Red Hat Security Advisory: buildah security and bug fix update

Fixed packages 5

Vulnerabilities 7

• High 7.5
  CVE-2022-27191

  golang.org/x/crypto/ssh Denial of service via crafted Signer

  The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey.

  go k3d k3d-proxy k3d-tools Debian Ubuntu Alpine Wolfi Go
  Mar 18, 2022
• High 7.1
  CVE-2022-2989

  Podman's incorrect handling of the supplementary groups may lead to data disclosure, modification

  An incorrect handling of the supplementary groups in the Podman container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to…

  podman podman github.com/containers/podman/v3 github.com/containers/podman/v4 Debian Ubuntu Azure Linux Alpine Go
  Sep 13, 2022
• High 7.1
  CVE-2022-2990

  Buildah's incorrect handling of the supplementary groups may lead to data disclosure, modification

  An incorrect handling of the supplementary groups in the Buildah container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used t…

  buildah buildah golang-github-containers-buildah golang-github-containers-buildah Debian Ubuntu Azure Linux Alpine Go
  Sep 13, 2022
• Medium 6.5
  CVE-2021-20291

  Improper Locking in github.com/containers/storage

  A deadlock vulnerability was found in 'github.com/containers/storage' in versions before 1.28.1. When a container image is processed, each layer is unpacked using `tar`. If one of those layers is not a valid `tar` archive this causes an error leading to an un…

  buildah golang-github-containers-storage golang-github-containers-storage github.com/containers/storage Debian Ubuntu Azure Linux Go
  Apr 1, 2021
• Unscored —
  CVE-2021-33195

  Improper sanitization when resolving values from DNS in net

  Go before 1.15.13 and 1.16.x before 1.16.5 has functions for DNS lookups that do not validate replies from DNS servers, and thus a return value may contain an unsafe injection (e.g., XSS) that does not conform to the RFC1035 format.

  golang go stdlib golang-1.8 Debian Ubuntu Azure Linux Alpine Go
  Aug 2, 2021
• Unscored —
  CVE-2021-33197

  Attacker can drop certain headers in net/http/httputil

  In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from net/http/httputil) result in a situation where an attacker is able to drop arbitrary headers.

  golang go stdlib golang-1.8 Debian Ubuntu Azure Linux Alpine Go
  Aug 2, 2021
• Unscored —
  CVE-2021-33198

  Panic on inputs with large exponents in math/big

  In Go before 1.15.13 and 1.16.x before 1.16.5, there can be a panic for a large exponent to the math/big.Rat SetString or UnmarshalText method.

  go stdlib golang-1.8 golang-1.16 Debian Ubuntu Alpine Go
  Aug 2, 2021

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• article
  https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.1_release_notes/index
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1939485
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1989564
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1989570
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1989575
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2064702
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2081835
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2121445
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2121453
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_8008.json
• report
  https://access.redhat.com/security/cve/CVE-2021-20291
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-20291
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-20291
• article
  https://unit42.paloaltonetworks.com/cve-2021-20291/
• report
  https://access.redhat.com/security/cve/CVE-2021-33195
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-33195
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-33195
• article
  https://groups.google.com/g/golang-announce/c/RgCMkAEQjSI
• report
  https://access.redhat.com/security/cve/CVE-2021-33197
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-33197
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-33197
• report
  https://access.redhat.com/security/cve/CVE-2021-33198
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-33198
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-33198
• report
  https://access.redhat.com/security/cve/CVE-2022-2989
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-2989
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-2989
• article
  https://www.benthamsgaze.org/2022/08/22/vulnerability-in-linux-containers-investigation-and-mitigation/
• report
  https://access.redhat.com/security/cve/CVE-2022-2990
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-2990
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-2990
• report
  https://access.redhat.com/security/cve/CVE-2022-27191
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-27191
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-27191
• article
  https://groups.google.com/g/golang-announce/c/-cp44ypCT5s/m/wmegxkLiAQAJ