Skip to content
OpenAdvisories
Medium ALSA-2020:1650 3 CVEs

Moderate: container-tools:rhel8 security, bug fix, and enhancement update

Published Apr 28, 2020 · Updated Oct 31, 2026

Ecosystem: AlmaLinux

Summary

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

* runc: volume mount race condition with shared mounts leads to information leak/integrity manipulation (CVE-2019-19921)

* containers/image: Container images read entire image manifest into memory (CVE-2020-1702)

* podman: incorrectly allows existing files in volumes to be overwritten by a container when it is created (CVE-2020-1726)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Fixed packages 17

ReleasePackageFixed in
AlmaLinux · 8 crit 3.12-9.module_el8.3.0+2044+12421f43
AlmaLinux · 8 crit 3.12-9.module_el8.4.0+2496+12421f43
AlmaLinux · 8 crit 3.12-9.module_el8.5.0+119+9a9ec082
AlmaLinux · 8 criu 3.12-9.module_el8.4.0+2496+12421f43
AlmaLinux · 8 criu 3.12-9.module_el8.3.0+2044+12421f43
AlmaLinux · 8 criu 3.12-9.module_el8.5.0+119+9a9ec082
AlmaLinux · 8 python-podman-api 1.2.0-0.2.gitd0a45fe.module_el8.5.0+2635+e4386a39
AlmaLinux · 8 python-podman-api 1.2.0-0.2.gitd0a45fe.module_el8.5.0+108+00865455
AlmaLinux · 8 python3-criu 3.12-9.module_el8.3.0+2044+12421f43
AlmaLinux · 8 python3-criu 3.12-9.module_el8.4.0+2496+12421f43
AlmaLinux · 8 python3-criu 3.12-9.module_el8.5.0+119+9a9ec082
AlmaLinux · 8 slirp4netns 0.4.2-3.git21fdece.module_el8.5.0+2635+e4386a39
AlmaLinux · 8 slirp4netns 0.4.2-3.git21fdece.module_el8.5.0+108+00865455
AlmaLinux · 8 toolbox 0.0.7-1.module_el8.5.0+108+00865455
AlmaLinux · 8 toolbox 0.0.7-1.module_el8.5.0+2635+e4386a39
AlmaLinux · 8 udica 0.2.1-2.module_el8.5.0+108+00865455
AlmaLinux · 8 udica 0.2.1-2.module_el8.5.0+2635+e4386a39

Vulnerabilities 3

  • Medium 5.9
    CVE-2019-19921

    opencontainers runc contains procfs race condition with a shared volume mount

    runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run cus…

    containerd runc github.com/opencontainers/runc runc Debian Ubuntu Alpine Go
  • Medium 5.9
    CVE-2020-1726

    Podman has Files or Directories Accessible to External Parties

    A flaw was discovered in Podman where it incorrectly allows containers when created to overwrite existing files in volumes, even if they are mounted as read-only. When a user runs a malicious container or a container based on a malicious image with an attache…

    The podman podman github.com/containers/podman Debian Alpine Go
  • Unscored —
    CVE-2020-1702

    A malicious container image can consume an unbounded amount of memory when being pulled to a container runtime host, su…

References

  • report
    https://bugzilla.redhat.com/1703245
  • report
    https://bugzilla.redhat.com/1717357
  • report
    https://bugzilla.redhat.com/1731107
  • report
    https://bugzilla.redhat.com/1732704
  • report
    https://bugzilla.redhat.com/1732713
  • report
    https://bugzilla.redhat.com/1748519
  • report
    https://bugzilla.redhat.com/1749999
  • report
    https://bugzilla.redhat.com/1754744
  • report
    https://bugzilla.redhat.com/1754763
  • report
    https://bugzilla.redhat.com/1755119
  • report
    https://bugzilla.redhat.com/1756919
  • report
    https://bugzilla.redhat.com/1757693
  • report
    https://bugzilla.redhat.com/1757845
  • report
    https://bugzilla.redhat.com/1763454
  • report
    https://bugzilla.redhat.com/1766774
  • report
    https://bugzilla.redhat.com/1768930
  • report
    https://bugzilla.redhat.com/1769469
  • report
    https://bugzilla.redhat.com/1771990
  • report
    https://bugzilla.redhat.com/1774755
  • report
    https://bugzilla.redhat.com/1775307
  • report
    https://bugzilla.redhat.com/1776112
  • report
    https://bugzilla.redhat.com/1779834
  • report
    https://bugzilla.redhat.com/1783267
  • report
    https://bugzilla.redhat.com/1783268
  • report
    https://bugzilla.redhat.com/1783270
  • report
    https://bugzilla.redhat.com/1783272
  • report
    https://bugzilla.redhat.com/1783274
  • report
    https://bugzilla.redhat.com/1784267
  • report
    https://bugzilla.redhat.com/1784952
  • report
    https://bugzilla.redhat.com/1788539
  • report
    https://bugzilla.redhat.com/1792796
  • report
    https://bugzilla.redhat.com/1793084
  • report
    https://bugzilla.redhat.com/1793598
  • report
    https://bugzilla.redhat.com/1796107
  • report
    https://bugzilla.redhat.com/1801152
  • report
    https://bugzilla.redhat.com/1802907
  • report
    https://bugzilla.redhat.com/1803496
  • report
    https://bugzilla.redhat.com/1804849
  • report
    https://bugzilla.redhat.com/1805017