Moderate: container-tools:ol8 security, bug fix, and enhancement update (Oracle Linux 8)

Summary

Fixed packages 32

Vulnerabilities 6

• High 7.5
  CVE-2022-1708

  Node DOS by way of memory exhaustion through ExecSync request in CRI-O

  A vulnerability was found in CRI-O that causes memory or disk space exhaustion on the node for anyone with access to the Kube API. The ExecSync request runs commands in a container and logs the output of the command. This output is then read by CRI-O after co…

  cri-o github.com/cri-o/cri-o cri-o Azure Linux Alpine Go
  Jun 7, 2022
• High 7.5
  CVE-2022-27191

  golang.org/x/crypto/ssh Denial of service via crafted Signer

  The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey.

  go k3d k3d-proxy k3d-tools Debian Ubuntu Alpine Wolfi Go
  Mar 18, 2022
• High 7.1
  CVE-2022-2990

  Buildah's incorrect handling of the supplementary groups may lead to data disclosure, modification

  An incorrect handling of the supplementary groups in the Buildah container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used t…

  buildah buildah golang-github-containers-buildah golang-github-containers-buildah Debian Ubuntu Azure Linux Alpine Go
  Sep 13, 2022
• Medium 5.9
  CVE-2022-29162

  Incorrect Default Permissions in runc

  runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. A bug was found in runc prior to version 1.1.2 where `runc exec --cap` created processes with non-empty inheritable Linux process capabilities, creating an aty…

  opencontainers runc ctop podman Debian Ubuntu Azure Linux Alpine Wolfi Go
  May 17, 2022
• Low 3.0
  CVE-2021-41190

  Clarify Content-Type handling in OCI spec

  The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution of content. In the OCI Distribution Specification version 1.0.0 and prior, the Content-Type header alone was used to determine the type of document during…

  opencontainers distribution-spec buildah docker.io Ubuntu Azure Linux Alpine Go
  Nov 17, 2021
• Unscored —
  CVE-2021-36221

  Panic in ReverseProxy in net/http/httputil

  Go before 1.15.15 and 1.16.x before 1.16.7 has a race condition that can lead to a net/http/httputil ReverseProxy panic upon an ErrAbortHandler abort.

  go stdlib golang-1.8 golang-1.13 Debian Ubuntu Alpine Go
  Aug 8, 2021