Summary
buildah
[1:1.24.2-4]
- update to the latest content of https://github.com/containers/buildah/tree/release-1.24
(https://github.com/containers/buildah/commit/7b559a3)
- Related: #2059296
[1:1.24.2-3]
- switch to RHEL maintenance branch which fixes CVE-2022-27651
- Resolves: #2067559
[1:1.24.2-2]
- Add patch to fix bash symtax for gating tests
- Upstream PR: https://github.com/containers/buildah/pull/3792
- Related: #2001445
[1:1.24.2-1]
- update to https://github.com/containers/buildah/releases/tag/v1.24.2
- Related: #2001445
[1:1.24.1-1]
- update to https://github.com/containers/buildah/releases/tag/v1.24.1
- Related: #2001445
[1:1.24.0-1]
- update to https://github.com/containers/buildah/releases/tag/v1.24.0
- Related: #2001445
cockpit-podman
[43-1]
- update to https://github.com/cockpit-project/cockpit-podman/releases/tag/43
- Related: #2017266
conmon
[2:2.1.0-1]
- update to https://github.com/containers/conmon/releases/tag/v2.1.0
- Related: #2001445
containernetworking-plugins
[1:1.0.1-2]
- revert back to https://github.com/containernetworking/plugins/releases/tag/v1.0.1
- Related: #2001445
containers-common
[1-27.0.1]
- Updated removed references [Orabug: 33473101] (Alex Burmashev)
- Adjust registries.conf (Nikita Gerasimov)
- remove references to RedHat registry (Nikita Gerasimov)
[2:1-27]
- update vendored tarballs to avoid unwanted licenses
(thanks to Brent Baude)
- Related: #2065707
container-selinux
[2:2.179.1-1]
- update to https://github.com/containers/container-selinux/releases/tag/v2.179.1
- Related: #2001445
criu
[3.15-3]
- add Requires: criu-libs = %{version}-%{release} in criu-devel
- add gating tests
- Related: #1934415
[3.15-2]
- add -devel and -libs subpackages
- Resolves: #1971718
crun
[1.4.4-1]
- update to https://github.com/containers/crun/releases/tag/1.4.4
- Resolves: #2067577
fuse-overlayfs
[1.8.2-1]
- update to https://github.com/containers/fuse-overlayfs/releases/tag/v1.8.2
- Related: #2001445
libslirp
[4.4.0-1]
- Fix CVE-2021-3592 CVE-2021-3593 CVE-2021-3594 CVE-2021-3595 out-of-bounds access
- Related: #1934415
oci-seccomp-bpf-hook
[1.2.3-3]
- change runc dependency to conflict
- Related: #1934415
podman
[2:4.0.2-6]
- update to the latest content of https://github.com/containers/podman/tree/v4.0-rhel
(https://github.com/containers/podman/commit/3d24a66)
- Related: #2059296
[2:4.0.2-5]
- update to the latest content of https://github.com/containers/podman/tree/v4.0-rhel
(https://github.com/containers/podman/commit/bb1e6e6)
- Related: #2059296
[2:4.0.2-4]
- update to the latest content of https://github.com/containers/podman/tree/v4.0-rhel
(https://github.com/containers/podman/commit/5a54f81)
- Resolves: #2066493
[2:4.0.2-3]
- depend on libseccomp >= 2.5
- Resolves: #2065292
[2:4.0.2-2]
- update to the latest content of https://github.com/containers/podman/tree/v4.0-rhel
(https://github.com/containers/podman/commit/9237d75)
- Related: #2059296
[2:4.0.2-1]
- update to https://github.com/containers/podman/releases/tag/v4.0.2
- Related: #2059754
[2:4.0.1-1]
- update to https://github.com/containers/podman/releases/tag/v4.0.1
- Related: #2001445
python-podman
[4.0.0-1]
- bump to v4.0.0
- Related: #2001445
runc
[1.0.3-2]
- rollback to 1.0.3 due to gating test issues
- Related: #2001445
[1.1.0-1]
- update to https://github.com/opencontainers/runc/releases/tag/v1.1.0
- Related: #2001445
skopeo
[2:1.6.1-2]
- fix CVE-2022-21698
- Related: #2059296
[2:1.6.1-1]
- update to https://github.com/containers/skopeo/releases/tag/v1.6.1
- Related: #2001445
slirp4netns
[1.1.8-2]
- fix gating - don't use insecure functions - thanks to Marc-Andre Lureau
- Related: #2001445
udica
[0.2.6-3]
- Require container-selinux shipping policy templates (#2005866)
[0.2.6-1]
- update to https://github.com/containers/udica/releases/tag/v0.2.6
- Related: #2001445
[0.2.5-2]
- New rebase https://github.com/containers/udica/releases/tag/v0.2.5 (#1995041)
- Replace capability dictionary with str.lower()
- Enable udica to generate policies with fifo class
- Sort container inspect data before processing
- Update templates to work properly with new cil parser
