<security-notice xmlns="http://security.libvirt.org/xmlns/security-notice/1.0">
  <id>2018-0003</id>

  <summary>Insecure usage of NSS modules during container startup</summary>

  <description>
    <![CDATA[During container startup it is possible that libvirt logging
	     code will trigger a hostname lookup. This will in turn potentially
	     cause GLibC to load various NSS modules from the container's
	     root filesystem rather than the host's root filesystem. During this
	     time the host's root filesystem is still accessible and fully
	     writable]]>
  </description>

  <impact>
    <![CDATA[A maliciously crafted NSS module in the container's root filesystem
	     can exploit the host OS by writing content into the host's root
	     filesystem]]>
  </impact>

  <workaround>
    <![CDATA[There is no practical workaround]]>
  </workaround>

  <credits>
    <reporter>
      <name>Lubomir Rintel</name>
      <email>lkundrak@v3.sk</email>
    </reporter>
    <patcher>
      <name>Lubomir Rintel</name>
      <email>lkundrak@v3.sk</email>
    </patcher>
    <patcher>
      <name>Daniel P. Berrangé</name>
      <email>berrange@redhat.com</email>
    </patcher>
  </credits>

  <lifecycle>
    <reported>20180127</reported>
    <published>20180207</published>
    <fixed>20180207</fixed>
  </lifecycle>

