RHSA-2022:4816 — Red Hat Security Advisory: container-tools:3.0 security update

Fixed packages 55

Release	Package	Fixed in
Red Hat · RHEL 8.4 EUS rhel_eus:8.4::appstream	buildah	0:1.19.9-1.module+el8.4.0+14872+9efa52a3
Red Hat · RHEL 8.4 EUS rhel_eus:8.4::appstream	buildah-debuginfo	0:1.19.9-1.module+el8.4.0+14872+9efa52a3
Red Hat · RHEL 8.4 EUS rhel_eus:8.4::appstream	buildah-debugsource	0:1.19.9-1.module+el8.4.0+14872+9efa52a3
Red Hat · RHEL 8.4 EUS rhel_eus:8.4::appstream	buildah-tests	0:1.19.9-1.module+el8.4.0+14872+9efa52a3
Red Hat · RHEL 8.4 EUS rhel_eus:8.4::appstream	buildah-tests-debuginfo	0:1.19.9-1.module+el8.4.0+14872+9efa52a3
Red Hat · RHEL 8.4 EUS rhel_eus:8.4::appstream	cockpit-podman	0:29-2.module+el8.4.0+14872+9efa52a3
Red Hat · RHEL 8.4 EUS rhel_eus:8.4::appstream	conmon	2:2.0.26-1.module+el8.4.0+14872+9efa52a3
Red Hat · RHEL 8.4 EUS rhel_eus:8.4::appstream	conmon-debuginfo	2:2.0.26-1.module+el8.4.0+14872+9efa52a3
Red Hat · RHEL 8.4 EUS rhel_eus:8.4::appstream	conmon-debugsource	2:2.0.26-1.module+el8.4.0+14872+9efa52a3
Red Hat · RHEL 8.4 EUS rhel_eus:8.4::appstream	container-selinux	2:2.167.0-1.module+el8.4.0+14872+9efa52a3
Red Hat · RHEL 8.4 EUS rhel_eus:8.4::appstream	containernetworking-plugins	0:0.9.1-1.module+el8.4.0+14872+9efa52a3
Red Hat · RHEL 8.4 EUS rhel_eus:8.4::appstream	containernetworking-plugins-debuginfo	0:0.9.1-1.module+el8.4.0+14872+9efa52a3
Red Hat · RHEL 8.4 EUS rhel_eus:8.4::appstream	containernetworking-plugins-debugsource	0:0.9.1-1.module+el8.4.0+14872+9efa52a3
Red Hat · RHEL 8.4 EUS rhel_eus:8.4::appstream	containers-common	1:1.2.2-8.module+el8.4.0+14872+9efa52a3
Red Hat · RHEL 8.4 EUS rhel_eus:8.4::appstream	crit	0:3.15-1.module+el8.4.0+14872+9efa52a3
Red Hat · RHEL 8.4 EUS rhel_eus:8.4::appstream	criu	0:3.15-1.module+el8.4.0+14872+9efa52a3
Red Hat · RHEL 8.4 EUS rhel_eus:8.4::appstream	criu-debuginfo	0:3.15-1.module+el8.4.0+14872+9efa52a3
Red Hat · RHEL 8.4 EUS rhel_eus:8.4::appstream	criu-debugsource	0:3.15-1.module+el8.4.0+14872+9efa52a3
Red Hat · RHEL 8.4 EUS rhel_eus:8.4::appstream	crun	0:0.18-2.module+el8.4.0+14872+9efa52a3
Red Hat · RHEL 8.4 EUS rhel_eus:8.4::appstream	crun-debuginfo	0:0.18-2.module+el8.4.0+14872+9efa52a3
Red Hat · RHEL 8.4 EUS rhel_eus:8.4::appstream	crun-debugsource	0:0.18-2.module+el8.4.0+14872+9efa52a3
Red Hat · RHEL 8.4 EUS rhel_eus:8.4::appstream	fuse-overlayfs	0:1.4.0-2.module+el8.4.0+14872+9efa52a3
Red Hat · RHEL 8.4 EUS rhel_eus:8.4::appstream	fuse-overlayfs-debuginfo	0:1.4.0-2.module+el8.4.0+14872+9efa52a3
Red Hat · RHEL 8.4 EUS rhel_eus:8.4::appstream	fuse-overlayfs-debugsource	0:1.4.0-2.module+el8.4.0+14872+9efa52a3
Red Hat · RHEL 8.4 EUS rhel_eus:8.4::appstream	libslirp	0:4.3.1-1.module+el8.4.0+14872+9efa52a3
Red Hat · RHEL 8.4 EUS rhel_eus:8.4::appstream	libslirp-debuginfo	0:4.3.1-1.module+el8.4.0+14872+9efa52a3
Red Hat · RHEL 8.4 EUS rhel_eus:8.4::appstream	libslirp-debugsource	0:4.3.1-1.module+el8.4.0+14872+9efa52a3
