Skip to content
OpenAdvisories
Medium ALSA-2020:3053 2 CVEs

Moderate: container-tools:rhel8 security, bug fix, and enhancement update

Published Jul 21, 2020 · Updated Nov 5, 2026

Ecosystem: AlmaLinux

Summary

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

* QEMU: slirp: use-after-free in ip_reass() function in ip_input.c (CVE-2020-1983)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Fixed packages 8

ReleasePackageFixed in
AlmaLinux · 8 python-podman-api 1.2.0-0.2.gitd0a45fe.module_el8.5.0+2635+e4386a39
AlmaLinux · 8 python-podman-api 1.2.0-0.2.gitd0a45fe.module_el8.5.0+108+00865455
AlmaLinux · 8 runc 1.0.0-66.rc10.module_el8.5.0+2635+e4386a39
AlmaLinux · 8 runc 1.0.0-66.rc10.module_el8.5.0+108+00865455
AlmaLinux · 8 toolbox 0.0.7-1.module_el8.5.0+108+00865455
AlmaLinux · 8 toolbox 0.0.7-1.module_el8.5.0+2635+e4386a39
AlmaLinux · 8 udica 0.2.1-2.module_el8.5.0+108+00865455
AlmaLinux · 8 udica 0.2.1-2.module_el8.5.0+2635+e4386a39

Vulnerabilities 2

  • High 7.5
    CVE-2020-1983

    libslirp: use after free vulnerability cause a denial of service.

    A use after free vulnerability in ip_reass() in ip_input.c of libslirp 4.2.0 and prior releases allows crafted packets to cause a denial of service.

    slirp libslirp qemu qemu Debian Ubuntu Alpine
  • High 7.0
    CVE-2021-20188

    Improper Authorization in github.com/containers/libpod

    A flaw was found in podman before 1.7.0. File permissions for non-root users running in a privileged container are not correctly checked. This flaw can be abused by a low-privileged user inside the container to access any other file in the container, even if …

    libpod libpod github.com/containers/libpod Debian Ubuntu Go

References

  • report
    https://bugzilla.redhat.com/1703261
  • report
    https://bugzilla.redhat.com/1782408
  • report
    https://bugzilla.redhat.com/1784950
  • report
    https://bugzilla.redhat.com/1785480
  • report
    https://bugzilla.redhat.com/1806044
  • report
    https://bugzilla.redhat.com/1807379
  • report
    https://bugzilla.redhat.com/1808483
  • report
    https://bugzilla.redhat.com/1809648
  • report
    https://bugzilla.redhat.com/1810874
  • report
    https://bugzilla.redhat.com/1811779
  • report
    https://bugzilla.redhat.com/1815170
  • report
    https://bugzilla.redhat.com/1815991
  • report
    https://bugzilla.redhat.com/1822037
  • report
    https://bugzilla.redhat.com/1826486
  • report
    https://bugzilla.redhat.com/1829061
  • report
    https://bugzilla.redhat.com/1829825
  • report
    https://bugzilla.redhat.com/1833390
  • report
    https://bugzilla.redhat.com/1836440
  • report
    https://bugzilla.redhat.com/1838991
  • report
    https://bugzilla.redhat.com/1839065
  • report
    https://bugzilla.redhat.com/1915734
  • advisory
    https://errata.almalinux.org/8/ALSA-2020-3053.html
  • report
    https://vulners.com/cve/CVE-2020-1983
  • report
    https://vulners.com/cve/CVE-2021-20188