Summary
The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.
Security Fix(es):
* buildah: full container escape at build time (CVE-2024-1753)
* golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters (CVE-2022-2880)
* golang: regexp/syntax: limit memory used by parsing regexps (CVE-2022-41715)
* golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON (CVE-2024-24786)
* jose-go: improper handling of highly compressed data (CVE-2024-28180)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 34
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 8 | aardvark-dns | 2:1.10.0-1.module_el8.10.0+3792+03eaed9c |
| AlmaLinux · 8 | buildah | 2:1.33.7-1.module_el8.10.0+3845+87b84552 |
| AlmaLinux · 8 | buildah-tests | 2:1.33.7-1.module_el8.10.0+3845+87b84552 |
| AlmaLinux · 8 | cockpit-podman | 84.1-1.module_el8.10.0+3792+03eaed9c |
| AlmaLinux · 8 | conmon | 3:2.1.10-1.module_el8.10.0+3845+87b84552 |
| AlmaLinux · 8 | container-selinux | 2:2.229.0-2.module_el8.10.0+3792+03eaed9c |
| AlmaLinux · 8 | containernetworking-plugins | 1:1.4.0-2.module_el8.10.0+3792+03eaed9c |
| AlmaLinux · 8 | containers-common | 2:1-81.module_el8.10.0+3792+03eaed9c |
| AlmaLinux · 8 | crit | 3.18-5.module_el8.10.0+3845+87b84552 |
| AlmaLinux · 8 | criu | 3.18-5.module_el8.10.0+3845+87b84552 |
| AlmaLinux · 8 | criu-devel | 3.18-5.module_el8.10.0+3845+87b84552 |
| AlmaLinux · 8 | criu-libs | 3.18-5.module_el8.10.0+3845+87b84552 |
| AlmaLinux · 8 | crun | 1.14.3-2.module_el8.10.0+3845+87b84552 |
| AlmaLinux · 8 | fuse-overlayfs | 1.13-1.module_el8.10.0+3792+03eaed9c |
| AlmaLinux · 8 | libslirp | 4.4.0-2.module_el8.10.0+3845+87b84552 |
| AlmaLinux · 8 | libslirp-devel | 4.4.0-2.module_el8.10.0+3845+87b84552 |
| AlmaLinux · 8 | netavark | 2:1.10.3-1.module_el8.10.0+3845+87b84552 |
| AlmaLinux · 8 | oci-seccomp-bpf-hook | 1.2.10-1.module_el8.10.0+3792+03eaed9c |
| AlmaLinux · 8 | podman | 4:4.9.4-1.module_el8.10.0+3845+87b84552 |
| AlmaLinux · 8 | podman-catatonit | 4:4.9.4-1.module_el8.10.0+3845+87b84552 |
| AlmaLinux · 8 | podman-docker | 4:4.9.4-1.module_el8.10.0+3845+87b84552 |
| AlmaLinux · 8 | podman-gvproxy | 4:4.9.4-1.module_el8.10.0+3845+87b84552 |
| AlmaLinux · 8 | podman-plugins | 4:4.9.4-1.module_el8.10.0+3845+87b84552 |
| AlmaLinux · 8 | podman-remote | 4:4.9.4-1.module_el8.10.0+3845+87b84552 |
| AlmaLinux · 8 | podman-tests | 4:4.9.4-1.module_el8.10.0+3845+87b84552 |
| AlmaLinux · 8 | python3-criu | 3.18-5.module_el8.10.0+3845+87b84552 |
| AlmaLinux · 8 | python3-podman | 4.9.0-1.module_el8.10.0+3792+03eaed9c |
| AlmaLinux · 8 | runc | 1:1.1.12-1.module_el8.10.0+3845+87b84552 |
| AlmaLinux · 8 | skopeo | 2:1.14.3-2.module_el8.10.0+3845+87b84552 |
| AlmaLinux · 8 | skopeo-tests | 2:1.14.3-2.module_el8.10.0+3845+87b84552 |
| AlmaLinux · 8 | slirp4netns | 1.2.3-1.module_el8.10.0+3845+87b84552 |
| AlmaLinux · 8 | toolbox | 0.0.99.5-2.module_el8.10.0+3845+87b84552 |
| AlmaLinux · 8 | toolbox-tests | 0.0.99.5-2.module_el8.10.0+3845+87b84552 |
| AlmaLinux · 8 | udica | 0.2.6-21.module_el8.10.0+3845+87b84552 |
Vulnerabilities 5
-
High 8.6
Buildah: buildah: container escape via improper bind mount validation
A flaw was found in Buildah (and subsequently Podman Build) which allows containers to mount arbitrary locations on the host filesystem into build containers. A malicious Containerfile can use a dummy image with a symbolic link to the root filesystem as a mou…
-
High 7.5
Infinite loop in JSON unmarshaling in google.golang.org/protobuf
The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown opti…
-
Medium 4.3
Go JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification)
Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Th…
-
Unscored —
Incorrect sanitization of forwarded query parameters in net/http/httputil
Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy forwards a parameter with an unparsable value. Afte…
-
Unscored —
Memory exhaustion when compiling regular expressions in regexp/syntax
Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed regexp representation is linear in the size of the input, but in some cases the constant factor can be as high as 40,000,…
References
-
report
https://access.redhat.com/security/cve/CVE-2022-2880
-
report
https://access.redhat.com/security/cve/CVE-2022-41715
-
report
https://access.redhat.com/security/cve/CVE-2024-1753
-
report
https://access.redhat.com/security/cve/CVE-2024-24786
-
report
https://access.redhat.com/security/cve/CVE-2024-28180
-
report
https://bugzilla.redhat.com/2132868
-
report
https://bugzilla.redhat.com/2132872
-
report
https://bugzilla.redhat.com/2265513
-
report
https://bugzilla.redhat.com/2268046
-
report
https://bugzilla.redhat.com/2268854
-
advisory
https://errata.almalinux.org/8/ALSA-2024-3254.html