Summary
The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images.
Security Fix(es):
* containers/storage: DoS via malicious image (CVE-2021-20291)
* golang: net: lookup functions may return invalid host names (CVE-2021-33195)
* golang: net/http/httputil: ReverseProxy forwards connection headers if first one is empty (CVE-2021-33197)
* golang: math/big.Rat: may cause a panic or an unrecoverable fatal error if passed inputs with very large exponents (CVE-2021-33198)
* golang: crash in a golang.org/x/crypto/ssh server (CVE-2022-27191)
* podman: possible information disclosure and modification (CVE-2022-2989)
* buildah: possible information disclosure and modification (CVE-2022-2990)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 9 | buildah | 1:1.27.0-2.el9 |
| AlmaLinux · 9 | buildah-tests | 1:1.27.0-2.el9 |
Vulnerabilities 7
-
High 7.5
golang.org/x/crypto/ssh Denial of service via crafted Signer
The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey.
-
High 7.1
Podman's incorrect handling of the supplementary groups may lead to data disclosure, modification
An incorrect handling of the supplementary groups in the Podman container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to…
-
High 7.1
Buildah's incorrect handling of the supplementary groups may lead to data disclosure, modification
An incorrect handling of the supplementary groups in the Buildah container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used t…
-
Medium 6.5
Improper Locking in github.com/containers/storage
A deadlock vulnerability was found in 'github.com/containers/storage' in versions before 1.28.1. When a container image is processed, each layer is unpacked using `tar`. If one of those layers is not a valid `tar` archive this causes an error leading to an un…
-
Unscored —
Improper sanitization when resolving values from DNS in net
Go before 1.15.13 and 1.16.x before 1.16.5 has functions for DNS lookups that do not validate replies from DNS servers, and thus a return value may contain an unsafe injection (e.g., XSS) that does not conform to the RFC1035 format.
-
Unscored —
Attacker can drop certain headers in net/http/httputil
In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from net/http/httputil) result in a situation where an attacker is able to drop arbitrary headers.
-
Unscored —
Panic on inputs with large exponents in math/big
In Go before 1.15.13 and 1.16.x before 1.16.5, there can be a panic for a large exponent to the math/big.Rat SetString or UnmarshalText method.
References
-
report
https://access.redhat.com/security/cve/CVE-2021-20291
-
report
https://access.redhat.com/security/cve/CVE-2021-33195
-
report
https://access.redhat.com/security/cve/CVE-2021-33197
-
report
https://access.redhat.com/security/cve/CVE-2021-33198
-
report
https://access.redhat.com/security/cve/CVE-2022-27191
-
report
https://access.redhat.com/security/cve/CVE-2022-2989
-
report
https://access.redhat.com/security/cve/CVE-2022-2990
-
report
https://bugzilla.redhat.com/1939485
-
report
https://bugzilla.redhat.com/1989564
-
report
https://bugzilla.redhat.com/1989570
-
report
https://bugzilla.redhat.com/1989575
-
report
https://bugzilla.redhat.com/2064702
-
report
https://bugzilla.redhat.com/2121445
-
report
https://bugzilla.redhat.com/2121453
-
advisory
https://errata.almalinux.org/9/ALSA-2022-8008.html