ALSA-2022:7529 — Moderate: container-tools:3.0 security update

Summary

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

* golang: net/http: improper sanitization of Transfer-Encoding header (CVE-2022-1705)
* cri-o: memory exhaustion on the node when access to the kube api (CVE-2022-1708)
* golang: go/parser: stack exhaustion in all Parse* functions (CVE-2022-1962)
* prometheus/client_golang: Denial of service using InstrumentHandlerCounter (CVE-2022-21698)
* golang: encoding/xml: stack exhaustion in Decoder.Skip (CVE-2022-28131)
* golang: io/fs: stack exhaustion in Glob (CVE-2022-30630)
* golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)
* golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632)
* golang: encoding/xml: stack exhaustion in Unmarshal (CVE-2022-30633)
* golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working (CVE-2022-32148)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Fixed packages 43

Release	Package	Fixed in
AlmaLinux · 8	buildah	1.19.9-6.module_el8.7.0+3297+1eb250cf
AlmaLinux · 8	buildah-tests	1.19.9-6.module_el8.7.0+3297+1eb250cf
AlmaLinux · 8	cockpit-podman	29-2.module_el8.6.0+2876+9ed4eae2
AlmaLinux · 8	conmon	2:2.0.26-3.module_el8.7.0+3297+1eb250cf
AlmaLinux · 8	container-selinux	2:2.189.0-1.module_el8.7.0+3406+a17c4180
AlmaLinux · 8	container-selinux	2:2.189.0-1.module_el8.6.0+3336+00d107d5
AlmaLinux · 8	container-selinux	2:2.189.0-1.module_el8.7.0+3297+1eb250cf
AlmaLinux · 8	containernetworking-plugins	0.9.1-1.module_el8.6.0+2876+9ed4eae2
AlmaLinux · 8	containernetworking-plugins	0.9.1-1.module_el8.6.0+3136+bfcd65b6
AlmaLinux · 8	containers-common	1:1.2.4-2.module_el8.7.0+3297+1eb250cf
AlmaLinux · 8	crit	3.15-1.module_el8.6.0+2876+9ed4eae2
AlmaLinux · 8	crit	3.15-1.module_el8.6.0+3136+bfcd65b6
AlmaLinux · 8	criu	3.15-1.module_el8.6.0+2876+9ed4eae2
AlmaLinux · 8	criu	3.15-1.module_el8.6.0+3136+bfcd65b6
AlmaLinux · 8	crun	0.18-3.module_el8.6.0+2876+9ed4eae2
AlmaLinux · 8	crun	0.18-3.module_el8.6.0+3136+bfcd65b6
AlmaLinux · 8	fuse-overlayfs	1.4.0-2.module_el8.6.0+2876+9ed4eae2
AlmaLinux · 8	fuse-overlayfs	1.4.0-2.module_el8.6.0+3136+bfcd65b6
AlmaLinux · 8	libslirp	4.3.1-1.module_el8.6.0+3136+bfcd65b6
AlmaLinux · 8	libslirp	4.3.1-1.module_el8.6.0+2876+9ed4eae2
AlmaLinux · 8	libslirp-devel	4.3.1-1.module_el8.6.0+2876+9ed4eae2
AlmaLinux · 8	libslirp-devel	4.3.1-1.module_el8.6.0+3136+bfcd65b6
AlmaLinux · 8	oci-seccomp-bpf-hook	1.2.0-3.module_el8.6.0+2876+9ed4eae2
AlmaLinux · 8	oci-seccomp-bpf-hook	1.2.0-3.module_el8.6.0+3136+bfcd65b6
AlmaLinux · 8	podman	3.0.1-13.module_el8.7.0+3297+1eb250cf
AlmaLinux · 8	podman-catatonit	3.0.1-13.module_el8.7.0+3297+1eb250cf
AlmaLinux · 8	podman-docker	3.0.1-13.module_el8.7.0+3297+1eb250cf
AlmaLinux · 8	podman-plugins	3.0.1-13.module_el8.7.0+3297+1eb250cf
AlmaLinux · 8	podman-remote	3.0.1-13.module_el8.7.0+3297+1eb250cf
AlmaLinux · 8	podman-tests	3.0.1-13.module_el8.7.0+3297+1eb250cf
AlmaLinux · 8	python3-criu	3.15-1.module_el8.6.0+2876+9ed4eae2
AlmaLinux · 8	python3-criu	3.15-1.module_el8.6.0+3136+bfcd65b6
AlmaLinux · 8	runc	1.0.0-73.rc95.module_el8.6.0+3136+bfcd65b6
AlmaLinux · 8	runc	1.0.0-73.rc95.module_el8.6.0+2876+9ed4eae2
AlmaLinux · 8	skopeo	1:1.2.4-2.module_el8.7.0+3297+1eb250cf
AlmaLinux · 8	skopeo-tests	1:1.2.4-2.module_el8.7.0+3297+1eb250cf
AlmaLinux · 8	slirp4netns	1.1.8-1.module_el8.6.0+2876+9ed4eae2
AlmaLinux · 8	slirp4netns	1.1.8-1.module_el8.6.0+3136+bfcd65b6
AlmaLinux · 8	toolbox	0.0.99.3-1.module_el8.6.0+2876+9ed4eae2
AlmaLinux · 8	toolbox	0.0.99.3-1.module_el8.6.0+3136+bfcd65b6
AlmaLinux · 8	toolbox-tests	0.0.99.3-1.module_el8.6.0+3136+bfcd65b6
AlmaLinux · 8	toolbox-tests	0.0.99.3-1.module_el8.6.0+2876+9ed4eae2
AlmaLinux · 8	udica	0.2.4-1.module_el8.6.0+2876+9ed4eae2

