RHSA-2022:4651 — Red Hat Security Advisory: container-tools:2.0 security update

Fixed packages 40

Release	Package	Fixed in
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	buildah	0:1.11.6-8.module+el8.2.0+14896+bf621b2a
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	buildah-debuginfo	0:1.11.6-8.module+el8.2.0+14896+bf621b2a
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	buildah-debugsource	0:1.11.6-8.module+el8.2.0+14896+bf621b2a
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	buildah-tests	0:1.11.6-8.module+el8.2.0+14896+bf621b2a
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	buildah-tests-debuginfo	0:1.11.6-8.module+el8.2.0+14896+bf621b2a
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	cockpit-podman	0:11-1.module+el8.2.0+14896+bf621b2a
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	conmon	2:2.0.6-1.module+el8.2.0+14896+bf621b2a
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	container-selinux	2:2.124.0-1.module+el8.2.0+14896+bf621b2a
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	containernetworking-plugins	0:0.8.3-4.module+el8.2.0+14896+bf621b2a
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	containernetworking-plugins-debuginfo	0:0.8.3-4.module+el8.2.0+14896+bf621b2a
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	containernetworking-plugins-debugsource	0:0.8.3-4.module+el8.2.0+14896+bf621b2a
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	containers-common	1:0.1.40-9.module+el8.2.0+14896+bf621b2a
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	crit	0:3.12-9.module+el8.2.0+14896+bf621b2a
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	criu	0:3.12-9.module+el8.2.0+14896+bf621b2a
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	criu-debuginfo	0:3.12-9.module+el8.2.0+14896+bf621b2a
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	criu-debugsource	0:3.12-9.module+el8.2.0+14896+bf621b2a
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	fuse-overlayfs	0:0.7.2-5.module+el8.2.0+14896+bf621b2a
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	fuse-overlayfs-debuginfo	0:0.7.2-5.module+el8.2.0+14896+bf621b2a
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	fuse-overlayfs-debugsource	0:0.7.2-5.module+el8.2.0+14896+bf621b2a
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	podman	0:1.6.4-24.module+el8.2.0+14896+bf621b2a
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	podman-debuginfo	0:1.6.4-24.module+el8.2.0+14896+bf621b2a
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	podman-debugsource	0:1.6.4-24.module+el8.2.0+14896+bf621b2a
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	podman-docker	0:1.6.4-24.module+el8.2.0+14896+bf621b2a
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	podman-remote	0:1.6.4-24.module+el8.2.0+14896+bf621b2a
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	podman-remote-debuginfo	0:1.6.4-24.module+el8.2.0+14896+bf621b2a
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	podman-tests	0:1.6.4-24.module+el8.2.0+14896+bf621b2a
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	python-podman-api	0:1.2.0-0.2.gitd0a45fe.module+el8.2.0+14896+bf621b2a
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	python3-criu	0:3.12-9.module+el8.2.0+14896+bf621b2a
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	runc	0:1.0.0-65.rc10.module+el8.2.0+14896+bf621b2a
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	runc-debuginfo	0:1.0.0-65.rc10.module+el8.2.0+14896+bf621b2a
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	runc-debugsource	0:1.0.0-65.rc10.module+el8.2.0+14896+bf621b2a
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	skopeo	1:0.1.40-9.module+el8.2.0+14896+bf621b2a
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	skopeo-debuginfo	1:0.1.40-9.module+el8.2.0+14896+bf621b2a
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	skopeo-debugsource	1:0.1.40-9.module+el8.2.0+14896+bf621b2a
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	skopeo-tests	1:0.1.40-9.module+el8.2.0+14896+bf621b2a
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	slirp4netns	0:0.4.2-3.git21fdece.module+el8.2.0+14896+bf621b2a
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	slirp4netns-debuginfo	0:0.4.2-3.git21fdece.module+el8.2.0+14896+bf621b2a
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	slirp4netns-debugsource	0:0.4.2-3.git21fdece.module+el8.2.0+14896+bf621b2a
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	toolbox	0:0.0.7-1.module+el8.2.0+14896+bf621b2a
Red Hat · RHEL 8.2 EUS rhel_eus:8.2::appstream	udica	0:0.2.1-2.module+el8.2.0+14896+bf621b2a

Vulnerabilities 3

High 8.8

CVE-2022-1227 Public exploit

Podman publishes a malicious image to public registries

A privilege escalation flaw was found in Podman. This flaw allows an attacker to publish a malicious image to a public registry. Once this image is downloaded by a potential victim, the vulnerability is triggered after a user runs the 'podman top' command. Th…

podman podman github.com/containers/podman/v3 libpod Debian Ubuntu Azure Linux Alpine Go

Apr 29, 2022
High 7.5

CVE-2022-27649

Podman's default inheritable capabilities for linux container not empty

A flaw was found in Podman, where containers were started incorrectly with non-empty default permissions. A vulnerability was found in Moby (Docker Engine), where containers were started incorrectly with non-empty inheritable Linux process capabilities. This …

podman podman github.com/containers/podman/v3 github.com/containers/podman/v4 Debian Ubuntu Azure Linux Alpine Go

Apr 4, 2022
Medium 6.8

CVE-2022-27651

Non-empty default inheritable capabilities for linux container in Buildah

A flaw was found in buildah where containers were incorrectly started with non-empty default permissions. A bug was found in Moby (Docker Engine) where containers were incorrectly started with non-empty inheritable Linux process capabilities, enabling an atta…

cri-o buildah buildah golang-github-containers-buildah Debian Ubuntu Azure Linux Alpine Go

Apr 4, 2022

References

article
https://access.redhat.com/security/updates/classification/#important
article
https://access.redhat.com/security/cve/cve-2022-1227
article
https://access.redhat.com/security/cve/cve-2022-27649
article
https://access.redhat.com/security/cve/cve-2022-27651
report
https://bugzilla.redhat.com/show_bug.cgi?id=2066568
report
https://bugzilla.redhat.com/show_bug.cgi?id=2066840
report
https://bugzilla.redhat.com/show_bug.cgi?id=2070368
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_4651.json
report
https://access.redhat.com/security/cve/CVE-2022-1227
advisory
https://www.cve.org/CVERecord?id=CVE-2022-1227
advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-1227
article
https://github.com/containers/podman/issues/10941
report
https://access.redhat.com/security/cve/CVE-2022-27649
advisory
https://www.cve.org/CVERecord?id=CVE-2022-27649
advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-27649
article
https://github.com/containers/podman/security/advisories/GHSA-qvf8-p83w-v58j
report
https://access.redhat.com/security/cve/CVE-2022-27651
advisory
https://www.cve.org/CVERecord?id=CVE-2022-27651
advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-27651
article
https://github.com/containers/buildah/security/advisories/GHSA-c3g4-w6cv-6v7h

Red Hat Security Advisory: container-tools:2.0 security update

Fixed packages 40

Vulnerabilities 3

Podman publishes a malicious image to public registries

Podman's default inheritable capabilities for linux container not empty

Non-empty default inheritable capabilities for linux container in Buildah

References