RHSA-2022:1762 — Red Hat Security Advisory: container-tools:rhel8 security, bug fix, and enhancement update

Fixed packages 67

Release	Package	Fixed in
Red Hat · RHEL 8 enterprise_linux:8::appstream	aardvark-dns	2:1.0.1-27.module+el8.6.0+14673+621cb8be
Red Hat · RHEL 8 enterprise_linux:8::appstream	buildah	1:1.24.2-4.module+el8.6.0+14673+621cb8be
Red Hat · RHEL 8 enterprise_linux:8::appstream	buildah-debuginfo	1:1.24.2-4.module+el8.6.0+14673+621cb8be
Red Hat · RHEL 8 enterprise_linux:8::appstream	buildah-debugsource	1:1.24.2-4.module+el8.6.0+14673+621cb8be
Red Hat · RHEL 8 enterprise_linux:8::appstream	buildah-tests	1:1.24.2-4.module+el8.6.0+14673+621cb8be
Red Hat · RHEL 8 enterprise_linux:8::appstream	buildah-tests-debuginfo	1:1.24.2-4.module+el8.6.0+14673+621cb8be
Red Hat · RHEL 8 enterprise_linux:8::appstream	cockpit-podman	0:43-1.module+el8.6.0+14673+621cb8be
Red Hat · RHEL 8 enterprise_linux:8::appstream	conmon	2:2.1.0-1.module+el8.6.0+14673+621cb8be
Red Hat · RHEL 8 enterprise_linux:8::appstream	conmon-debuginfo	2:2.1.0-1.module+el8.6.0+14673+621cb8be
Red Hat · RHEL 8 enterprise_linux:8::appstream	conmon-debugsource	2:2.1.0-1.module+el8.6.0+14673+621cb8be
Red Hat · RHEL 8 enterprise_linux:8::appstream	container-selinux	2:2.179.1-1.module+el8.6.0+14673+621cb8be
Red Hat · RHEL 8 enterprise_linux:8::appstream	containernetworking-plugins	1:1.0.1-2.module+el8.6.0+14673+621cb8be
Red Hat · RHEL 8 enterprise_linux:8::appstream	containernetworking-plugins-debuginfo	1:1.0.1-2.module+el8.6.0+14673+621cb8be
Red Hat · RHEL 8 enterprise_linux:8::appstream	containernetworking-plugins-debugsource	1:1.0.1-2.module+el8.6.0+14673+621cb8be
Red Hat · RHEL 8 enterprise_linux:8::appstream	containers-common	2:1-27.module+el8.6.0+14673+621cb8be
Red Hat · RHEL 8 enterprise_linux:8::appstream	crit	0:3.15-3.module+el8.6.0+14673+621cb8be
Red Hat · RHEL 8 enterprise_linux:8::appstream	criu	0:3.15-3.module+el8.6.0+14673+621cb8be
Red Hat · RHEL 8 enterprise_linux:8::appstream	criu-debuginfo	0:3.15-3.module+el8.6.0+14673+621cb8be
Red Hat · RHEL 8 enterprise_linux:8::appstream	criu-debugsource	0:3.15-3.module+el8.6.0+14673+621cb8be
Red Hat · RHEL 8 enterprise_linux:8::appstream	criu-devel	0:3.15-3.module+el8.6.0+14673+621cb8be
Red Hat · RHEL 8 enterprise_linux:8::appstream	criu-libs	0:3.15-3.module+el8.6.0+14673+621cb8be
