CVE-2019-16884 · cross-distro fix matrix

CVE-2019-16884: runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /proc directory.

Affects 8 Linux releases across 16 (distro × package) combinations.

Fix per ecosystem

Each block below is a distro release where CVE-2019-16884 has a known fix. Run the listed command on that distro to remediate.

Source: Debian Security Tracker

golang-github-opencontainers-selinux→ fixed in1.3.0-2urgency: not yet assigned
```
sudo apt-get install --only-upgrade -y golang-github-opencontainers-selinux
```
runc→ fixed in1.0.0~rc9+dfsg1-1urgency: not yet assigned
```
sudo apt-get install --only-upgrade -y runc
```

Source: Debian Security Tracker

golang-github-opencontainers-selinux→ fixed in1.3.0-2urgency: not yet assigned
```
sudo apt-get install --only-upgrade -y golang-github-opencontainers-selinux
```
runc→ fixed in1.0.0~rc9+dfsg1-1urgency: not yet assigned
```
sudo apt-get install --only-upgrade -y runc
```

Source: Debian Security Tracker

golang-github-opencontainers-selinux→ fixed in1.3.0-2urgency: not yet assigned
```
sudo apt-get install --only-upgrade -y golang-github-opencontainers-selinux
```
runc→ fixed in1.0.0~rc9+dfsg1-1urgency: not yet assigned
```
sudo apt-get install --only-upgrade -y runc
```