Summary
The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.
Security Fix(es):
* golang.org/x/text: Panic in language.ParseAcceptLanguage while parsing -u- extension (CVE-2020-28851)
* golang.org/x/text: Panic in language.ParseAcceptLanguage while processing bcp47 tag (CVE-2020-28852)
* podman: podman machine spawns gvproxy with port bound to all IPs (CVE-2021-4024)
* podman: Remote traffic to rootless containers is seen as orginating from localhost (CVE-2021-20199)
* containers/storage: DoS via malicious image (CVE-2021-20291)
* golang: net/http/httputil: ReverseProxy forwards connection headers if first one is empty (CVE-2021-33197)
* golang: crypto/tls: certificate of wrong type is causing TLS client to panic (CVE-2021-34558)
* golang: crash in a golang.org/x/crypto/ssh server (CVE-2022-27191)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 9 | podman | 2:4.2.0-3.el9 |
| AlmaLinux · 9 | podman-docker | 2:4.2.0-3.el9 |
| AlmaLinux · 9 | podman-gvproxy | 2:4.2.0-3.el9 |
| AlmaLinux · 9 | podman-plugins | 2:4.2.0-3.el9 |
| AlmaLinux · 9 | podman-remote | 2:4.2.0-3.el9 |
| AlmaLinux · 9 | podman-tests | 2:4.2.0-3.el9 |
Vulnerabilities 8
-
High 7.5
golang.org/x/crypto/ssh Denial of service via crafted Signer
The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey.
-
Medium 6.5
Improper Locking in github.com/containers/storage
A deadlock vulnerability was found in 'github.com/containers/storage' in versions before 1.28.1. When a container image is processed, each layer is unpacked using `tar`. If one of those layers is not a valid `tar` archive this causes an error leading to an un…
-
Medium 6.5
Exposure of Sensitive Information to an Unauthorized Actor and Origin Validation Error in podman
A flaw was found in podman. The `podman machine` function (used to create and manage Podman virtual machine containing a Podman process) spawns a `gvproxy` process on the host system. The `gvproxy` API is accessible on port 7777 on all IP addresses on the hos…
-
Medium 5.9
Podman Origin Validation Error
Rootless containers run with Podman, receive all traffic with a source IP address of 127.0.0.1 (including from remote hosts). This impacts containerized applications that trust localhost (127.0.01) connections by default and do not require authentication. Thi…
-
Unscored —
In x/text in Go 1.15.4, an "index out of range" panic occurs in language.ParseAcceptLanguage while parsing the -u- exte…
-
Unscored —
In x/text in Go before v0.3.5, a "slice bounds out of range" panic occurs in language.ParseAcceptLanguage while process…
-
Unscored —
Attacker can drop certain headers in net/http/httputil
In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from net/http/httputil) result in a situation where an attacker is able to drop arbitrary headers.
-
Unscored —CVE-2021-34558 Public exploit
Panic on certain certificates in crypto/tls
The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS server to cause a TLS client to panic.
References
-
report
https://access.redhat.com/security/cve/CVE-2020-28851
-
report
https://access.redhat.com/security/cve/CVE-2020-28852
-
report
https://access.redhat.com/security/cve/CVE-2021-20199
-
report
https://access.redhat.com/security/cve/CVE-2021-20291
-
report
https://access.redhat.com/security/cve/CVE-2021-33197
-
report
https://access.redhat.com/security/cve/CVE-2021-34558
-
report
https://access.redhat.com/security/cve/CVE-2021-4024
-
report
https://access.redhat.com/security/cve/CVE-2022-27191
-
report
https://bugzilla.redhat.com/1913333
-
report
https://bugzilla.redhat.com/1913338
-
report
https://bugzilla.redhat.com/1919050
-
report
https://bugzilla.redhat.com/1939485
-
report
https://bugzilla.redhat.com/1983596
-
report
https://bugzilla.redhat.com/1989570
-
report
https://bugzilla.redhat.com/2026675
-
report
https://bugzilla.redhat.com/2064702
-
advisory
https://errata.almalinux.org/9/ALSA-2022-7954.html