RHSA-2020:4694 — Red Hat Security Advisory: container-tools:rhel8 security, bug fix, and enhancement update

Fixed packages 52

Release	Package	Fixed in
Red Hat · RHEL 8 enterprise_linux:8::appstream	buildah	0:1.15.1-2.module+el8.3.0+8221+97165c3f
Red Hat · RHEL 8 enterprise_linux:8::appstream	buildah-debuginfo	0:1.15.1-2.module+el8.3.0+8221+97165c3f
Red Hat · RHEL 8 enterprise_linux:8::appstream	buildah-debugsource	0:1.15.1-2.module+el8.3.0+8221+97165c3f
Red Hat · RHEL 8 enterprise_linux:8::appstream	buildah-tests	0:1.15.1-2.module+el8.3.0+8221+97165c3f
Red Hat · RHEL 8 enterprise_linux:8::appstream	buildah-tests-debuginfo	0:1.15.1-2.module+el8.3.0+8221+97165c3f
Red Hat · RHEL 8 enterprise_linux:8::appstream	cockpit-podman	0:18.1-2.module+el8.3.0+8221+97165c3f
Red Hat · RHEL 8 enterprise_linux:8::appstream	conmon	2:2.0.20-2.module+el8.3.0+8221+97165c3f
Red Hat · RHEL 8 enterprise_linux:8::appstream	container-selinux	2:2.144.0-1.module+el8.3.0+8221+97165c3f
Red Hat · RHEL 8 enterprise_linux:8::appstream	containernetworking-plugins	0:0.8.6-2.module+el8.3.0+8221+97165c3f
Red Hat · RHEL 8 enterprise_linux:8::appstream	containernetworking-plugins-debuginfo	0:0.8.6-2.module+el8.3.0+8221+97165c3f
Red Hat · RHEL 8 enterprise_linux:8::appstream	containernetworking-plugins-debugsource	0:0.8.6-2.module+el8.3.0+8221+97165c3f
Red Hat · RHEL 8 enterprise_linux:8::appstream	containers-common	1:1.1.1-3.module+el8.3.0+8221+97165c3f
Red Hat · RHEL 8 enterprise_linux:8::appstream	crit	0:3.14-2.module+el8.3.0+8221+97165c3f
Red Hat · RHEL 8 enterprise_linux:8::appstream	criu	0:3.14-2.module+el8.3.0+8221+97165c3f
Red Hat · RHEL 8 enterprise_linux:8::appstream	criu-debuginfo	0:3.14-2.module+el8.3.0+8221+97165c3f
Red Hat · RHEL 8 enterprise_linux:8::appstream	criu-debugsource	0:3.14-2.module+el8.3.0+8221+97165c3f
Red Hat · RHEL 8 enterprise_linux:8::appstream	crun	0:0.14.1-2.module+el8.3.0+8221+97165c3f
Red Hat · RHEL 8 enterprise_linux:8::appstream	crun-debuginfo	0:0.14.1-2.module+el8.3.0+8221+97165c3f
Red Hat · RHEL 8 enterprise_linux:8::appstream	crun-debugsource	0:0.14.1-2.module+el8.3.0+8221+97165c3f
Red Hat · RHEL 8 enterprise_linux:8::appstream	fuse-overlayfs	0:1.1.2-3.module+el8.3.0+8221+97165c3f
Red Hat · RHEL 8 enterprise_linux:8::appstream	fuse-overlayfs-debuginfo	0:1.1.2-3.module+el8.3.0+8221+97165c3f
Red Hat · RHEL 8 enterprise_linux:8::appstream	fuse-overlayfs-debugsource	0:1.1.2-3.module+el8.3.0+8221+97165c3f
Red Hat · RHEL 8 enterprise_linux:8::appstream	libslirp	0:4.3.1-1.module+el8.3.0+8221+97165c3f
Red Hat · RHEL 8 enterprise_linux:8::appstream	libslirp-debuginfo	0:4.3.1-1.module+el8.3.0+8221+97165c3f
Red Hat · RHEL 8 enterprise_linux:8::appstream	libslirp-debugsource	0:4.3.1-1.module+el8.3.0+8221+97165c3f