Red Hat · RHEL 8 enterprise_linux:8::appstream	criu-libs-debuginfo	0:3.15-3.module+el8.6.0+14673+621cb8be
Red Hat · RHEL 8 enterprise_linux:8::appstream	crun	0:1.4.4-1.module+el8.6.0+14673+621cb8be
Red Hat · RHEL 8 enterprise_linux:8::appstream	crun-debuginfo	0:1.4.4-1.module+el8.6.0+14673+621cb8be
Red Hat · RHEL 8 enterprise_linux:8::appstream	crun-debugsource	0:1.4.4-1.module+el8.6.0+14673+621cb8be
Red Hat · RHEL 8 enterprise_linux:8::appstream	fuse-overlayfs	0:1.8.2-1.module+el8.6.0+14673+621cb8be
Red Hat · RHEL 8 enterprise_linux:8::appstream	fuse-overlayfs-debuginfo	0:1.8.2-1.module+el8.6.0+14673+621cb8be
Red Hat · RHEL 8 enterprise_linux:8::appstream	fuse-overlayfs-debugsource	0:1.8.2-1.module+el8.6.0+14673+621cb8be
Red Hat · RHEL 8 enterprise_linux:8::appstream	libslirp	0:4.4.0-1.module+el8.6.0+14673+621cb8be
Red Hat · RHEL 8 enterprise_linux:8::appstream	libslirp-debuginfo	0:4.4.0-1.module+el8.6.0+14673+621cb8be
Red Hat · RHEL 8 enterprise_linux:8::appstream	libslirp-debugsource	0:4.4.0-1.module+el8.6.0+14673+621cb8be
Red Hat · RHEL 8 enterprise_linux:8::appstream	libslirp-devel	0:4.4.0-1.module+el8.6.0+14673+621cb8be
Red Hat · RHEL 8 enterprise_linux:8::appstream	netavark	2:1.0.1-27.module+el8.6.0+14673+621cb8be
Red Hat · RHEL 8 enterprise_linux:8::appstream	oci-seccomp-bpf-hook	0:1.2.3-3.module+el8.6.0+14673+621cb8be
Red Hat · RHEL 8 enterprise_linux:8::appstream	oci-seccomp-bpf-hook-debuginfo	0:1.2.3-3.module+el8.6.0+14673+621cb8be
Red Hat · RHEL 8 enterprise_linux:8::appstream	oci-seccomp-bpf-hook-debugsource	0:1.2.3-3.module+el8.6.0+14673+621cb8be
Red Hat · RHEL 8 enterprise_linux:8::appstream	podman	2:4.0.2-6.module+el8.6.0+14673+621cb8be
Red Hat · RHEL 8 enterprise_linux:8::appstream	podman-catatonit	2:4.0.2-6.module+el8.6.0+14673+621cb8be
Red Hat · RHEL 8 enterprise_linux:8::appstream	podman-catatonit-debuginfo	2:4.0.2-6.module+el8.6.0+14673+621cb8be
Red Hat · RHEL 8 enterprise_linux:8::appstream	podman-debuginfo	2:4.0.2-6.module+el8.6.0+14673+621cb8be
Red Hat · RHEL 8 enterprise_linux:8::appstream	podman-debugsource	2:4.0.2-6.module+el8.6.0+14673+621cb8be
Red Hat · RHEL 8 enterprise_linux:8::appstream	podman-docker	2:4.0.2-6.module+el8.6.0+14673+621cb8be
Red Hat · RHEL 8 enterprise_linux:8::appstream	podman-gvproxy	2:4.0.2-6.module+el8.6.0+14673+621cb8be
Red Hat · RHEL 8 enterprise_linux:8::appstream	podman-gvproxy-debuginfo	2:4.0.2-6.module+el8.6.0+14673+621cb8be
