RHSA-2023:6939 — Red Hat Security Advisory: container-tools:rhel8 security and bug fix update

Fixed packages 65

Release	Package	Fixed in
Red Hat · RHEL 8 enterprise_linux:8::appstream	aardvark-dns	2:1.7.0-1.module+el8.9.0+19244+655f84ee
Red Hat · RHEL 8 enterprise_linux:8::appstream	buildah	1:1.31.3-1.module+el8.9.0+19761+326da906
Red Hat · RHEL 8 enterprise_linux:8::appstream	buildah-debuginfo	1:1.31.3-1.module+el8.9.0+19761+326da906
Red Hat · RHEL 8 enterprise_linux:8::appstream	buildah-debugsource	1:1.31.3-1.module+el8.9.0+19761+326da906
Red Hat · RHEL 8 enterprise_linux:8::appstream	buildah-tests	1:1.31.3-1.module+el8.9.0+19761+326da906
Red Hat · RHEL 8 enterprise_linux:8::appstream	buildah-tests-debuginfo	1:1.31.3-1.module+el8.9.0+19761+326da906
Red Hat · RHEL 8 enterprise_linux:8::appstream	cockpit-podman	0:75-1.module+el8.9.0+19761+326da906
Red Hat · RHEL 8 enterprise_linux:8::appstream	conmon	3:2.1.8-1.module+el8.9.0+19761+326da906
Red Hat · RHEL 8 enterprise_linux:8::appstream	conmon-debuginfo	3:2.1.8-1.module+el8.9.0+19761+326da906
Red Hat · RHEL 8 enterprise_linux:8::appstream	conmon-debugsource	3:2.1.8-1.module+el8.9.0+19761+326da906
Red Hat · RHEL 8 enterprise_linux:8::appstream	container-selinux	2:2.221.0-1.module+el8.9.0+19685+019f3589
Red Hat · RHEL 8 enterprise_linux:8::appstream	containernetworking-plugins	1:1.3.0-4.module+el8.9.0+19649+5879504a
Red Hat · RHEL 8 enterprise_linux:8::appstream	containernetworking-plugins-debuginfo	1:1.3.0-4.module+el8.9.0+19649+5879504a
Red Hat · RHEL 8 enterprise_linux:8::appstream	containernetworking-plugins-debugsource	1:1.3.0-4.module+el8.9.0+19649+5879504a
Red Hat · RHEL 8 enterprise_linux:8::appstream	containers-common	2:1-54.module+el8.9.0+19761+326da906
Red Hat · RHEL 8 enterprise_linux:8::appstream	crit	0:3.18-4.module+el8.9.0+19090+d2921118
Red Hat · RHEL 8 enterprise_linux:8::appstream	criu	0:3.18-4.module+el8.9.0+19090+d2921118
Red Hat · RHEL 8 enterprise_linux:8::appstream	criu-debuginfo	0:3.18-4.module+el8.9.0+19090+d2921118
Red Hat · RHEL 8 enterprise_linux:8::appstream	criu-debugsource	0:3.18-4.module+el8.9.0+19090+d2921118
Red Hat · RHEL 8 enterprise_linux:8::appstream	criu-devel	0:3.18-4.module+el8.9.0+19090+d2921118
Red Hat · RHEL 8 enterprise_linux:8::appstream	criu-libs	0:3.18-4.module+el8.9.0+19090+d2921118
