Summary
[1.27.0-2.0.1]
- Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117178]
[1:1.27.0-2]
- fix CVE-2022-2990
- Related: #2061316
[1:1.27.0-1]
- update to https://github.com/containers/buildah/releases/tag/v1.27.0
- Related: #2061316
[1:1.26.4-2]
- add buildah-tutorial to test subpackage
- Related: #2061316
[1:1.26.4-1]
- update to https://github.com/containers/buildah/releases/tag/v1.26.4
- Related: #2061316
[1:1.26.3-1]
- update to https://github.com/containers/buildah/releases/tag/v1.26.3
- Related: #2061316
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | buildah | 1:1.27.0-2.0.1.el9 |
| Oracle Linux · 9 | buildah-tests | 1:1.27.0-2.0.1.el9 |
Vulnerabilities 7
-
High 7.5
golang.org/x/crypto/ssh Denial of service via crafted Signer
The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey.
-
High 7.1
Podman's incorrect handling of the supplementary groups may lead to data disclosure, modification
An incorrect handling of the supplementary groups in the Podman container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to…
-
High 7.1
Buildah's incorrect handling of the supplementary groups may lead to data disclosure, modification
An incorrect handling of the supplementary groups in the Buildah container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used t…
-
Medium 6.5
Improper Locking in github.com/containers/storage
A deadlock vulnerability was found in 'github.com/containers/storage' in versions before 1.28.1. When a container image is processed, each layer is unpacked using `tar`. If one of those layers is not a valid `tar` archive this causes an error leading to an un…
-
Unscored —
Improper sanitization when resolving values from DNS in net
Go before 1.15.13 and 1.16.x before 1.16.5 has functions for DNS lookups that do not validate replies from DNS servers, and thus a return value may contain an unsafe injection (e.g., XSS) that does not conform to the RFC1035 format.
-
Unscored —
Attacker can drop certain headers in net/http/httputil
In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from net/http/httputil) result in a situation where an attacker is able to drop arbitrary headers.
-
Unscored —
Panic on inputs with large exponents in math/big
In Go before 1.15.13 and 1.16.x before 1.16.5, there can be a panic for a large exponent to the math/big.Rat SetString or UnmarshalText method.