Summary
[1.37.5-1.0.1]
- Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117178]
[2:1.37.5-1]
- update to https://github.com/containers/buildah/releases/tag/v1.37.5
- Resolves: RHEL-61857
[2:1.37.4-2]
- enable CNI
- Resolves: RHEL-62107
[2:1.37.4-1]
- update to https://github.com/containers/buildah/releases/tag/v1.37.4
- Resolves: RHEL-61114
[2:1.37.2-2]
- rebuild to fix CVE-2024-34156
- Resolves: RHEL-57912
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | buildah | 2:1.37.5-1.0.1.el9_5 |
| Oracle Linux · 9 | buildah-tests | 2:1.37.5-1.0.1.el9_5 |
Vulnerabilities 7
-
High 7.8
Buildah: buildah allows arbitrary directory mount
A vulnerability was found in Buildah. Cache mounts do not properly validate that user-specified paths for the cache are within our cache directory, allowing a `RUN` instruction in a Container file to mount an arbitrary directory from the host (read/write) int…
-
High 7.5
Stack exhaustion in Decoder.Decode in encoding/gob
Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635.
-
High 7.5
Stack exhaustion in Parse in go/build/constraint
Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion.
-
Medium 6.5
Podman: buildah: cri-o: symlink traversal vulnerability in the containers/storage library can cause denial of service (dos)
A vulnerability was found in Podman, Buildah, and CRI-O. A symlink traversal vulnerability in the containers/storage library can cause Podman, Buildah, and CRI-O to hang and result in a denial of service via OOM kill when running a malicious image using an au…
-
Medium 5.4
Podman: buildah: cri-o: fips crypto-policy directory mounting issue in containers/common go library
A flaw was found in Go. When FIPS mode is enabled on a system, container runtimes may incorrectly handle certain file paths due to improper validation in the containers/common Go library. This flaw allows an attacker to exploit symbolic links and trick the sy…
-
Medium 4.7
Buildah: podman: improper input validation in bind-propagation option of dockerfile run --mount instruction
A vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exp…
-
Medium 4.3
Stack exhaustion in all Parse functions in go/parser
Calling any of the Parse functions on Go source code which contains deeply nested literals can cause a panic due to stack exhaustion.