Red Hat · RHEL 8.4 EUS rhel_eus:8.4::appstream	libslirp-devel	0:4.3.1-1.module+el8.4.0+14872+9efa52a3
Red Hat · RHEL 8.4 EUS rhel_eus:8.4::appstream	oci-seccomp-bpf-hook	0:1.2.0-1.module+el8.4.0+14872+9efa52a3
Red Hat · RHEL 8.4 EUS rhel_eus:8.4::appstream	oci-seccomp-bpf-hook-debuginfo	0:1.2.0-1.module+el8.4.0+14872+9efa52a3
Red Hat · RHEL 8.4 EUS rhel_eus:8.4::appstream	oci-seccomp-bpf-hook-debugsource	0:1.2.0-1.module+el8.4.0+14872+9efa52a3
Red Hat · RHEL 8.4 EUS rhel_eus:8.4::appstream	podman	0:3.0.1-9.module+el8.4.0+14872+9efa52a3
Red Hat · RHEL 8.4 EUS rhel_eus:8.4::appstream	podman-catatonit	0:3.0.1-9.module+el8.4.0+14872+9efa52a3
Red Hat · RHEL 8.4 EUS rhel_eus:8.4::appstream	podman-catatonit-debuginfo	0:3.0.1-9.module+el8.4.0+14872+9efa52a3
Red Hat · RHEL 8.4 EUS rhel_eus:8.4::appstream	podman-debuginfo	0:3.0.1-9.module+el8.4.0+14872+9efa52a3
Red Hat · RHEL 8.4 EUS rhel_eus:8.4::appstream	podman-debugsource	0:3.0.1-9.module+el8.4.0+14872+9efa52a3
Red Hat · RHEL 8.4 EUS rhel_eus:8.4::appstream	podman-docker	0:3.0.1-9.module+el8.4.0+14872+9efa52a3
Red Hat · RHEL 8.4 EUS rhel_eus:8.4::appstream	podman-plugins	0:3.0.1-9.module+el8.4.0+14872+9efa52a3
Red Hat · RHEL 8.4 EUS rhel_eus:8.4::appstream	podman-plugins-debuginfo	0:3.0.1-9.module+el8.4.0+14872+9efa52a3
Red Hat · RHEL 8.4 EUS rhel_eus:8.4::appstream	podman-remote	0:3.0.1-9.module+el8.4.0+14872+9efa52a3
Red Hat · RHEL 8.4 EUS rhel_eus:8.4::appstream	podman-remote-debuginfo	0:3.0.1-9.module+el8.4.0+14872+9efa52a3
Red Hat · RHEL 8.4 EUS rhel_eus:8.4::appstream	podman-tests	0:3.0.1-9.module+el8.4.0+14872+9efa52a3
Red Hat · RHEL 8.4 EUS rhel_eus:8.4::appstream	python3-criu	0:3.15-1.module+el8.4.0+14872+9efa52a3
Red Hat · RHEL 8.4 EUS rhel_eus:8.4::appstream	runc	0:1.0.0-76.rc95.module+el8.4.0+14872+9efa52a3
Red Hat · RHEL 8.4 EUS rhel_eus:8.4::appstream	runc-debuginfo	0:1.0.0-76.rc95.module+el8.4.0+14872+9efa52a3
Red Hat · RHEL 8.4 EUS rhel_eus:8.4::appstream	runc-debugsource	0:1.0.0-76.rc95.module+el8.4.0+14872+9efa52a3
Red Hat · RHEL 8.4 EUS rhel_eus:8.4::appstream	skopeo	1:1.2.2-8.module+el8.4.0+14872+9efa52a3
Red Hat · RHEL 8.4 EUS rhel_eus:8.4::appstream	skopeo-debuginfo	1:1.2.2-8.module+el8.4.0+14872+9efa52a3
Red Hat · RHEL 8.4 EUS rhel_eus:8.4::appstream	skopeo-debugsource	1:1.2.2-8.module+el8.4.0+14872+9efa52a3
Red Hat · RHEL 8.4 EUS rhel_eus:8.4::appstream	skopeo-tests	1:1.2.2-8.module+el8.4.0+14872+9efa52a3
Red Hat · RHEL 8.4 EUS rhel_eus:8.4::appstream	slirp4netns	0:1.1.8-1.module+el8.4.0+14872+9efa52a3
Red Hat · RHEL 8.4 EUS rhel_eus:8.4::appstream	slirp4netns-debuginfo	0:1.1.8-1.module+el8.4.0+14872+9efa52a3
Red Hat · RHEL 8.4 EUS rhel_eus:8.4::appstream	slirp4netns-debugsource	0:1.1.8-1.module+el8.4.0+14872+9efa52a3
Red Hat · RHEL 8.4 EUS rhel_eus:8.4::appstream	toolbox	0:0.0.8-1.module+el8.4.0+14872+9efa52a3
Red Hat · RHEL 8.4 EUS rhel_eus:8.4::appstream	udica	0:0.2.4-1.module+el8.4.0+14872+9efa52a3