- Related: #1934415
[0.2.5-1]
- update to https://github.com/containers/udica/releases/tag/v0.2.5
- Related: #1934415
[0.2.4-2]
- remove %check again and all related BRs
- Related: #1934415
Fixed packages 32
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | aardvark-dns | 2:1.0.1-27.module+el8.6.0+20656+53f7e955 |
| Oracle Linux · 8 | buildah | 1:1.24.2-4.module+el8.6.0+20656+53f7e955 |
| Oracle Linux · 8 | buildah-tests | 1:1.24.2-4.module+el8.6.0+20656+53f7e955 |
| Oracle Linux · 8 | cockpit-podman | 0:43-1.module+el8.6.0+20656+53f7e955 |
| Oracle Linux · 8 | conmon | 2:2.1.0-1.module+el8.6.0+20656+53f7e955 |
| Oracle Linux · 8 | container-selinux | 2:2.179.1-1.module+el8.6.0+20656+53f7e955 |
| Oracle Linux · 8 | containernetworking-plugins | 1:1.0.1-2.module+el8.6.0+20656+53f7e955 |
| Oracle Linux · 8 | containers-common | 2:1-27.0.1.module+el8.6.0+20656+53f7e955 |
| Oracle Linux · 8 | crit | 0:3.15-3.module+el8.6.0+20656+53f7e955 |
| Oracle Linux · 8 | criu | 0:3.15-3.module+el8.6.0+20656+53f7e955 |
| Oracle Linux · 8 | criu-devel | 0:3.15-3.module+el8.6.0+20656+53f7e955 |
| Oracle Linux · 8 | criu-libs | 0:3.15-3.module+el8.6.0+20656+53f7e955 |
| Oracle Linux · 8 | crun | 0:1.4.4-1.module+el8.6.0+20656+53f7e955 |
| Oracle Linux · 8 | fuse-overlayfs | 0:1.8.2-1.module+el8.6.0+20656+53f7e955 |
| Oracle Linux · 8 | libslirp | 0:4.4.0-1.module+el8.6.0+20656+53f7e955 |
| Oracle Linux · 8 | libslirp-devel | 0:4.4.0-1.module+el8.6.0+20656+53f7e955 |
| Oracle Linux · 8 | netavark | 2:1.0.1-27.module+el8.6.0+20656+53f7e955 |
| Oracle Linux · 8 | oci-seccomp-bpf-hook | 0:1.2.3-3.module+el8.6.0+20656+53f7e955 |
| Oracle Linux · 8 | podman | 2:4.0.2-6.module+el8.6.0+20656+53f7e955 |
| Oracle Linux · 8 | podman-catatonit | 2:4.0.2-6.module+el8.6.0+20656+53f7e955 |
| Oracle Linux · 8 | podman-docker | 2:4.0.2-6.module+el8.6.0+20656+53f7e955 |
| Oracle Linux · 8 | podman-gvproxy | 2:4.0.2-6.module+el8.6.0+20656+53f7e955 |
| Oracle Linux · 8 | podman-plugins | 2:4.0.2-6.module+el8.6.0+20656+53f7e955 |
| Oracle Linux · 8 | podman-remote | 2:4.0.2-6.module+el8.6.0+20656+53f7e955 |
| Oracle Linux · 8 | podman-tests | 2:4.0.2-6.module+el8.6.0+20656+53f7e955 |
| Oracle Linux · 8 | python3-criu | 0:3.15-3.module+el8.6.0+20656+53f7e955 |
| Oracle Linux · 8 | python3-podman | 0:4.0.0-1.module+el8.6.0+20656+53f7e955 |
| Oracle Linux · 8 | runc | 1:1.0.3-2.module+el8.6.0+20656+53f7e955 |
| Oracle Linux · 8 | skopeo | 2:1.6.1-2.module+el8.6.0+20656+53f7e955 |
| Oracle Linux · 8 | skopeo-tests | 2:1.6.1-2.module+el8.6.0+20656+53f7e955 |
| Oracle Linux · 8 | slirp4netns | 0:1.1.8-2.module+el8.6.0+20656+53f7e955 |
| Oracle Linux · 8 | udica | 0:0.2.6-2.module+el8.6.0+20656+53f7e955 |
Vulnerabilities 5
-
High 8.8CVE-2022-1227 Public exploit
Podman publishes a malicious image to public registries
A privilege escalation flaw was found in Podman. This flaw allows an attacker to publish a malicious image to a public registry. Once this image is downloaded by a potential victim, the vulnerability is triggered after a user runs the 'podman top' command. Th…
-
High 7.5
Uncontrolled Resource Consumption in promhttp
client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers and clients. In client_golang prior to version 1.11.1, HTTP server is susceptible to a Denial of Ser…
-
High 7.5
Podman's default inheritable capabilities for linux container not empty
A flaw was found in Podman, where containers were started incorrectly with non-empty default permissions. A vulnerability was found in Moby (Docker Engine), where containers were started incorrectly with non-empty inheritable Linux process capabilities. This …
-
Medium 6.8
Non-empty default inheritable capabilities for linux container in Buildah
A flaw was found in buildah where containers were incorrectly started with non-empty default permissions. A bug was found in Moby (Docker Engine) where containers were incorrectly started with non-empty inheritable Linux process capabilities, enabling an atta…
-
Unscored —
A flaw was found in crun where containers were incorrectly started with non-empty default permissions. A vulnerability …