Red Hat · RHEL 8 enterprise_linux:8::appstream	podman-plugins	2:4.0.2-6.module+el8.6.0+14673+621cb8be
Red Hat · RHEL 8 enterprise_linux:8::appstream	podman-plugins-debuginfo	2:4.0.2-6.module+el8.6.0+14673+621cb8be
Red Hat · RHEL 8 enterprise_linux:8::appstream	podman-remote	2:4.0.2-6.module+el8.6.0+14673+621cb8be
Red Hat · RHEL 8 enterprise_linux:8::appstream	podman-remote-debuginfo	2:4.0.2-6.module+el8.6.0+14673+621cb8be
Red Hat · RHEL 8 enterprise_linux:8::appstream	podman-tests	2:4.0.2-6.module+el8.6.0+14673+621cb8be
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-podman	0:4.0.0-1.module+el8.6.0+14673+621cb8be
Red Hat · RHEL 8 enterprise_linux:8::appstream	python3-criu	0:3.15-3.module+el8.6.0+14673+621cb8be
Red Hat · RHEL 8 enterprise_linux:8::appstream	python3-podman	0:4.0.0-1.module+el8.6.0+14673+621cb8be
Red Hat · RHEL 8 enterprise_linux:8::appstream	runc	1:1.0.3-2.module+el8.6.0+14673+621cb8be
Red Hat · RHEL 8 enterprise_linux:8::appstream	runc-debuginfo	1:1.0.3-2.module+el8.6.0+14673+621cb8be
Red Hat · RHEL 8 enterprise_linux:8::appstream	runc-debugsource	1:1.0.3-2.module+el8.6.0+14673+621cb8be
Red Hat · RHEL 8 enterprise_linux:8::appstream	skopeo	2:1.6.1-2.module+el8.6.0+14673+621cb8be
Red Hat · RHEL 8 enterprise_linux:8::appstream	skopeo-debuginfo	2:1.6.1-2.module+el8.6.0+14673+621cb8be
Red Hat · RHEL 8 enterprise_linux:8::appstream	skopeo-debugsource	2:1.6.1-2.module+el8.6.0+14673+621cb8be
Red Hat · RHEL 8 enterprise_linux:8::appstream	skopeo-tests	2:1.6.1-2.module+el8.6.0+14673+621cb8be
Red Hat · RHEL 8 enterprise_linux:8::appstream	slirp4netns	0:1.1.8-2.module+el8.6.0+14673+621cb8be
Red Hat · RHEL 8 enterprise_linux:8::appstream	slirp4netns-debuginfo	0:1.1.8-2.module+el8.6.0+14673+621cb8be
Red Hat · RHEL 8 enterprise_linux:8::appstream	slirp4netns-debugsource	0:1.1.8-2.module+el8.6.0+14673+621cb8be
Red Hat · RHEL 8 enterprise_linux:8::appstream	toolbox	0:0.0.99.3-0.4.module+el8.6.0+14673+621cb8be
Red Hat · RHEL 8 enterprise_linux:8::appstream	toolbox-debuginfo	0:0.0.99.3-0.4.module+el8.6.0+14673+621cb8be
Red Hat · RHEL 8 enterprise_linux:8::appstream	toolbox-debugsource	0:0.0.99.3-0.4.module+el8.6.0+14673+621cb8be
Red Hat · RHEL 8 enterprise_linux:8::appstream	toolbox-tests	0:0.0.99.3-0.4.module+el8.6.0+14673+621cb8be
Red Hat · RHEL 8 enterprise_linux:8::appstream	udica	0:0.2.6-2.module+el8.6.0+14673+621cb8be