Vulnerabilities 10

High 7.5

CVE-2022-1708

Node DOS by way of memory exhaustion through ExecSync request in CRI-O

A vulnerability was found in CRI-O that causes memory or disk space exhaustion on the node for anyone with access to the Kube API. The ExecSync request runs commands in a container and logs the output of the command. This output is then read by CRI-O after co…

cri-o github.com/cri-o/cri-o cri-o Azure Linux Alpine Go

Jun 7, 2022
High 7.5

CVE-2022-21698

Uncontrolled Resource Consumption in promhttp

client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers and clients. In client_golang prior to version 1.11.1, HTTP server is susceptible to a Denial of Ser…

prometheus client_golang cri-o dynamic-localpv-provisioner Debian Ubuntu Azure Linux Alpine Wolfi Go

Feb 15, 2022
High 7.5

CVE-2022-30630

Stack exhaustion in Glob on certain paths in io/fs

Uncontrolled recursion in Glob in io/fs before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path which contains a large number of path separators.

Go standard library io/fs golang go Debian Ubuntu Azure Linux Alpine Go

Aug 9, 2022
High 7.5

CVE-2022-30631

Stack exhaustion when reading certain archives in compress/gzip

Uncontrolled recursion in Reader.Read in compress/gzip before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via an archive containing a large number of concatenated 0-length compressed files.

Go standard library compress/gzip golang go Debian Ubuntu Azure Linux Alpine Go

Aug 9, 2022
High 7.5

CVE-2022-30633

Stack exhaustion when unmarshaling certain documents in encoding/xml

Uncontrolled recursion in Unmarshal in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via unmarshalling an XML document into a Go struct which has a nested field that uses the 'any' field tag.

Go standard library encoding/xml golang go Debian Ubuntu Azure Linux Alpine Go

Aug 9, 2022
Medium 6.5

CVE-2022-1705

Improper sanitization of Transfer-Encoding headers in net/http

Acceptance of some invalid Transfer-Encoding headers in the HTTP/1 client in net/http before Go 1.17.12 and Go 1.18.4 allows HTTP request smuggling if combined with an intermediate server that also improperly fails to reject the header as invalid.

Go standard library net/http golang go Debian Ubuntu Azure Linux Alpine Go

Aug 9, 2022
Medium 6.5

CVE-2022-32148

Exposure of client IP addresses in net/http

Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by calling httputil.ReverseProxy.ServeHTTP with a Request.Header map containing a nil value for the X-Forwarded-For header, which causes ReverseProxy to set …

Go standard library net/http golang go Debian Ubuntu Azure Linux Alpine Go

Aug 9, 2022
Medium 5.5

CVE-2022-1962

Stack exhaustion due to deeply nested types in go/parser

Uncontrolled recursion in the Parse functions in go/parser before Go 1.17.12 and Go 1.18.4 allow an attacker to cause a panic due to stack exhaustion via deeply nested types or declarations.

Go standard library go/parser golang go Debian Ubuntu Azure Linux Alpine Go

Aug 9, 2022
Unscored —

CVE-2022-28131

Stack exhaustion from deeply nested XML documents in encoding/xml

Uncontrolled recursion in Decoder.Skip in encoding/xml before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a deeply nested XML document.

Go standard library encoding/xml golang go Debian Ubuntu Azure Linux Alpine Go

Aug 9, 2022
Unscored —

CVE-2022-30632

Stack exhaustion on crafted paths in path/filepath

Uncontrolled recursion in Glob in path/filepath before Go 1.17.12 and Go 1.18.4 allows an attacker to cause a panic due to stack exhaustion via a path containing a large number of path separators.

Go standard library path/filepath golang go Debian Ubuntu Azure Linux Alpine Go

Aug 9, 2022

References

report
https://access.redhat.com/security/cve/CVE-2022-1705
report
https://access.redhat.com/security/cve/CVE-2022-1708
report
https://access.redhat.com/security/cve/CVE-2022-1962
report
https://access.redhat.com/security/cve/CVE-2022-21698
report
https://access.redhat.com/security/cve/CVE-2022-28131
report
https://access.redhat.com/security/cve/CVE-2022-30630
report
https://access.redhat.com/security/cve/CVE-2022-30631
report
https://access.redhat.com/security/cve/CVE-2022-30632
report
https://access.redhat.com/security/cve/CVE-2022-30633
report
https://access.redhat.com/security/cve/CVE-2022-32148
report
https://bugzilla.redhat.com/2045880
report
https://bugzilla.redhat.com/2085361
report
https://bugzilla.redhat.com/2107342
report
https://bugzilla.redhat.com/2107371
report
https://bugzilla.redhat.com/2107374
report
https://bugzilla.redhat.com/2107376
report
https://bugzilla.redhat.com/2107383
report
https://bugzilla.redhat.com/2107386
report
https://bugzilla.redhat.com/2107390
report
https://bugzilla.redhat.com/2107392
advisory
https://errata.almalinux.org/8/ALSA-2022-7529.html

Moderate: container-tools:3.0 security update

Summary

Fixed packages 43

Vulnerabilities 10

Node DOS by way of memory exhaustion through ExecSync request in CRI-O

Uncontrolled Resource Consumption in promhttp

Stack exhaustion in Glob on certain paths in io/fs

Stack exhaustion when reading certain archives in compress/gzip

Stack exhaustion when unmarshaling certain documents in encoding/xml

Improper sanitization of Transfer-Encoding headers in net/http

Exposure of client IP addresses in net/http

Stack exhaustion due to deeply nested types in go/parser

Stack exhaustion from deeply nested XML documents in encoding/xml

Stack exhaustion on crafted paths in path/filepath

References