Red Hat · RHEL 8 enterprise_linux:8::appstream	criu-libs-debuginfo	0:3.18-4.module+el8.9.0+19090+d2921118
Red Hat · RHEL 8 enterprise_linux:8::appstream	crun	0:1.8.7-1.module+el8.9.0+19731+94cfa27e
Red Hat · RHEL 8 enterprise_linux:8::appstream	crun-debuginfo	0:1.8.7-1.module+el8.9.0+19731+94cfa27e
Red Hat · RHEL 8 enterprise_linux:8::appstream	crun-debugsource	0:1.8.7-1.module+el8.9.0+19731+94cfa27e
Red Hat · RHEL 8 enterprise_linux:8::appstream	fuse-overlayfs	0:1.12-1.module+el8.9.0+19090+d2921118
Red Hat · RHEL 8 enterprise_linux:8::appstream	fuse-overlayfs-debuginfo	0:1.12-1.module+el8.9.0+19090+d2921118
Red Hat · RHEL 8 enterprise_linux:8::appstream	fuse-overlayfs-debugsource	0:1.12-1.module+el8.9.0+19090+d2921118
Red Hat · RHEL 8 enterprise_linux:8::appstream	libslirp	0:4.4.0-1.module+el8.9.0+19244+655f84ee
Red Hat · RHEL 8 enterprise_linux:8::appstream	libslirp-debuginfo	0:4.4.0-1.module+el8.9.0+19244+655f84ee
Red Hat · RHEL 8 enterprise_linux:8::appstream	libslirp-debugsource	0:4.4.0-1.module+el8.9.0+19244+655f84ee
Red Hat · RHEL 8 enterprise_linux:8::appstream	libslirp-devel	0:4.4.0-1.module+el8.9.0+19244+655f84ee
Red Hat · RHEL 8 enterprise_linux:8::appstream	netavark	2:1.7.0-1.module+el8.9.0+19244+655f84ee
Red Hat · RHEL 8 enterprise_linux:8::appstream	oci-seccomp-bpf-hook	0:1.2.9-1.module+el8.9.0+19090+d2921118
Red Hat · RHEL 8 enterprise_linux:8::appstream	oci-seccomp-bpf-hook-debuginfo	0:1.2.9-1.module+el8.9.0+19090+d2921118
Red Hat · RHEL 8 enterprise_linux:8::appstream	oci-seccomp-bpf-hook-debugsource	0:1.2.9-1.module+el8.9.0+19090+d2921118
Red Hat · RHEL 8 enterprise_linux:8::appstream	podman	3:4.6.1-4.module+el8.9.0+19761+326da906
Red Hat · RHEL 8 enterprise_linux:8::appstream	podman-catatonit	3:4.6.1-4.module+el8.9.0+19761+326da906
Red Hat · RHEL 8 enterprise_linux:8::appstream	podman-catatonit-debuginfo	3:4.6.1-4.module+el8.9.0+19761+326da906
Red Hat · RHEL 8 enterprise_linux:8::appstream	podman-debuginfo	3:4.6.1-4.module+el8.9.0+19761+326da906
Red Hat · RHEL 8 enterprise_linux:8::appstream	podman-debugsource	3:4.6.1-4.module+el8.9.0+19761+326da906
Red Hat · RHEL 8 enterprise_linux:8::appstream	podman-docker	3:4.6.1-4.module+el8.9.0+19761+326da906
Red Hat · RHEL 8 enterprise_linux:8::appstream	podman-gvproxy	3:4.6.1-4.module+el8.9.0+19761+326da906
