Skip to content
OpenAdvisories
Medium ELSA-2024-3968 2 CVEs

Moderate: container-tools:ol8 bug fix and enhancement update (Oracle Linux 8)

Published Jun 18, 2024 · Updated Jun 18, 2024

Summary

aardvark-dns
[2:1.10.0-1]
- update to https://github.com/containers/aardvark-dns/releases/tag/v1.10.0
- Related: Jira:RHEL-2110

[2:1.9.0-1]
- update to https://github.com/containers/aardvark-dns/releases/tag/v1.9.0
- Related: Jira:RHEL-2110

[2:1.8.0-1]
- update to https://github.com/containers/aardvark-dns/releases/tag/v1.8.0
- Related: Jira:RHEL-2110

buildah
[2:1.33.7-2]
- update to the latest content of https://github.com/containers/buildah/tree/release-1.33
(https://github.com/containers/buildah/commit/997beea)
- Resolves: RHEL-28725

cockpit-podman
[84.1-1]
- update to https://github.com/cockpit-project/cockpit-podman/releases/tag/84.1
- Related: Jira:RHEL-25557

[84-1]
- update to https://github.com/cockpit-project/cockpit-podman/releases/tag/84
- Related: Jira:RHEL-2110

[83-1]
- update to https://github.com/cockpit-project/cockpit-podman/releases/tag/83
- Related: Jira:RHEL-2110

[82-1]
- update to https://github.com/cockpit-project/cockpit-podman/releases/tag/82
- Related: Jira:RHEL-2110

[81-1]
- update to https://github.com/cockpit-project/cockpit-podman/releases/tag/81
- Related: Jira:RHEL-2110

[80-1]
- update to https://github.com/cockpit-project/cockpit-podman/releases/tag/80
- Related: Jira:RHEL-2110

[79-1]
- update to https://github.com/cockpit-project/cockpit-podman/releases/tag/79
- Related: Jira:RHEL-2110

[78-1]
- update to https://github.com/cockpit-project/cockpit-podman/releases/tag/78
- Related: Jira:RHEL-2110

[77-1]
- update to https://github.com/cockpit-project/cockpit-podman/releases/tag/77
- Related: Jira:RHEL-2110

[75-1]
- update to https://github.com/cockpit-project/cockpit-podman/releases/tag/75
- Related: #2176055

conmon
[3:2.1.10-1]
- update to https://github.com/containers/conmon/releases/tag/v2.1.10
- Related: Jira:RHEL-2110

[3:2.1.8-1]
- update to https://github.com/containers/conmon/releases/tag/v2.1.8
- Related: #2176055

containernetworking-plugins
[1:1.4.0-2]
- rebuild
- Resolves: RHEL-18390

[1:1.4.0-1]
- update to https://github.com/containernetworking/plugins/releases/tag/v1.4.0
- Related: Jira:RHEL-2110

containers-common
[2:1-81.0.1]
- Updated removed references [Orabug: 33473101] (Alex Burmashev)
- Adjust registries.conf (Nikita Gerasimov)
- remove references to RedHat registry (Nikita Gerasimov)

[2:1-81]
- Update shortnames from Pyxis
- Related: Jira:RHEL-2110

[2:1-80]
- bump release to preserve upgrade path
- Resolves: Jira:RHEL-12277

container-selinux
[2:2.229.0-2]
- remove watch statements properly for RHEL8 and lower
- Related: Jira:RHEL-2110

[2:2.229.0-1]
- update to https://github.com/containers/container-selinux/releases/tag/v2.229.0
- Related: Jira:RHEL-2110

[2:2.228.1-1]
- update to https://github.com/containers/container-selinux/releases/tag/v2.228.1
- Related: Jira:RHEL-2110

[2:2.228.0-1]
- update to https://github.com/containers/container-selinux/releases/tag/v2.228.0
- Related: Jira:RHEL-2110