  <reference>
    <advisory type="CVE" id="2018-6764"/>
  </reference>

  <product name="libvirt">
    <repository>libvirt.git</repository>
    <branch>
      <name>master</name>
      <tag state="vulnerable">v0.4.4</tag>
      <tag state="vulnerable">v0.4.6</tag>
      <tag state="vulnerable">v0.5.0</tag>
      <tag state="vulnerable">v0.5.1</tag>
      <tag state="vulnerable">v0.6.0</tag>
      <tag state="vulnerable">v0.6.1</tag>
      <tag state="vulnerable">v0.6.2</tag>
      <tag state="vulnerable">v0.6.3</tag>
      <tag state="vulnerable">v0.6.4</tag>
      <tag state="vulnerable">v0.6.5</tag>
      <tag state="vulnerable">v0.7.0</tag>
      <tag state="vulnerable">v0.7.1</tag>
      <tag state="vulnerable">v0.7.2</tag>
      <tag state="vulnerable">v0.7.3</tag>
      <tag state="vulnerable">v0.7.4</tag>
      <tag state="vulnerable">v0.7.5</tag>
      <tag state="vulnerable">v0.7.6</tag>
      <tag state="vulnerable">v0.7.7</tag>
      <tag state="vulnerable">v0.8.0</tag>
      <tag state="vulnerable">v0.8.1</tag>
      <tag state="vulnerable">v0.8.2</tag>
      <tag state="vulnerable">v0.8.3</tag>
      <tag state="vulnerable">v0.8.4</tag>
      <tag state="vulnerable">v0.8.5</tag>
      <tag state="vulnerable">v0.8.6</tag>
      <tag state="vulnerable">v0.8.7</tag>
      <tag state="vulnerable">v0.8.8</tag>
      <tag state="vulnerable">v0.9.0</tag>
      <tag state="vulnerable">v0.9.1</tag>
      <tag state="vulnerable">v0.9.2</tag>
      <tag state="vulnerable">v0.9.3</tag>
      <tag state="vulnerable">v0.9.4</tag>
      <tag state="vulnerable">v0.9.5</tag>
      <tag state="vulnerable">v0.9.6</tag>
      <tag state="vulnerable">v0.9.7</tag>
      <tag state="vulnerable">v0.9.8</tag>
      <tag state="vulnerable">v0.9.9</tag>
      <tag state="vulnerable">v0.9.10</tag>
      <tag state="vulnerable">v0.9.11</tag>
      <tag state="vulnerable">v0.9.12</tag>
      <tag state="vulnerable">v0.9.13</tag>
      <tag state="vulnerable">v0.10.0</tag>
      <tag state="vulnerable">v0.10.1</tag>
      <tag state="vulnerable">v0.10.2</tag>
      <tag state="vulnerable">v1.0.0</tag>
      <tag state="vulnerable">v1.0.1</tag>
      <tag state="vulnerable">v1.0.2</tag>
      <tag state="vulnerable">v1.0.3</tag>
      <tag state="vulnerable">v1.0.4</tag>
      <tag state="vulnerable">v1.0.5</tag>
      <tag state="vulnerable">v1.0.6</tag>
      <tag state="vulnerable">v1.1.0</tag>
      <tag state="vulnerable">v1.1.1</tag>
      <tag state="vulnerable">v1.1.2</tag>
      <tag state="vulnerable">v1.1.3</tag>
      <tag state="vulnerable">v1.1.4</tag>
      <tag state="vulnerable">v1.2.0</tag>
      <tag state="vulnerable">v1.2.1</tag>
      <tag state="vulnerable">v1.2.2</tag>
      <tag state="vulnerable">v1.2.3</tag>
      <tag state="vulnerable">v1.2.4</tag>
      <tag state="vulnerable">v1.2.5</tag>
      <tag state="vulnerable">v1.2.6</tag>
      <tag state="vulnerable">v1.2.7</tag>
      <tag state="vulnerable">v1.2.8</tag>
      <tag state="vulnerable">v1.2.9</tag>
      <tag state="vulnerable">v1.2.10</tag>
      <tag state="vulnerable">v1.2.11</tag>
      <tag state="vulnerable">v1.2.12</tag>
      <tag state="vulnerable">v1.2.13</tag>
      <tag state="vulnerable">v1.2.14</tag>
      <tag state="vulnerable">v1.2.15</tag>
      <tag state="vulnerable">v1.2.16</tag>
      <tag state="vulnerable">v1.2.17</tag>
      <tag state="vulnerable">v1.2.18</tag>
      <tag state="vulnerable">v1.2.19</tag>
      <tag state="vulnerable">v1.2.20</tag>
      <tag state="vulnerable">v1.2.21</tag>
      <tag state="vulnerable">v1.3.0</tag>
      <tag state="vulnerable">v1.3.1</tag>
      <tag state="vulnerable">v1.3.2</tag>
      <tag state="vulnerable">v1.3.3</tag>