Red Hat · RHEL 8 enterprise_linux:8::appstream	podman-gvproxy-debuginfo	3:4.6.1-4.module+el8.9.0+19761+326da906
Red Hat · RHEL 8 enterprise_linux:8::appstream	podman-plugins	3:4.6.1-4.module+el8.9.0+19761+326da906
Red Hat · RHEL 8 enterprise_linux:8::appstream	podman-plugins-debuginfo	3:4.6.1-4.module+el8.9.0+19761+326da906
Red Hat · RHEL 8 enterprise_linux:8::appstream	podman-remote	3:4.6.1-4.module+el8.9.0+19761+326da906
Red Hat · RHEL 8 enterprise_linux:8::appstream	podman-remote-debuginfo	3:4.6.1-4.module+el8.9.0+19761+326da906
Red Hat · RHEL 8 enterprise_linux:8::appstream	podman-tests	3:4.6.1-4.module+el8.9.0+19761+326da906
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-podman	0:4.6.0-1.module+el8.9.0+19513+83322573
Red Hat · RHEL 8 enterprise_linux:8::appstream	python3-criu	0:3.18-4.module+el8.9.0+19090+d2921118
Red Hat · RHEL 8 enterprise_linux:8::appstream	python3-podman	0:4.6.0-1.module+el8.9.0+19513+83322573
Red Hat · RHEL 8 enterprise_linux:8::appstream	runc	1:1.1.9-1.module+el8.9.0+19648+0d5ae0ec
Red Hat · RHEL 8 enterprise_linux:8::appstream	runc-debuginfo	1:1.1.9-1.module+el8.9.0+19648+0d5ae0ec
Red Hat · RHEL 8 enterprise_linux:8::appstream	runc-debugsource	1:1.1.9-1.module+el8.9.0+19648+0d5ae0ec
Red Hat · RHEL 8 enterprise_linux:8::appstream	skopeo	2:1.13.3-1.module+el8.9.0+19761+326da906
Red Hat · RHEL 8 enterprise_linux:8::appstream	skopeo-tests	2:1.13.3-1.module+el8.9.0+19761+326da906
Red Hat · RHEL 8 enterprise_linux:8::appstream	slirp4netns	0:1.2.1-1.module+el8.9.0+19731+94cfa27e
Red Hat · RHEL 8 enterprise_linux:8::appstream	slirp4netns-debuginfo	0:1.2.1-1.module+el8.9.0+19731+94cfa27e
Red Hat · RHEL 8 enterprise_linux:8::appstream	slirp4netns-debugsource	0:1.2.1-1.module+el8.9.0+19731+94cfa27e
Red Hat · RHEL 8 enterprise_linux:8::appstream	toolbox	0:0.0.99.4-5.module+el8.9.0+19655+b08391f8
Red Hat · RHEL 8 enterprise_linux:8::appstream	toolbox-debuginfo	0:0.0.99.4-5.module+el8.9.0+19655+b08391f8
Red Hat · RHEL 8 enterprise_linux:8::appstream	toolbox-debugsource	0:0.0.99.4-5.module+el8.9.0+19655+b08391f8
Red Hat · RHEL 8 enterprise_linux:8::appstream	toolbox-tests	0:0.0.99.4-5.module+el8.9.0+19655+b08391f8
Red Hat · RHEL 8 enterprise_linux:8::appstream	udica	0:0.2.6-20.module+el8.9.0+19244+655f84ee