[2:2.227.0-1]
- update to https://github.com/containers/container-selinux/releases/tag/v2.227.0
- Related: Jira:RHEL-2110

[2:2.226.0-1]
- update to https://github.com/containers/container-selinux/releases/tag/v2.226.0
- remove dependency on policycoreutils-python-utils as it pulls in python
- Related: Jira:RHEL-2110

[2:2.224.0-1]
- update to https://github.com/containers/container-selinux/releases/tag/v2.224.0
- Related: Jira:RHEL-2110

[2:2.222.0-1]
- update to https://github.com/containers/container-selinux/releases/tag/v2.222.0
- Related: Jira:RHEL-2110

criu
[3.18-5]
- rebuild to preserve upgrade path
- Related: RHEL-32671

[3.18-4]
- switch to egg-info on 8.9
- Related: #2176055

[3.18-3]
- remove --progress-bar option
- Related: #2176055

[3.18-2]
- update to 3.18
- Related: #2176055

[3.17-1]
- update to 3.17
- Resolves: #2175794

crun
[1.14.3-2]
- remove BR libgcrypt-devel, no longer needed
- Related: Jira:RHEL-2110

[1.14.3-1]
- update to https://github.com/containers/crun/releases/tag/1.14.3
- Related: Jira:RHEL-2110

[1.14.1-1]
- update to https://github.com/containers/crun/releases/tag/1.14.1
- Related: Jira:RHEL-2110

[1.14-1]
- update to https://github.com/containers/crun/releases/tag/1.14
- Related: Jira:RHEL-2110

[1.13-1]
- update to https://github.com/containers/crun/releases/tag/1.13
- Related: Jira:RHEL-2110

[1.12-1]
- update to https://github.com/containers/crun/releases/tag/1.12
- Related: Jira:RHEL-2110

[1.11.2-1]
- update to https://github.com/containers/crun/releases/tag/1.11.2
- Related: Jira:RHEL-2110

[1.11.1-1]
- update to https://github.com/containers/crun/releases/tag/1.11.1
- Related: Jira:RHEL-2110

[1.11-1]
- update to https://github.com/containers/crun/releases/tag/1.11
- Related: Jira:RHEL-2110

[1.9.2-1]
- update to https://github.com/containers/crun/releases/tag/1.9.2
- Related: Jira:RHEL-2110

[1.9.1-1]
- update to https://github.com/containers/crun/releases/tag/1.9.1
- Related: Jira:RHEL-2110

[1.9-1]
- update to https://github.com/containers/crun/releases/tag/1.9
- Related: Jira:RHEL-2110

fuse-overlayfs
[1.13-1]
- update to https://github.com/containers/fuse-overlayfs/releases/tag/v1.13
- Related: Jira:RHEL-2110

libslirp
[4.4.0-2]
- rebuild to preserve upgrade path 8.9 -> 8.10
- Related: RHEL-32671

netavark
[2:1.10.3-1]
- update to https://github.com/containers/netavark/releases/tag/v1.10.3
- Related: Jira:RHEL-2110

[2:1.10.2-1]
- update to https://github.com/containers/netavark/releases/tag/v1.10.2
- Related: Jira:RHEL-2110

[2:1.10.1-1]
- update to https://github.com/containers/netavark/releases/tag/v1.10.1
- Related: Jira:RHEL-2110

[2:1.10.0-1]
- update to https://github.com/containers/netavark/releases/tag/v1.10.0
- Related: Jira:RHEL-2110

[2:1.9.0-1]
- update to https://github.com/containers/netavark/releases/tag/v1.9.0
- Related: Jira:RHEL-2110

