Summary
The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.
Security Fix(es):
* containernetworking/plugins: IPv6 router advertisements allow for MitM attacks on IPv4 clusters (CVE-2020-10749)
* QEMU: slirp: networking out-of-bounds read information disclosure vulnerability (CVE-2020-10756)
* golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash (CVE-2020-14040)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 8 | libslirp | 4.3.1-1.module_el8.6.0+2876+9ed4eae2 |
| AlmaLinux · 8 | libslirp-devel | 4.3.1-1.module_el8.6.0+2876+9ed4eae2 |
| AlmaLinux · 8 | python-podman-api | 1.2.0-0.2.gitd0a45fe.module_el8.5.0+2635+e4386a39 |
| AlmaLinux · 8 | python-podman-api | 1.2.0-0.2.gitd0a45fe.module_el8.5.0+108+00865455 |
Vulnerabilities 3
-
High 7.5
golang.org/x/text Infinite loop
The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker could provide a single byte to a UTF16 decoder insta…
-
Medium 6.0CVE-2020-10749 Public exploit
containernetworking/plugins vulnerable to MitM attacks
A vulnerability was found in all versions of containernetworking/plugins before version 0.8.6, that allows malicious containers in Kubernetes clusters to perform man-in-the-middle (MitM) attacks. A malicious container can exploit this flaw by sending rogue IP…
-
Unscored —
An out-of-bounds read vulnerability was found in the SLiRP networking implementation of the QEMU emulator. This flaw oc…
References
-
report
https://bugzilla.redhat.com/1682970
-
report
https://bugzilla.redhat.com/1752079
-
report
https://bugzilla.redhat.com/1785242
-
report
https://bugzilla.redhat.com/1800815
-
report
https://bugzilla.redhat.com/1801874
-
report
https://bugzilla.redhat.com/1804193
-
report
https://bugzilla.redhat.com/1804195
-
report
https://bugzilla.redhat.com/1813845
-
report
https://bugzilla.redhat.com/1814928
-
report
https://bugzilla.redhat.com/1818694
-
report
https://bugzilla.redhat.com/1821193
-
report
https://bugzilla.redhat.com/1822038
-
report
https://bugzilla.redhat.com/1825789
-
report
https://bugzilla.redhat.com/1827794
-
report
https://bugzilla.redhat.com/1833220
-
report
https://bugzilla.redhat.com/1835986
-
report
https://bugzilla.redhat.com/1837755
-
report
https://bugzilla.redhat.com/1847544
-
report
https://bugzilla.redhat.com/1849557
-
report
https://bugzilla.redhat.com/1850230
-
report
https://bugzilla.redhat.com/1853230
-
report
https://bugzilla.redhat.com/1853652
-
report
https://bugzilla.redhat.com/1857606
-
report
https://bugzilla.redhat.com/1858862
-
report
https://bugzilla.redhat.com/1860126
-
report
https://bugzilla.redhat.com/1866153
-
report
https://bugzilla.redhat.com/1866833
-
report
https://bugzilla.redhat.com/1867447
-
report
https://bugzilla.redhat.com/1868612
-
report
https://bugzilla.redhat.com/1872263
-
report
https://bugzilla.redhat.com/1877463
-
report
https://bugzilla.redhat.com/1879622
-
advisory
https://errata.almalinux.org/8/ALSA-2020-4694.html
-
report
https://vulners.com/cve/CVE-2020-10749
-
report
https://vulners.com/cve/CVE-2020-10756
-
report
https://vulners.com/cve/CVE-2020-14040