Summary
[2:4.2.0-3.0.1]
- Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117404]
[2:4.2.0-3]
- fix dependency in test subpackage
- Related: #2061316
[2:4.2.0-2]
- readd catatonit
- Related: #2061316
[2:4.2.0-1]
- update to latest content of https://github.com/containers/podman/releases/tag/4.2.0
(https://github.com/containers/podman/commit/7fe5a419cfd2880df2028ad3d7fd9378a88a04f4)
- Related: #2061316
[2:4.2.0-0.3rc3]
- require catatonit for gating tests
- Related: #2061316
[2:4.2.0-0.2rc3]
- update to 4.2.0-rc3
- Related: #2061316
[2:4.2.0-0.1rc2]
- update to 4.2.0-rc2
- Related: #2061316
[2:4.1.1-6]
- convert catatonit dependency to soft dep as catatonit is
no longer in Appstream but in CRB
- Related: #2061316
[2:4.1.1-5]
- rebuild for combined gating with catatonit
- Related: #2097694
[2:4.1.1-4]
- catatonit is now a standalone package
- Related: #2097694
[2:4.1.1-3]
- update to the latest content of https://github.com/containers/podman/tree/v4.1.1-rhel
(https://github.com/containers/podman/commit/fa692a6)
- Related: #2097694
[2:4.1.1-2]
- be sure podman services/sockets are stopped upon package removal
- Related: #2061316
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | podman | 2:4.2.0-3.0.1.el9 |
| Oracle Linux · 9 | podman-catatonit | 2:4.2.0-3.0.1.el9 |
| Oracle Linux · 9 | podman-docker | 2:4.2.0-3.0.1.el9 |
| Oracle Linux · 9 | podman-gvproxy | 2:4.2.0-3.0.1.el9 |
| Oracle Linux · 9 | podman-plugins | 2:4.2.0-3.0.1.el9 |
| Oracle Linux · 9 | podman-remote | 2:4.2.0-3.0.1.el9 |
| Oracle Linux · 9 | podman-tests | 2:4.2.0-3.0.1.el9 |
Vulnerabilities 8
-
High 7.5
golang.org/x/crypto/ssh Denial of service via crafted Signer
The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey.
-
Medium 6.5
Improper Locking in github.com/containers/storage
A deadlock vulnerability was found in 'github.com/containers/storage' in versions before 1.28.1. When a container image is processed, each layer is unpacked using `tar`. If one of those layers is not a valid `tar` archive this causes an error leading to an un…
-
Medium 6.5
Exposure of Sensitive Information to an Unauthorized Actor and Origin Validation Error in podman
A flaw was found in podman. The `podman machine` function (used to create and manage Podman virtual machine containing a Podman process) spawns a `gvproxy` process on the host system. The `gvproxy` API is accessible on port 7777 on all IP addresses on the hos…
-
Medium 5.9
Podman Origin Validation Error
Rootless containers run with Podman, receive all traffic with a source IP address of 127.0.0.1 (including from remote hosts). This impacts containerized applications that trust localhost (127.0.01) connections by default and do not require authentication. Thi…
-
Unscored —
In x/text in Go 1.15.4, an "index out of range" panic occurs in language.ParseAcceptLanguage while parsing the -u- exte…
-
Unscored —
In x/text in Go before v0.3.5, a "slice bounds out of range" panic occurs in language.ParseAcceptLanguage while process…
-
Unscored —
Attacker can drop certain headers in net/http/httputil
In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from net/http/httputil) result in a situation where an attacker is able to drop arbitrary headers.
-
Unscored —CVE-2021-34558 Public exploit
Panic on certain certificates in crypto/tls
The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS server to cause a TLS client to panic.