Vulnerabilities 17

Critical 9.8

CVE-2023-24538 Public exploit

Backticks not treated as string delimiters in html/template

Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them as expected. Backticks are used, since ES6, for JS template literals. If a template contains a Go template action within a Javascript template literal, th…

Go standard library html/template katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go

Apr 6, 2023
Critical 9.8

CVE-2023-24540

Improper handling of JavaScript whitespace in html/template

Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the character set "\t\n\f\r\u0020\u2028\u2029" in JavaScript contexts that also contain actions may not be properly sanitized…

Go standard library html/template katib-suggestion-hyperopt katib-earlystopping Debian Azure Linux Alpine Wolfi Go

May 11, 2023
High 7.5

CVE-2022-3064

Excessive resource consumption in gopkg.in/yaml.v2

Parsing malicious or large YAML documents can consume excessive amounts of CPU or memory.

gopkg.in/yaml.v2 gopkg.in/yaml.v2 k3d k3d-proxy Debian Ubuntu Azure Linux Wolfi Go

Dec 27, 2022
High 7.5

CVE-2022-41723

Denial of service via crafted HTTP/2 stream in net/http and golang.org/x/net

A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.

Go standard library golang.org/x/net net/http golang.org/x/net/http2 Debian Ubuntu Azure Linux Alpine Wolfi Go

Feb 28, 2023
High 7.5

CVE-2023-24534

Excessive memory allocation in net/http and net/textproto

HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of service. Certain unusual patterns of input data can cause the common function used to parse HTTP and MIME headers to allocate…

Go standard library net/textproto katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go

Apr 6, 2023
High 7.5

CVE-2023-24536

Excessive resource consumption in net/http, net/textproto and mime/multipart

Multipart form parsing can consume large amounts of CPU and memory when processing form inputs containing very large numbers of parts. This stems from several causes: 1. mime/multipart.Reader.ReadForm limits the total memory a parsed multipart form can consum…

Go standard library net/textproto mime/multipart katib-suggestion-hyperopt Debian Ubuntu Azure Linux Alpine Wolfi Go

Apr 6, 2023
High 7.5

CVE-2023-24537

Infinite loop in parsing in go/scanner

Calling any of the Parse functions on Go source code which contains //line directives with very large line numbers can cause an infinite loop due to integer overflow.

Go standard library go/scanner katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go

Apr 6, 2023
High 7.3

CVE-2023-24539

Improper sanitization of CSS values in html/template

Angle brackets (<>) are not considered dangerous characters when inserted into CSS contexts. Templates containing multiple actions separated by a '/' character can result in unexpectedly closing the CSS context and allowing for injection of unexpected HTML, i…

Go standard library html/template katib-suggestion-hyperopt katib-earlystopping Debian Azure Linux Alpine Wolfi Go

May 11, 2023
High 7.3

CVE-2023-29400

Improper handling of empty HTML attributes in html/template

Templates containing actions in unquoted HTML attributes (e.g. "attr={{.}}") executed with empty input can result in output with unexpected results when parsed due to HTML normalization rules. This may allow injection of arbitrary attributes into tags.

Go standard library html/template katib-suggestion-hyperopt katib-earlystopping Debian Azure Linux Alpine Wolfi Go

May 11, 2023
High 7.0

CVE-2023-27561

Opencontainers runc Incorrect Authorization vulnerability

runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom …

ctop podman podman-doc github.com/opencontainers/runc Debian Ubuntu Azure Linux Alpine Wolfi Go

Mar 3, 2023
Medium 6.1

CVE-2023-28642

AppArmor bypass with symlinked /proc in runc

runc is a CLI tool for spawning and running containers according to the OCI specification. It was found that AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount configuration. This issue has been fixed in runc version…

opencontainers runc ctop podman Debian Ubuntu Azure Linux Alpine Wolfi Go

Mar 29, 2023
Medium 6.1

CVE-2023-3978

Improper rendering of text nodes in golang.org/x/net/html

Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack.

golang.org/x/net golang.org/x/net/html zot kots Debian Ubuntu Azure Linux Wolfi Go

Aug 2, 2023
Medium 5.3

CVE-2023-25173

containerd supplementary groups are not set up properly

containerd is an open source container runtime. A bug was found in containerd prior to versions 1.6.18 and 1.5.18 where supplementary groups are not set up properly inside a container. If an attacker has direct access to a container and manipulates their supp…

containerd containerd ctop containerd Debian Ubuntu Azure Linux Alpine Wolfi Go

Feb 16, 2023
Medium 5.0

CVE-2023-25809

rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc

runc is a CLI tool for spawning and running containers according to the OCI specification. In affected versions it was found that rootless runc makes `/sys/fs/cgroup` writable in following conditons: 1. when runc is executed inside the user namespace, and the…

opencontainers runc ctop podman Debian Ubuntu Azure Linux Alpine Wolfi Go

Mar 29, 2023
Unscored —

CVE-2022-41724

Panic on large handshake records in crypto/tls

Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS handshake records which cause servers and clients, respectively, to panic when attempting to construct responses. This affects all TLS 1.3 clients, TLS 1.2 cli…

Go standard library crypto/tls katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go

Feb 28, 2023
Unscored —

CVE-2022-41725

Excessive resource consumption in mime/multipart

A denial of service is possible from excessive resource consumption in net/http and mime/multipart. Multipart form parsing with mime/multipart.Reader.ReadForm can consume largely unlimited amounts of memory and disk files. This also affects form parsing in th…

Go standard library mime/multipart katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go

Feb 28, 2023
Unscored —

CVE-2023-29406 Public exploit

Insufficient sanitization of Host header in net/http

The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send requests containing an invalid Request.Host or Reque…