      <tag state="vulnerable">v1.3.4</tag>
      <tag state="vulnerable">v1.3.5</tag>
      <tag state="vulnerable">v2.0.0</tag>
      <tag state="vulnerable">v2.1.0</tag>
      <tag state="vulnerable">v2.2.0</tag>
      <tag state="vulnerable">v2.3.0</tag>
      <tag state="vulnerable">v2.4.0</tag>
      <tag state="vulnerable">v2.5.0</tag>
      <tag state="vulnerable">v3.0.0</tag>
      <tag state="vulnerable">v3.1.0</tag>
      <tag state="vulnerable">v3.2.0</tag>
      <tag state="vulnerable">v3.3.0</tag>
      <tag state="vulnerable">v3.4.0</tag>
      <tag state="vulnerable">v3.5.0</tag>
      <tag state="vulnerable">v3.6.0</tag>
      <tag state="vulnerable">v3.7.0</tag>
      <tag state="vulnerable">v3.8.0</tag>
      <tag state="vulnerable">v3.9.0</tag>
      <tag state="vulnerable">v3.10.0</tag>
      <tag state="vulnerable">v4.0.0</tag>
      <change state="vulnerable">9ae41a71ac457994b7ca975e9eec7c3fc13ac101</change>
      <tag state="fixed">v4.1.0</tag>
      <change state="fixed">759b4d1b0fe5f4d84d98b99153dfa7ac289dd167</change>
      <change state="fixed">c2dc6698c88fb591639e542c8ecb0076c54f3dfb</change>
    </branch>
    <branch>
      <name>v0.8.3-maint</name>
      <change state="vulnerable">9ae41a71ac457994b7ca975e9eec7c3fc13ac101</change>
    </branch>
    <branch>
      <name>v0.9.6-maint</name>
      <tag state="vulnerable">v0.9.6.1</tag>
      <tag state="vulnerable">v0.9.6.2</tag>
      <tag state="vulnerable">v0.9.6.3</tag>
      <tag state="vulnerable">v0.9.6.4</tag>
      <change state="vulnerable">9ae41a71ac457994b7ca975e9eec7c3fc13ac101</change>
    </branch>
    <branch>
      <name>v0.9.11-maint</name>
      <tag state="vulnerable">v0.9.11.1</tag>
      <tag state="vulnerable">v0.9.11.2</tag>
      <tag state="vulnerable">v0.9.11.3</tag>
      <tag state="vulnerable">v0.9.11.4</tag>
      <tag state="vulnerable">v0.9.11.5</tag>
      <tag state="vulnerable">v0.9.11.6</tag>
      <tag state="vulnerable">v0.9.11.7</tag>
      <tag state="vulnerable">v0.9.11.8</tag>
      <tag state="vulnerable">v0.9.11.9</tag>
      <tag state="vulnerable">v0.9.11.10</tag>
      <change state="vulnerable">9ae41a71ac457994b7ca975e9eec7c3fc13ac101</change>
    </branch>
    <branch>
      <name>v0.9.12-maint</name>
      <tag state="vulnerable">v0.9.12.1</tag>
      <tag state="vulnerable">v0.9.12.2</tag>
      <tag state="vulnerable">v0.9.12.3</tag>
      <change state="vulnerable">9ae41a71ac457994b7ca975e9eec7c3fc13ac101</change>
    </branch>
    <branch>
      <name>v0.10.2-maint</name>
      <tag state="vulnerable">v0.10.2.1</tag>
      <tag state="vulnerable">v0.10.2.2</tag>
      <tag state="vulnerable">v0.10.2.3</tag>
      <tag state="vulnerable">v0.10.2.4</tag>
      <tag state="vulnerable">v0.10.2.5</tag>
      <tag state="vulnerable">v0.10.2.6</tag>
      <tag state="vulnerable">v0.10.2.7</tag>
      <tag state="vulnerable">v0.10.2.8</tag>
      <change state="vulnerable">9ae41a71ac457994b7ca975e9eec7c3fc13ac101</change>
    </branch>
    <branch>
      <name>v1.0.0-maint</name>
      <change state="vulnerable">9ae41a71ac457994b7ca975e9eec7c3fc13ac101</change>
    </branch>
    <branch>
      <name>v1.0.1-maint</name>
      <change state="vulnerable">9ae41a71ac457994b7ca975e9eec7c3fc13ac101</change>
    </branch>
    <branch>
      <name>v1.0.2-maint</name>
      <change state="vulnerable">9ae41a71ac457994b7ca975e9eec7c3fc13ac101</change>
    </branch>
    <branch>
      <name>v1.0.3-maint</name>
      <change state="vulnerable">9ae41a71ac457994b7ca975e9eec7c3fc13ac101</change>
    </branch>
    <branch>
      <name>v1.0.4-maint</name>
      <change state="vulnerable">9ae41a71ac457994b7ca975e9eec7c3fc13ac101</change>
    </branch>
