RHSA-2024:2077 — Red Hat Security Advisory: container-tools:rhel8 security and bug fix update

Fixed packages 65

Release	Package	Fixed in
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream	aardvark-dns	2:1.5.0-2.module+el8.8.0+21741+dd5be1e7
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream	buildah	1:1.29.3-1.module+el8.8.0+21741+dd5be1e7
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream	buildah-debuginfo	1:1.29.3-1.module+el8.8.0+21741+dd5be1e7
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream	buildah-debugsource	1:1.29.3-1.module+el8.8.0+21741+dd5be1e7
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream	buildah-tests	1:1.29.3-1.module+el8.8.0+21741+dd5be1e7
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream	buildah-tests-debuginfo	1:1.29.3-1.module+el8.8.0+21741+dd5be1e7
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream	cockpit-podman	0:63.1-1.module+el8.8.0+21741+dd5be1e7
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream	conmon	3:2.1.6-1.module+el8.8.0+21741+dd5be1e7
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream	conmon-debuginfo	3:2.1.6-1.module+el8.8.0+21741+dd5be1e7
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream	conmon-debugsource	3:2.1.6-1.module+el8.8.0+21741+dd5be1e7
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream	container-selinux	2:2.229.0-1.module+el8.8.0+21741+dd5be1e7
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream	containernetworking-plugins	1:1.2.0-1.module+el8.8.0+21741+dd5be1e7
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream	containernetworking-plugins-debuginfo	1:1.2.0-1.module+el8.8.0+21741+dd5be1e7
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream	containernetworking-plugins-debugsource	1:1.2.0-1.module+el8.8.0+21741+dd5be1e7
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream	containers-common	2:1-65.module+el8.8.0+21741+dd5be1e7
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream	crit	0:3.15-4.module+el8.8.0+21741+dd5be1e7
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream	criu	0:3.15-4.module+el8.8.0+21741+dd5be1e7
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream	criu-debuginfo	0:3.15-4.module+el8.8.0+21741+dd5be1e7
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream	criu-debugsource	0:3.15-4.module+el8.8.0+21741+dd5be1e7
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream	criu-devel	0:3.15-4.module+el8.8.0+21741+dd5be1e7
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream	criu-libs	0:3.15-4.module+el8.8.0+21741+dd5be1e7
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream	criu-libs-debuginfo	0:3.15-4.module+el8.8.0+21741+dd5be1e7
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream	crun	0:1.8.4-2.module+el8.8.0+21741+dd5be1e7
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream	crun-debuginfo	0:1.8.4-2.module+el8.8.0+21741+dd5be1e7
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream	crun-debugsource	0:1.8.4-2.module+el8.8.0+21741+dd5be1e7
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream	fuse-overlayfs	0:1.11-1.module+el8.8.0+21741+dd5be1e7
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream	fuse-overlayfs-debuginfo	0:1.11-1.module+el8.8.0+21741+dd5be1e7
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream	fuse-overlayfs-debugsource	0:1.11-1.module+el8.8.0+21741+dd5be1e7
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream	libslirp	0:4.4.0-1.module+el8.8.0+21741+dd5be1e7
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream	libslirp-debuginfo	0:4.4.0-1.module+el8.8.0+21741+dd5be1e7
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream	libslirp-debugsource	0:4.4.0-1.module+el8.8.0+21741+dd5be1e7
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream	libslirp-devel	0:4.4.0-1.module+el8.8.0+21741+dd5be1e7
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream	netavark	2:1.5.1-3.module+el8.8.0+21741+dd5be1e7
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream	oci-seccomp-bpf-hook	0:1.2.8-1.module+el8.8.0+21741+dd5be1e7
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream	oci-seccomp-bpf-hook-debuginfo	0:1.2.8-1.module+el8.8.0+21741+dd5be1e7
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream	oci-seccomp-bpf-hook-debugsource	0:1.2.8-1.module+el8.8.0+21741+dd5be1e7