Go standard library net/http katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go

Jul 11, 2023

References

article
https://access.redhat.com/security/updates/classification/#moderate
article
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.9_release_notes/index
report
https://bugzilla.redhat.com/show_bug.cgi?id=2066138
report
https://bugzilla.redhat.com/show_bug.cgi?id=2144541
report
https://bugzilla.redhat.com/show_bug.cgi?id=2163037
report
https://bugzilla.redhat.com/show_bug.cgi?id=2165744
report
https://bugzilla.redhat.com/show_bug.cgi?id=2166195
report
https://bugzilla.redhat.com/show_bug.cgi?id=2173082
report
https://bugzilla.redhat.com/show_bug.cgi?id=2174485
report
https://bugzilla.redhat.com/show_bug.cgi?id=2175721
report
https://bugzilla.redhat.com/show_bug.cgi?id=2175794
report
https://bugzilla.redhat.com/show_bug.cgi?id=2178358
report
https://bugzilla.redhat.com/show_bug.cgi?id=2178488
report
https://bugzilla.redhat.com/show_bug.cgi?id=2178492
report
https://bugzilla.redhat.com/show_bug.cgi?id=2179449
report
https://bugzilla.redhat.com/show_bug.cgi?id=2179465
report
https://bugzilla.redhat.com/show_bug.cgi?id=2180104
report
https://bugzilla.redhat.com/show_bug.cgi?id=2180118
report
https://bugzilla.redhat.com/show_bug.cgi?id=2181521
report
https://bugzilla.redhat.com/show_bug.cgi?id=2182052
report
https://bugzilla.redhat.com/show_bug.cgi?id=2182883
report
https://bugzilla.redhat.com/show_bug.cgi?id=2182884
report
https://bugzilla.redhat.com/show_bug.cgi?id=2182894
report
https://bugzilla.redhat.com/show_bug.cgi?id=2183041
report
https://bugzilla.redhat.com/show_bug.cgi?id=2183596
report
https://bugzilla.redhat.com/show_bug.cgi?id=2184481
report
https://bugzilla.redhat.com/show_bug.cgi?id=2184482
report
https://bugzilla.redhat.com/show_bug.cgi?id=2184483
report
https://bugzilla.redhat.com/show_bug.cgi?id=2184484
report
https://bugzilla.redhat.com/show_bug.cgi?id=2188524
report
https://bugzilla.redhat.com/show_bug.cgi?id=2189578
report
https://bugzilla.redhat.com/show_bug.cgi?id=2192977
report
https://bugzilla.redhat.com/show_bug.cgi?id=2196026
report
https://bugzilla.redhat.com/show_bug.cgi?id=2196027
report
https://bugzilla.redhat.com/show_bug.cgi?id=2196029
report
https://bugzilla.redhat.com/show_bug.cgi?id=2216700
report
https://bugzilla.redhat.com/show_bug.cgi?id=2218315
report
https://bugzilla.redhat.com/show_bug.cgi?id=2220931
report
https://bugzilla.redhat.com/show_bug.cgi?id=2222167

Red Hat Security Advisory: container-tools:rhel8 security and bug fix update

Fixed packages 65

Vulnerabilities 17

Backticks not treated as string delimiters in html/template

Improper handling of JavaScript whitespace in html/template

Excessive resource consumption in gopkg.in/yaml.v2

Denial of service via crafted HTTP/2 stream in net/http and golang.org/x/net

Excessive memory allocation in net/http and net/textproto

Excessive resource consumption in net/http, net/textproto and mime/multipart

Infinite loop in parsing in go/scanner

Improper sanitization of CSS values in html/template

Improper handling of empty HTML attributes in html/template

Opencontainers runc Incorrect Authorization vulnerability

AppArmor bypass with symlinked /proc in runc

Improper rendering of text nodes in golang.org/x/net/html

containerd supplementary groups are not set up properly

rootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc

Panic on large handshake records in crypto/tls

Excessive resource consumption in mime/multipart

Insufficient sanitization of Host header in net/http

References