Skip to content
OpenAdvisories
High ELSA-2021-0705 1 CVE

Important: container-tools:1.0 security update (Oracle Linux 8)

Published Mar 5, 2021 · Updated Mar 5, 2021

Summary

buildah
[1.5-8.gite94b4f9.0.1]
- Fixes troubles with oracle registry login [Orabug: 29937283]

[1.5-8.gite94b4f9]
- bump release to preserve upgrade path
- Related: #1821193

[1.5-4.gite94b4f9]
- fix 'CVE-2020-10696 buildah: crafted input tar file may lead to local file overwriting during image build process'
- Resolves: #1818127

[1.5-3.gite94b4f9]
- re-enable debuginfo

[1.5-2.gite94b4f9]
- go toolset not in scl anymore

[1.5-1.gite94b4f9]
- rebase

[1.4-3.git608fa84]
- fedora-like go compiler macro in buildrequires is enough

[1.4-2.git608fa84]
- rebase

[1.3-3.git4888163]
- Resolves: #1615611 - rebuild with gobuild tag 'no_openssl'

[1.3-2.git4888163]
- Resolves: #1614009 - built with updated scl-ized go-toolset dep
- build with %gobuild

[1.3-1]
- Bump to v1.3
- Vendor in lates containers/image
- build-using-dockerfile: let -t include transports again
- Block use of /proc/acpi and /proc/keys from inside containers
- Fix handling of --registries-conf
- Fix becoming a maintainer link
- add optional CI test fo darwin
- Don't pass a nil error to errors.Wrapf()
- image filter test: use kubernetes/pause as a 'since'
- Add --cidfile option to from
- vendor: update containers/storage
- Contributors need to find the CONTRIBUTOR.md file easier
- Add a --loglevel option to build-with-dockerfile
- Create Development plan
- cmd: Code improvement
- allow buildah cross compile for a darwin target
- Add unused function param lint check
- docs: Follow man-pages(7) suggestions for SYNOPSIS
- Start using github.com/seccomp/containers-golang
- umount: add all option to umount all mounted containers
- runConfigureNetwork(): remove an unused parameter
- Update github.com/opencontainers/selinux
- Fix buildah bud --layers
- Force ownership of /etc/hosts and /etc/resolv.conf to 0:0
- main: if unprivileged, reexec in a user namespace
- Vendor in latest imagebuilder
- Reduce the complexity of the buildah.Run function
- mount: output it before replacing lastError
- Vendor in latest selinux-go code
- Implement basic recognition of the '--isolation' option
- Run(): try to resolve non-absolute paths using /usr/local/bin:/usr/bin:/usr/local/sbin:/usr/sbin:/home/opc/.local/bin:/home/opc/bin
- Run(): don't include any default environment variables
- build without seccomp
- vendor in latest runtime-tools
- bind/mount_unsupported.go: remove import errors
- Update github.com/opencontainers/runc
- Add Capabilities lists to BuilderInfo
- Tweaks for commit tests
- commit: recognize committing to second storage locations
- Fix ARGS parsing for run commands
- Add info on registries.conf to from manpage
- Switch from using docker to podman for testing in .papr
- buildah: set the HTTP User-Agent
- ONBUILD tutorial
- Add information about the configuration files to the install docs
- Makefile: add uninstall
- Add tilde info for push to troubleshooting
- mount: support multiple inputs
- Use the right formatting when adding entries to /etc/hosts
- Vendor in latest go-selinux bindings
- Allow --userns-uid-map/--userns-gid-map to be global options
- bind: factor out UnmountMountpoints
- Run(): simplify runCopyStdio()
- Run(): handle POLLNVAL results
- Run(): tweak terminal mode handling
- Run(): rename 'copyStdio' to 'copyPipes'
- Run(): don't set a Pdeathsig for the runtime
- Run(): add options for adding and removing capabilities
- Run(): don't use a callback when a slice will do
- setupSeccomp(): refactor
- Change RunOptions.Stdin/Stdout/Stderr to just be Reader/Writers
- Escape use of '_' in .md docs
- Break out getProcIDMappings()
- Break out SetupIntermediateMountNamespace()
- Add Multi From Demo
- Use the c/image conversion code instead of converting configs manually
- Don't throw away the manifest MIME type and guess again
- Consolidate loading manifest and config in initConfig
- Pass a types.Image to Builder.initConfig
- Require an image ID in importBuilderDataFromImage
- Use c/image/manifest.GuessMIMEType instead of a custom heuristic
- Do not ignore any parsing errors in initConfig
- Explicitly handle 'from scratch' images in Builder.initConfig
- Fix parsing of OCI images
- Simplify dead but dangerous-looking error handling
- Don't ignore v2s1 history if docker_version is not set
- Add --rm and --force-rm to buildah bud
- Add --all,-a flag to buildah images
- Separate stdio buffering from writing
- Remove tty check from images --format
- Add environment variable BUILDAH_RUNTIME
- Add --layers and --no-cache to buildah bud
- Touch up images man
- version.md: fix DESCRIPTION
- tests: add containers test
- tests: add images test
- images: fix usage
- fix make clean error
- Change 'registries' to 'container registries' in man
- add commit test
- Add(): learn to record hashes of what we add
- Minor update to buildah config documentation for entrypoint
- Bump to v1.2-dev
- Add registries.conf link to a few man pages