Red Hat · RHEL 8 enterprise_linux:8::appstream	libslirp-devel	0:4.3.1-1.module+el8.3.0+8221+97165c3f
Red Hat · RHEL 8 enterprise_linux:8::appstream	oci-seccomp-bpf-hook	0:1.1.2-3.module+el8.3.0+8221+97165c3f
Red Hat · RHEL 8 enterprise_linux:8::appstream	oci-seccomp-bpf-hook-debuginfo	0:1.1.2-3.module+el8.3.0+8221+97165c3f
Red Hat · RHEL 8 enterprise_linux:8::appstream	oci-seccomp-bpf-hook-debugsource	0:1.1.2-3.module+el8.3.0+8221+97165c3f
Red Hat · RHEL 8 enterprise_linux:8::appstream	podman	0:2.0.5-5.module+el8.3.0+8221+97165c3f
Red Hat · RHEL 8 enterprise_linux:8::appstream	podman-catatonit	0:2.0.5-5.module+el8.3.0+8221+97165c3f
Red Hat · RHEL 8 enterprise_linux:8::appstream	podman-catatonit-debuginfo	0:2.0.5-5.module+el8.3.0+8221+97165c3f
Red Hat · RHEL 8 enterprise_linux:8::appstream	podman-debuginfo	0:2.0.5-5.module+el8.3.0+8221+97165c3f
Red Hat · RHEL 8 enterprise_linux:8::appstream	podman-debugsource	0:2.0.5-5.module+el8.3.0+8221+97165c3f
Red Hat · RHEL 8 enterprise_linux:8::appstream	podman-docker	0:2.0.5-5.module+el8.3.0+8221+97165c3f
Red Hat · RHEL 8 enterprise_linux:8::appstream	podman-remote	0:2.0.5-5.module+el8.3.0+8221+97165c3f
Red Hat · RHEL 8 enterprise_linux:8::appstream	podman-remote-debuginfo	0:2.0.5-5.module+el8.3.0+8221+97165c3f
Red Hat · RHEL 8 enterprise_linux:8::appstream	podman-tests	0:2.0.5-5.module+el8.3.0+8221+97165c3f
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-podman-api	0:1.2.0-0.2.gitd0a45fe.module+el8.3.0+8221+97165c3f
Red Hat · RHEL 8 enterprise_linux:8::appstream	python3-criu	0:3.14-2.module+el8.3.0+8221+97165c3f
Red Hat · RHEL 8 enterprise_linux:8::appstream	runc	0:1.0.0-68.rc92.module+el8.3.0+8221+97165c3f
Red Hat · RHEL 8 enterprise_linux:8::appstream	runc-debuginfo	0:1.0.0-68.rc92.module+el8.3.0+8221+97165c3f
Red Hat · RHEL 8 enterprise_linux:8::appstream	runc-debugsource	0:1.0.0-68.rc92.module+el8.3.0+8221+97165c3f
Red Hat · RHEL 8 enterprise_linux:8::appstream	skopeo	1:1.1.1-3.module+el8.3.0+8221+97165c3f
Red Hat · RHEL 8 enterprise_linux:8::appstream	skopeo-debuginfo	1:1.1.1-3.module+el8.3.0+8221+97165c3f
Red Hat · RHEL 8 enterprise_linux:8::appstream	skopeo-debugsource	1:1.1.1-3.module+el8.3.0+8221+97165c3f
Red Hat · RHEL 8 enterprise_linux:8::appstream	skopeo-tests	1:1.1.1-3.module+el8.3.0+8221+97165c3f
Red Hat · RHEL 8 enterprise_linux:8::appstream	slirp4netns	0:1.1.4-2.module+el8.3.0+8221+97165c3f
Red Hat · RHEL 8 enterprise_linux:8::appstream	slirp4netns-debuginfo	0:1.1.4-2.module+el8.3.0+8221+97165c3f
Red Hat · RHEL 8 enterprise_linux:8::appstream	slirp4netns-debugsource	0:1.1.4-2.module+el8.3.0+8221+97165c3f
Red Hat · RHEL 8 enterprise_linux:8::appstream	toolbox	0:0.0.8-1.module+el8.3.0+8221+97165c3f
Red Hat · RHEL 8 enterprise_linux:8::appstream	udica	0:0.2.2-1.module+el8.3.0+8221+97165c3f