    <branch>
      <name>v1.0.5-maint</name>
      <tag state="vulnerable">v1.0.5.1</tag>
      <tag state="vulnerable">v1.0.5.2</tag>
      <tag state="vulnerable">v1.0.5.3</tag>
      <tag state="vulnerable">v1.0.5.4</tag>
      <tag state="vulnerable">v1.0.5.5</tag>
      <tag state="vulnerable">v1.0.5.6</tag>
      <tag state="vulnerable">v1.0.5.7</tag>
      <tag state="vulnerable">v1.0.5.8</tag>
      <tag state="vulnerable">v1.0.5.9</tag>
      <change state="vulnerable">9ae41a71ac457994b7ca975e9eec7c3fc13ac101</change>
    </branch>
    <branch>
      <name>v1.0.6-maint</name>
      <change state="vulnerable">9ae41a71ac457994b7ca975e9eec7c3fc13ac101</change>
    </branch>
    <branch>
      <name>v1.1.0-maint</name>
      <change state="vulnerable">9ae41a71ac457994b7ca975e9eec7c3fc13ac101</change>
    </branch>
    <branch>
      <name>v1.1.1-maint</name>
      <change state="vulnerable">9ae41a71ac457994b7ca975e9eec7c3fc13ac101</change>
    </branch>
    <branch>
      <name>v1.1.2-maint</name>
      <change state="vulnerable">9ae41a71ac457994b7ca975e9eec7c3fc13ac101</change>
    </branch>
    <branch>
      <name>v1.1.3-maint</name>
      <tag state="vulnerable">v1.1.3.1</tag>
      <tag state="vulnerable">v1.1.3.2</tag>
      <tag state="vulnerable">v1.1.3.3</tag>
      <tag state="vulnerable">v1.1.3.4</tag>
      <tag state="vulnerable">v1.1.3.5</tag>
      <tag state="vulnerable">v1.1.3.6</tag>
      <tag state="vulnerable">v1.1.3.7</tag>
      <tag state="vulnerable">v1.1.3.8</tag>
      <tag state="vulnerable">v1.1.3.9</tag>
      <change state="vulnerable">9ae41a71ac457994b7ca975e9eec7c3fc13ac101</change>
    </branch>
    <branch>
      <name>v1.1.4-maint</name>
      <change state="vulnerable">9ae41a71ac457994b7ca975e9eec7c3fc13ac101</change>
    </branch>
    <branch>
      <name>v1.2.0-maint</name>
      <change state="vulnerable">9ae41a71ac457994b7ca975e9eec7c3fc13ac101</change>
    </branch>
    <branch>
      <name>v1.2.1-maint</name>
      <change state="vulnerable">9ae41a71ac457994b7ca975e9eec7c3fc13ac101</change>
    </branch>
    <branch>
      <name>v1.2.2-maint</name>
      <change state="vulnerable">9ae41a71ac457994b7ca975e9eec7c3fc13ac101</change>
    </branch>
    <branch>
      <name>v1.2.3-maint</name>
      <change state="vulnerable">9ae41a71ac457994b7ca975e9eec7c3fc13ac101</change>
    </branch>
    <branch>
      <name>v1.2.4-maint</name>
      <change state="vulnerable">9ae41a71ac457994b7ca975e9eec7c3fc13ac101</change>
    </branch>
    <branch>
      <name>v1.2.5-maint</name>
      <change state="vulnerable">9ae41a71ac457994b7ca975e9eec7c3fc13ac101</change>
    </branch>
    <branch>
      <name>v1.2.6-maint</name>
      <change state="vulnerable">9ae41a71ac457994b7ca975e9eec7c3fc13ac101</change>
    </branch>
    <branch>
      <name>v1.2.7-maint</name>
      <change state="vulnerable">9ae41a71ac457994b7ca975e9eec7c3fc13ac101</change>
    </branch>
    <branch>
      <name>v1.2.8-maint</name>
      <change state="vulnerable">9ae41a71ac457994b7ca975e9eec7c3fc13ac101</change>
    </branch>
    <branch>
      <name>v1.2.9-maint</name>
      <tag state="vulnerable">v1.2.9.1</tag>
      <tag state="vulnerable">v1.2.9.2</tag>
      <tag state="vulnerable">v1.2.9.3</tag>
      <change state="vulnerable">9ae41a71ac457994b7ca975e9eec7c3fc13ac101</change>
    </branch>
    <branch>
      <name>v1.2.10-maint</name>
      <change state="vulnerable">9ae41a71ac457994b7ca975e9eec7c3fc13ac101</change>
    </branch>
    <branch>
      <name>v1.2.11-maint</name>
      <change state="vulnerable">9ae41a71ac457994b7ca975e9eec7c3fc13ac101</change>
    </branch>
    <branch>
      <name>v1.2.12-maint</name>