[1.2-3]
- do not depend on btrfs-progs for rhel8

[1.2-2]
- buildah does not require ostree

[1.2-1]
- Vendor in latest containers/image
- build-using-dockerfile: let -t include transports again
- Block use of /proc/acpi and /proc/keys from inside containers
- Fix handling of --registries-conf
- Fix becoming a maintainer link
- add optional CI test fo darwin
- Don't pass a nil error to errors.Wrapf()
- image filter test: use kubernetes/pause as a 'since'
- Add --cidfile option to from
- vendor: update containers/storage
- Contributors need to find the CONTRIBUTOR.md file easier
- Add a --loglevel option to build-with-dockerfile
- Create Development plan
- cmd: Code improvement
- allow buildah cross compile for a darwin target
- Add unused function param lint check
- docs: Follow man-pages(7) suggestions for SYNOPSIS
- Start using github.com/seccomp/containers-golang
- umount: add all option to umount all mounted containers
- runConfigureNetwork(): remove an unused parameter
- Update github.com/opencontainers/selinux
- Fix buildah bud --layers
- Force ownership of /etc/hosts and /etc/resolv.conf to 0:0
- main: if

Fixed packages 15

ReleasePackageFixed in
Oracle Linux · 8 buildah 0:1.5-8.gite94b4f9.0.1.module+el8.3.0+9668+293abd4d
Oracle Linux · 8 container-selinux 2:2.124.0-1.gitf958d0c.module+el8.3.0+9668+293abd4d
Oracle Linux · 8 containernetworking-plugins 0:0.7.4-4.git9ebe139.module+el8.3.0+9668+293abd4d
Oracle Linux · 8 containers-common 1:0.1.32-6.git1715c90.0.1.module+el8.3.0+9668+293abd4d
Oracle Linux · 8 crit 0:3.12-9.module+el8.3.0+9668+293abd4d
Oracle Linux · 8 criu 0:3.12-9.module+el8.3.0+9668+293abd4d
Oracle Linux · 8 fuse-overlayfs 0:0.3-5.module+el8.3.0+9668+293abd4d
Oracle Linux · 8 oci-systemd-hook 1:0.1.15-2.git2d0b8a3.module+el8.3.0+9668+293abd4d
Oracle Linux · 8 oci-umount 2:2.3.4-2.git87f9237.module+el8.3.0+9668+293abd4d
Oracle Linux · 8 podman 0:1.0.0-8.git921f98f.module+el8.3.0+9668+293abd4d
Oracle Linux · 8 podman-docker 0:1.0.0-8.git921f98f.module+el8.3.0+9668+293abd4d
Oracle Linux · 8 python3-criu 0:3.12-9.module+el8.3.0+9668+293abd4d
Oracle Linux · 8 runc 0:1.0.0-56.rc5.dev.git2abd837.module+el8.3.0+9668+293abd4d
Oracle Linux · 8 skopeo 1:0.1.32-6.git1715c90.0.1.module+el8.3.0+9668+293abd4d
Oracle Linux · 8 slirp4netns 0:0.1-5.dev.gitc4e1bc5.module+el8.3.0+9668+293abd4d

Vulnerabilities 1

  • High 7.0

    Improper Authorization in github.com/containers/libpod

    A flaw was found in podman before 1.7.0. File permissions for non-root users running in a privileged container are not correctly checked. This flaw can be abused by a low-privileged user inside the container to access any other file in the container, even if …