Vulnerabilities 3

High 8.8

CVE-2022-1227 Public exploit

Podman publishes a malicious image to public registries

A privilege escalation flaw was found in Podman. This flaw allows an attacker to publish a malicious image to a public registry. Once this image is downloaded by a potential victim, the vulnerability is triggered after a user runs the 'podman top' command. Th…

podman podman github.com/containers/podman/v3 libpod Debian Ubuntu Azure Linux Alpine Go

Apr 29, 2022
High 7.5

CVE-2022-27649

Podman's default inheritable capabilities for linux container not empty

A flaw was found in Podman, where containers were started incorrectly with non-empty default permissions. A vulnerability was found in Moby (Docker Engine), where containers were started incorrectly with non-empty inheritable Linux process capabilities. This …

podman podman github.com/containers/podman/v3 github.com/containers/podman/v4 Debian Ubuntu Azure Linux Alpine Go

Apr 4, 2022
Medium 6.8

CVE-2022-27651

Non-empty default inheritable capabilities for linux container in Buildah

A flaw was found in buildah where containers were incorrectly started with non-empty default permissions. A bug was found in Moby (Docker Engine) where containers were incorrectly started with non-empty inheritable Linux process capabilities, enabling an atta…

cri-o buildah buildah golang-github-containers-buildah Debian Ubuntu Azure Linux Alpine Go

Apr 4, 2022

References

article
https://access.redhat.com/security/updates/classification/#important
report
https://bugzilla.redhat.com/show_bug.cgi?id=1972343
report
https://bugzilla.redhat.com/show_bug.cgi?id=2066568
report
https://bugzilla.redhat.com/show_bug.cgi?id=2066840
report
https://bugzilla.redhat.com/show_bug.cgi?id=2070368
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_4816.json
report
https://access.redhat.com/security/cve/CVE-2022-1227
advisory
https://www.cve.org/CVERecord?id=CVE-2022-1227
advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-1227
article
https://github.com/containers/podman/issues/10941
report
https://access.redhat.com/security/cve/CVE-2022-27649
advisory
https://www.cve.org/CVERecord?id=CVE-2022-27649
advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-27649
article
https://github.com/containers/podman/security/advisories/GHSA-qvf8-p83w-v58j
report
https://access.redhat.com/security/cve/CVE-2022-27651
advisory
https://www.cve.org/CVERecord?id=CVE-2022-27651
advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-27651
article
https://github.com/containers/buildah/security/advisories/GHSA-c3g4-w6cv-6v7h

Red Hat Security Advisory: container-tools:3.0 security update

Fixed packages 55

Vulnerabilities 3

Podman publishes a malicious image to public registries

Podman's default inheritable capabilities for linux container not empty

Non-empty default inheritable capabilities for linux container in Buildah

References