaces enabled (not default) * Centos 7 flatpak COPR, if unprivileged user namespaces enabled (not
default) This has been fixed in the 0.4.1 release, and all affected users should update. (CVE-2020-5291)
See Also
Plugin Details
Severity: High
ID: 423728
Version: Revision 1.8
Type: Local
Published: 4/4/2025
Updated: 7/2/2026
Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Medium
Score: 4.9
Percentile: 57.88
CVSS v2
Risk Factor: High
Base Score: 8.5
Temporal Score: 6.3
Vector: CVSS2#AV:N/AC:M/Au:S/C:C/I:C/A:C
CVSS Score Source: CVE-2020-5291
CVSS v3
Risk Factor: High
Base Score: 7.8
Temporal Score: 6.8
Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Exploit Ease: No known exploits are available
Vulnerability Publication Date: 3/31/2020
Reference Information
CVE: CVE-2020-5291