Red Hat Security Advisory: podman security and bug fix update

Fixed packages 12

Vulnerabilities 8

• High 7.5
  CVE-2022-27191

  golang.org/x/crypto/ssh Denial of service via crafted Signer

  The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey.

  go k3d k3d-proxy k3d-tools Debian Ubuntu Alpine Wolfi Go
  Mar 18, 2022
• Medium 6.5
  CVE-2021-20291

  Improper Locking in github.com/containers/storage

  A deadlock vulnerability was found in 'github.com/containers/storage' in versions before 1.28.1. When a container image is processed, each layer is unpacked using `tar`. If one of those layers is not a valid `tar` archive this causes an error leading to an un…

  buildah golang-github-containers-storage golang-github-containers-storage github.com/containers/storage Debian Ubuntu Azure Linux Go
  Apr 1, 2021
• Medium 6.5
  CVE-2021-4024

  Exposure of Sensitive Information to an Unauthorized Actor and Origin Validation Error in podman

  A flaw was found in podman. The `podman machine` function (used to create and manage Podman virtual machine containing a Podman process) spawns a `gvproxy` process on the host system. The `gvproxy` API is accessible on port 7777 on all IP addresses on the hos…

  podman github.com/containers/podman/v3 github.com/containers/podman github.com/containers/podman/v2 Debian Ubuntu Alpine Go
  Dec 23, 2021
• Medium 5.9
  CVE-2021-20199

  Podman Origin Validation Error

  Rootless containers run with Podman, receive all traffic with a source IP address of 127.0.0.1 (including from remote hosts). This impacts containerized applications that trust localhost (127.0.01) connections by default and do not require authentication. Thi…

  podman podman github.com/containers/podman/v3 libpod Debian Ubuntu Azure Linux Alpine Go
  Feb 2, 2021
• Unscored —
  CVE-2020-28851

  In x/text in Go 1.15.4, an "index out of range" panic occurs in language.ParseAcceptLanguage while parsing the -u- exte…

  buildah google-guest-agent multus golang-golang-x-text Debian Ubuntu Azure Linux
  Jan 2, 2021
• Unscored —
  CVE-2020-28852

  In x/text in Go before v0.3.5, a "slice bounds out of range" panic occurs in language.ParseAcceptLanguage while process…

  buildah google-guest-agent multus golang-golang-x-text Debian Ubuntu Azure Linux
  Jan 2, 2021
• Unscored —
  CVE-2021-33197

  Attacker can drop certain headers in net/http/httputil

  In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from net/http/httputil) result in a situation where an attacker is able to drop arbitrary headers.

  golang go stdlib golang-1.8 Debian Ubuntu Azure Linux Alpine Go
  Aug 2, 2021
• Unscored —
  CVE-2021-34558 Public exploit

  Panic on certain certificates in crypto/tls

  The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS server to cause a TLS client to panic.

  golang go stdlib golang-1.8 Debian Ubuntu Azure Linux Alpine Go
  Jul 15, 2021

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• article
  https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.1_release_notes/index
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1913333
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1913338
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1919050
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1939485
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1972303
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1983596
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1989570
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2026675
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2040379
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2064702
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2081349
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2088116
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2092798
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2097694
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_7954.json
• report
  https://access.redhat.com/security/cve/CVE-2020-28851
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-28851
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-28851
• report
  https://access.redhat.com/security/cve/CVE-2020-28852
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-28852
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-28852
• report
  https://access.redhat.com/security/cve/CVE-2021-4024
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-4024
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-4024
• report
  https://access.redhat.com/security/cve/CVE-2021-20199
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-20199
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-20199
• report
  https://access.redhat.com/security/cve/CVE-2021-20291
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-20291
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-20291
• article
  https://unit42.paloaltonetworks.com/cve-2021-20291/
• report
  https://access.redhat.com/security/cve/CVE-2021-33197
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-33197
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-33197
• article
  https://groups.google.com/g/golang-announce/c/RgCMkAEQjSI
• report
  https://access.redhat.com/security/cve/CVE-2021-34558
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-34558