Vulnerabilities 3

High 7.5

CVE-2020-14040

golang.org/x/text Infinite loop

The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker could provide a single byte to a UTF16 decoder insta…

k3d k3d-proxy k3d-tools podman Debian Ubuntu Azure Linux Wolfi Go

Jun 17, 2020
Medium 6.0

CVE-2020-10749 Public exploit

containernetworking/plugins vulnerable to MitM attacks

A vulnerability was found in all versions of containernetworking/plugins before version 0.8.6, that allows malicious containers in Kubernetes clusters to perform man-in-the-middle (MitM) attacks. A malicious container can exploit this flaw by sending rogue IP…

Red Hat containernetworking/plugins k3s golang-github-containernetworking-plugins Debian Ubuntu Alpine Go

Jun 3, 2020
Unscored —

CVE-2020-10756

An out-of-bounds read vulnerability was found in the SLiRP networking implementation of the QEMU emulator. This flaw oc…

qemu qemu libslirp libslirp Debian Ubuntu Alpine

Jul 9, 2020

References

article
https://access.redhat.com/security/updates/classification/#moderate
article
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.3_release_notes/
report
https://bugzilla.redhat.com/show_bug.cgi?id=1682970
report
https://bugzilla.redhat.com/show_bug.cgi?id=1752079
report
https://bugzilla.redhat.com/show_bug.cgi?id=1785242
report
https://bugzilla.redhat.com/show_bug.cgi?id=1800815
report
https://bugzilla.redhat.com/show_bug.cgi?id=1801874
report
https://bugzilla.redhat.com/show_bug.cgi?id=1804193
report
https://bugzilla.redhat.com/show_bug.cgi?id=1804195
report
https://bugzilla.redhat.com/show_bug.cgi?id=1813845
report
https://bugzilla.redhat.com/show_bug.cgi?id=1814928
report
https://bugzilla.redhat.com/show_bug.cgi?id=1818694
report
https://bugzilla.redhat.com/show_bug.cgi?id=1821193
report
https://bugzilla.redhat.com/show_bug.cgi?id=1822038
report
https://bugzilla.redhat.com/show_bug.cgi?id=1825789
report
https://bugzilla.redhat.com/show_bug.cgi?id=1827794
report
https://bugzilla.redhat.com/show_bug.cgi?id=1833220
report
https://bugzilla.redhat.com/show_bug.cgi?id=1835986
report
https://bugzilla.redhat.com/show_bug.cgi?id=1837755
report
https://bugzilla.redhat.com/show_bug.cgi?id=1847544
report
https://bugzilla.redhat.com/show_bug.cgi?id=1849557
report
https://bugzilla.redhat.com/show_bug.cgi?id=1850230
report
https://bugzilla.redhat.com/show_bug.cgi?id=1853230
report
https://bugzilla.redhat.com/show_bug.cgi?id=1853652
report
https://bugzilla.redhat.com/show_bug.cgi?id=1857606
report
https://bugzilla.redhat.com/show_bug.cgi?id=1858862
report
https://bugzilla.redhat.com/show_bug.cgi?id=1860126
report
https://bugzilla.redhat.com/show_bug.cgi?id=1866153
report
https://bugzilla.redhat.com/show_bug.cgi?id=1866833
report
https://bugzilla.redhat.com/show_bug.cgi?id=1867447
report
https://bugzilla.redhat.com/show_bug.cgi?id=1868612
report
https://bugzilla.redhat.com/show_bug.cgi?id=1872263
report
https://bugzilla.redhat.com/show_bug.cgi?id=1877463
report
https://bugzilla.redhat.com/show_bug.cgi?id=1879622
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4694.json
report
https://access.redhat.com/security/cve/CVE-2020-10749
advisory
https://www.cve.org/CVERecord?id=CVE-2020-10749
advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-10749
article
https://groups.google.com/forum/#!topic/kubernetes-security-announce/BMb_6ICCfp8

Red Hat Security Advisory: container-tools:rhel8 security, bug fix, and enhancement update

Fixed packages 52

Vulnerabilities 3

golang.org/x/text Infinite loop

containernetworking/plugins vulnerable to MitM attacks

An out-of-bounds read vulnerability was found in the SLiRP networking implementation of the QEMU emulator. This flaw oc…

References