rkt: add CVEs

https://www.twistlock.com/labs-blog/breaking-out-of-coresos-rkt-3-new-cves/
NixOS · Mar 7, 2020 · c4c936f · c4c936f
1 parent db4ccde
commit c4c936f
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/pkgs/applications/virtualization/rkt/default.nix b/pkgs/applications/virtualization/rkt/default.nix
@@ -69,5 +69,10 @@ in stdenv.mkDerivation rec {
     license = licenses.asl20;
     maintainers = with maintainers; [ ragge steveej ];
     platforms = [ "x86_64-linux" ];
+    knownVulnerabilities = [
+      "CVE-2019-10144: processes run with `rkt enter` are given all capabilities during stage 2"
+      "CVE-2019-10145: processes run with `rkt enter` do not have seccomp filtering during stage 2"
+      "CVE-2019-10147: processes run with `rkt enter` are not limited by cgroups during stage 2"
+    ];
   };
 }