Project Atomic maintains container and system-level tools including Bubblewrap and OCI-register-machine, which operate at the intersection of container isolation and privileged system access. The observed weakness classes—improper input validation, sensitive information exposure, improper privilege management, and incorrect use of privileged APIs—reflect the security-critical nature of sandboxing and system-integration components where parsing and access control are fundamental to containment boundaries. Current severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Projectatomic over time
Signals from CVEs in this vendor scope (4 CVEs).
4 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2017-5226CRITICAL When executing a program via the bubblewrap sandbox, the nonpriv session can escape to the parent session by using the TIOCSTI ioctl to push characters into the terminal's input bu | Mar 29, 2017 | 10.0 | 33 | NO | NO |
CVE-2020-5291HIGH Bubblewrap (bwrap) before version 0.4.1, if installed in setuid mode and the kernel supports unprivileged user namespaces, then the `bwrap --userns2` option can be used to make the | Mar 31, 2020 | 7.8 | 25 | NO | NO |
CVE-2019-12439HIGH bubblewrap.c in Bubblewrap before 0.3.3 misuses temporary directories in /tmp as a mount point. In some particular configurations (related to XDG_RUNTIME_DIR), a local attacker may | May 29, 2019 | 7.8 | 24 | NO | NO |
The machinectl command in oci-register-machine allows local users to list running containers and possibly obtain sensitive information by running that command. | Mar 29, 2017 | 3.3 | 12 | NO | NO |
Signals from CVEs in this vendor scope (4 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Projectatomic.
Media articles that mention a CVE ID that affects a product developed by Projectatomic — matched by CVE ID, not by vendor name.