CVE-2019-1010023.toml

# glibc ldd on a malicious ELF can lead to code execution.
# Exploitation requires a user to run `ldd` against an attacker-supplied
# ELF file. The 5-Spot container image is Distroless and contains no
# shell, no ldd, and no tooling that invokes the dynamic loader against
# arbitrary binaries. The controller binary itself never calls ldd.
cve = "CVE-2019-1010023"
status = "not_affected"
justification = "vulnerable_code_not_in_execute_path"
impact_statement = "The Distroless image ships no ldd or shell; the vulnerable workflow (running ldd on an adversary-supplied ELF) cannot occur at runtime."
products = ["pkg:oci/5-spot"]
author = "erick.bourgeois@gmail.com"
timestamp = "2026-04-19T00:00:00Z"