[2:1.8.0-2]
- fix directory for systemd units
- Related: Jira:RHEL-2110

[2:1.8.0-1]
- update to https://github.com/containers/netavark/releases/tag/v1.8.0
- Related: Jira:RHEL-2110

oci-seccomp-bpf-hook
[1.2.10-1]
- update to

Fixed packages 32

ReleasePackageFixed in
Oracle Linux · 8 aardvark-dns 2:1.10.0-1.module+el8.10.0+90298+77a9814d
Oracle Linux · 8 buildah 2:1.33.7-2.module+el8.10.0+90352+16362864
Oracle Linux · 8 buildah-tests 2:1.33.7-2.module+el8.10.0+90352+16362864
Oracle Linux · 8 cockpit-podman 0:84.1-1.module+el8.10.0+90298+77a9814d
Oracle Linux · 8 conmon 3:2.1.10-1.module+el8.10.0+90298+77a9814d
Oracle Linux · 8 container-selinux 2:2.229.0-2.module+el8.10.0+90298+77a9814d
Oracle Linux · 8 containernetworking-plugins 1:1.4.0-2.module+el8.10.0+90298+77a9814d
Oracle Linux · 8 containers-common 2:1-81.0.1.module+el8.10.0+90298+77a9814d
Oracle Linux · 8 crit 0:3.18-5.module+el8.10.0+90337+0d7b6e74
Oracle Linux · 8 criu 0:3.18-5.module+el8.10.0+90337+0d7b6e74
Oracle Linux · 8 criu-devel 0:3.18-5.module+el8.10.0+90337+0d7b6e74
Oracle Linux · 8 criu-libs 0:3.18-5.module+el8.10.0+90337+0d7b6e74
Oracle Linux · 8 crun 0:1.14.3-2.module+el8.10.0+90298+77a9814d
Oracle Linux · 8 fuse-overlayfs 0:1.13-1.module+el8.10.0+90298+77a9814d
Oracle Linux · 8 libslirp 0:4.4.0-2.module+el8.10.0+90337+0d7b6e74
Oracle Linux · 8 libslirp-devel 0:4.4.0-2.module+el8.10.0+90337+0d7b6e74
Oracle Linux · 8 netavark 2:1.10.3-1.module+el8.10.0+90298+77a9814d
Oracle Linux · 8 oci-seccomp-bpf-hook 0:1.2.10-1.module+el8.10.0+90298+77a9814d
Oracle Linux · 8 podman 4:4.9.4-3.0.1.module+el8.10.0+90352+16362864
Oracle Linux · 8 podman-catatonit 4:4.9.4-3.0.1.module+el8.10.0+90352+16362864
Oracle Linux · 8 podman-docker 4:4.9.4-3.0.1.module+el8.10.0+90352+16362864
Oracle Linux · 8 podman-gvproxy 4:4.9.4-3.0.1.module+el8.10.0+90352+16362864
Oracle Linux · 8 podman-plugins 4:4.9.4-3.0.1.module+el8.10.0+90352+16362864
Oracle Linux · 8 podman-remote 4:4.9.4-3.0.1.module+el8.10.0+90352+16362864
Oracle Linux · 8 podman-tests 4:4.9.4-3.0.1.module+el8.10.0+90352+16362864
Oracle Linux · 8 python3-criu 0:3.18-5.module+el8.10.0+90337+0d7b6e74
Oracle Linux · 8 python3-podman 0:4.9.0-1.module+el8.10.0+90298+77a9814d
Oracle Linux · 8 runc 1:1.1.12-1.module+el8.10.0+90298+77a9814d
Oracle Linux · 8 skopeo 2:1.14.3-2.module+el8.10.0+90337+0d7b6e74
Oracle Linux · 8 skopeo-tests 2:1.14.3-2.module+el8.10.0+90337+0d7b6e74
Oracle Linux · 8 slirp4netns 0:1.2.3-1.module+el8.10.0+90298+77a9814d
Oracle Linux · 8 udica 0:0.2.6-21.module+el8.10.0+90337+0d7b6e74

Vulnerabilities 2

  • Medium 4.9

    jose vulnerable to resource exhaustion via specifically crafted JWE with compressed plaintext

    jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS), and more. A vulnerability has been identified in t…

  • Medium 4.3

    Go JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification)

    Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Th…