      <change state="vulnerable">9ae41a71ac457994b7ca975e9eec7c3fc13ac101</change>
    </branch>
    <branch>
      <name>v1.2.13-maint</name>
      <tag state="vulnerable">v1.2.13.1</tag>
      <tag state="vulnerable">v1.2.13.2</tag>
      <change state="vulnerable">9ae41a71ac457994b7ca975e9eec7c3fc13ac101</change>
    </branch>
    <branch>
      <name>v1.2.14-maint</name>
      <change state="vulnerable">9ae41a71ac457994b7ca975e9eec7c3fc13ac101</change>
    </branch>
    <branch>
      <name>v1.2.15-maint</name>
      <change state="vulnerable">9ae41a71ac457994b7ca975e9eec7c3fc13ac101</change>
    </branch>
    <branch>
      <name>v1.2.16-maint</name>
      <change state="vulnerable">9ae41a71ac457994b7ca975e9eec7c3fc13ac101</change>
    </branch>
    <branch>
      <name>v1.2.17-maint</name>
      <change state="vulnerable">9ae41a71ac457994b7ca975e9eec7c3fc13ac101</change>
    </branch>
    <branch>
      <name>v1.2.18-maint</name>
      <tag state="vulnerable">v1.2.18.1</tag>
      <tag state="vulnerable">v1.2.18.2</tag>
      <tag state="vulnerable">v1.2.18.3</tag>
      <tag state="vulnerable">v1.2.18.4</tag>
      <change state="vulnerable">9ae41a71ac457994b7ca975e9eec7c3fc13ac101</change>
    </branch>
    <branch>
      <name>v1.2.19-maint</name>
      <change state="vulnerable">9ae41a71ac457994b7ca975e9eec7c3fc13ac101</change>
    </branch>
    <branch>
      <name>v1.2.20-maint</name>
      <change state="vulnerable">9ae41a71ac457994b7ca975e9eec7c3fc13ac101</change>
    </branch>
    <branch>
      <name>v1.2.21-maint</name>
      <change state="vulnerable">9ae41a71ac457994b7ca975e9eec7c3fc13ac101</change>
    </branch>
    <branch>
      <name>v1.3.0-maint</name>
      <change state="vulnerable">9ae41a71ac457994b7ca975e9eec7c3fc13ac101</change>
    </branch>
    <branch>
      <name>v1.3.1-maint</name>
      <change state="vulnerable">9ae41a71ac457994b7ca975e9eec7c3fc13ac101</change>
    </branch>
    <branch>
      <name>v1.3.2-maint</name>
      <change state="vulnerable">9ae41a71ac457994b7ca975e9eec7c3fc13ac101</change>
    </branch>
    <branch>
      <name>v1.3.3-maint</name>
      <tag state="vulnerable">v1.3.3.1</tag>
      <tag state="vulnerable">v1.3.3.2</tag>
      <tag state="vulnerable">v1.3.3.3</tag>
      <change state="vulnerable">9ae41a71ac457994b7ca975e9eec7c3fc13ac101</change>
    </branch>
    <branch>
      <name>v1.3.4-maint</name>
      <change state="vulnerable">9ae41a71ac457994b7ca975e9eec7c3fc13ac101</change>
    </branch>
    <branch>
      <name>v1.3.5-maint</name>
      <change state="vulnerable">9ae41a71ac457994b7ca975e9eec7c3fc13ac101</change>
    </branch>
    <branch>
      <name>v2.0-maint</name>
      <change state="vulnerable">9ae41a71ac457994b7ca975e9eec7c3fc13ac101</change>
    </branch>
    <branch>
      <name>v2.1-maint</name>
      <change state="vulnerable">9ae41a71ac457994b7ca975e9eec7c3fc13ac101</change>
    </branch>
    <branch>
      <name>v2.2-maint</name>
      <tag state="vulnerable">v2.2.1</tag>
      <change state="vulnerable">9ae41a71ac457994b7ca975e9eec7c3fc13ac101</change>
    </branch>
    <branch>
      <name>v3.0-maint</name>
      <change state="vulnerable">9ae41a71ac457994b7ca975e9eec7c3fc13ac101</change>
    </branch>
    <branch>
      <name>v3.2-maint</name>
      <tag state="vulnerable">v3.2.1</tag>
      <change state="vulnerable">9ae41a71ac457994b7ca975e9eec7c3fc13ac101</change>
    </branch>
    <branch>
      <name>v3.7-maint</name>
      <change state="vulnerable">9ae41a71ac457994b7ca975e9eec7c3fc13ac101</change>
      <change state="fixed">3aadeae9709dae6593b5b26e8953b459c6764a6d</change>
      <change state="fixed">ee54b0bd7faa3e211346b367f64e502af6442e07</change>
    </branch>
  </product>

</security-notice>