Vulnerabilities 6

High 8.8

CVE-2022-1227 Public exploit

Podman publishes a malicious image to public registries

A privilege escalation flaw was found in Podman. This flaw allows an attacker to publish a malicious image to a public registry. Once this image is downloaded by a potential victim, the vulnerability is triggered after a user runs the 'podman top' command. Th…

podman podman github.com/containers/podman/v3 libpod Debian Ubuntu Azure Linux Alpine Go

Apr 29, 2022
High 7.5

CVE-2022-21698

Uncontrolled Resource Consumption in promhttp

client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers and clients. In client_golang prior to version 1.11.1, HTTP server is susceptible to a Denial of Ser…

prometheus client_golang cri-o dynamic-localpv-provisioner Debian Ubuntu Azure Linux Alpine Wolfi Go

Feb 15, 2022
High 7.5

CVE-2022-27649

Podman's default inheritable capabilities for linux container not empty

A flaw was found in Podman, where containers were started incorrectly with non-empty default permissions. A vulnerability was found in Moby (Docker Engine), where containers were started incorrectly with non-empty inheritable Linux process capabilities. This …

podman podman github.com/containers/podman/v4 github.com/containers/podman/v3 Debian Ubuntu Azure Linux Alpine Go

Apr 4, 2022
Medium 6.8

CVE-2022-27651

Non-empty default inheritable capabilities for linux container in Buildah

A flaw was found in buildah where containers were incorrectly started with non-empty default permissions. A bug was found in Moby (Docker Engine) where containers were incorrectly started with non-empty inheritable Linux process capabilities, enabling an atta…

cri-o buildah buildah golang-github-containers-buildah Debian Ubuntu Azure Linux Alpine Go

Apr 4, 2022
Unscored —

CVE-2020-28851

In x/text in Go 1.15.4, an "index out of range" panic occurs in language.ParseAcceptLanguage while parsing the -u- exte…

buildah google-guest-agent multus golang-golang-x-text Debian Ubuntu Azure Linux

Jan 2, 2021
Unscored —

CVE-2022-27650

A flaw was found in crun where containers were incorrectly started with non-empty default permissions. A vulnerability …

crun crun crun Debian Ubuntu Alpine

Apr 4, 2022

References

article
https://access.redhat.com/security/updates/classification/#important
article
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.6_release_notes/
report
https://bugzilla.redhat.com/show_bug.cgi?id=1861760
report
https://bugzilla.redhat.com/show_bug.cgi?id=1967642
report
https://bugzilla.redhat.com/show_bug.cgi?id=1982164
report
https://bugzilla.redhat.com/show_bug.cgi?id=1982784
report
https://bugzilla.redhat.com/show_bug.cgi?id=1995900
report
https://bugzilla.redhat.com/show_bug.cgi?id=1998835
report
https://bugzilla.redhat.com/show_bug.cgi?id=2000914
report
https://bugzilla.redhat.com/show_bug.cgi?id=2002721
report
https://bugzilla.redhat.com/show_bug.cgi?id=2004993
report
https://bugzilla.redhat.com/show_bug.cgi?id=2005972
report
https://bugzilla.redhat.com/show_bug.cgi?id=2006678
report
https://bugzilla.redhat.com/show_bug.cgi?id=2009047
report
https://bugzilla.redhat.com/show_bug.cgi?id=2009296
report
https://bugzilla.redhat.com/show_bug.cgi?id=2017266
report
https://bugzilla.redhat.com/show_bug.cgi?id=2018949
report
https://bugzilla.redhat.com/show_bug.cgi?id=2023112
report
https://bugzilla.redhat.com/show_bug.cgi?id=2024229
report
https://bugzilla.redhat.com/show_bug.cgi?id=2025336
report
https://bugzilla.redhat.com/show_bug.cgi?id=2030599
report
https://bugzilla.redhat.com/show_bug.cgi?id=2045880
report
https://bugzilla.redhat.com/show_bug.cgi?id=2055487
report
https://bugzilla.redhat.com/show_bug.cgi?id=2059754
report
https://bugzilla.redhat.com/show_bug.cgi?id=2065292
report
https://bugzilla.redhat.com/show_bug.cgi?id=2065707
report
https://bugzilla.redhat.com/show_bug.cgi?id=2066568
report
https://bugzilla.redhat.com/show_bug.cgi?id=2066840
report
https://bugzilla.redhat.com/show_bug.cgi?id=2066845
report
https://bugzilla.redhat.com/show_bug.cgi?id=2070368
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_1762.json
report
https://access.redhat.com/security/cve/CVE-2020-28851
report
https://bugzilla.redhat.com/show_bug.cgi?id=1913333
advisory
https://www.cve.org/CVERecord?id=CVE-2020-28851
advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-28851
report
https://access.redhat.com/security/cve/CVE-2022-1227
advisory
https://www.cve.org/CVERecord?id=CVE-2022-1227
advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-1227
article
https://github.com/containers/podman/issues/10941

Red Hat Security Advisory: container-tools:rhel8 security, bug fix, and enhancement update

Fixed packages 67

Vulnerabilities 6

Podman publishes a malicious image to public registries

Uncontrolled Resource Consumption in promhttp

Podman's default inheritable capabilities for linux container not empty

Non-empty default inheritable capabilities for linux container in Buildah

In x/text in Go 1.15.4, an "index out of range" panic occurs in language.ParseAcceptLanguage while parsing the -u- exte…

A flaw was found in crun where containers were incorrectly started with non-empty default permissions. A vulnerability …

References