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream	podman	3:4.4.1-19.module+el8.8.0+21741+dd5be1e7
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream	podman-catatonit	3:4.4.1-19.module+el8.8.0+21741+dd5be1e7
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream	podman-catatonit-debuginfo	3:4.4.1-19.module+el8.8.0+21741+dd5be1e7
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream	podman-debuginfo	3:4.4.1-19.module+el8.8.0+21741+dd5be1e7
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream	podman-debugsource	3:4.4.1-19.module+el8.8.0+21741+dd5be1e7
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream	podman-docker	3:4.4.1-19.module+el8.8.0+21741+dd5be1e7
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream	podman-gvproxy	3:4.4.1-19.module+el8.8.0+21741+dd5be1e7
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream	podman-gvproxy-debuginfo	3:4.4.1-19.module+el8.8.0+21741+dd5be1e7
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream	podman-plugins	3:4.4.1-19.module+el8.8.0+21741+dd5be1e7
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream	podman-plugins-debuginfo	3:4.4.1-19.module+el8.8.0+21741+dd5be1e7
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream	podman-remote	3:4.4.1-19.module+el8.8.0+21741+dd5be1e7
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream	podman-remote-debuginfo	3:4.4.1-19.module+el8.8.0+21741+dd5be1e7
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream	podman-tests	3:4.4.1-19.module+el8.8.0+21741+dd5be1e7
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream	python-podman	0:4.4.1-1.module+el8.8.0+21741+dd5be1e7
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream	python3-criu	0:3.15-4.module+el8.8.0+21741+dd5be1e7
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream	python3-podman	0:4.4.1-1.module+el8.8.0+21741+dd5be1e7
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream	runc	1:1.1.12-1.module+el8.8.0+21741+dd5be1e7
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream	runc-debuginfo	1:1.1.12-1.module+el8.8.0+21741+dd5be1e7
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream	runc-debugsource	1:1.1.12-1.module+el8.8.0+21741+dd5be1e7
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream	skopeo	2:1.11.2-0.2.module+el8.8.0+21741+dd5be1e7
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream	skopeo-tests	2:1.11.2-0.2.module+el8.8.0+21741+dd5be1e7
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream	slirp4netns	0:1.2.0-3.module+el8.8.0+21741+dd5be1e7
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream	slirp4netns-debuginfo	0:1.2.0-3.module+el8.8.0+21741+dd5be1e7
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream	slirp4netns-debugsource	0:1.2.0-3.module+el8.8.0+21741+dd5be1e7
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream	toolbox	0:0.0.99.3-7.module+el8.8.0+21741+dd5be1e7
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream	toolbox-debuginfo	0:0.0.99.3-7.module+el8.8.0+21741+dd5be1e7
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream	toolbox-debugsource	0:0.0.99.3-7.module+el8.8.0+21741+dd5be1e7
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream	toolbox-tests	0:0.0.99.3-7.module+el8.8.0+21741+dd5be1e7
Red Hat · RHEL 8.8 EUS rhel_eus:8.8::appstream	udica	0:0.2.6-20.module+el8.8.0+21741+dd5be1e7

Vulnerabilities 3

High 8.6

CVE-2024-1753

Buildah: buildah: container escape via improper bind mount validation

A flaw was found in Buildah (and subsequently Podman Build) which allows containers to mount arbitrary locations on the host filesystem into build containers. A malicious Containerfile can use a dummy image with a symbolic link to the root filesystem as a mou…

Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine Go

Mar 18, 2024
High 7.5

CVE-2022-32149

Denial of service via crafted Accept-Language header in golang.org/x/text/language

An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse.

golang.org/x/text golang.org/x/text/language k3d k3d-proxy Debian Ubuntu Azure Linux Alpine Wolfi Go

Oct 14, 2022
Medium 5.3

CVE-2022-4122

Buildah (as part of Podman) vulnerable to Link Following

A vulnerability was found in buildah. Incorrect following of symlinks while reading .containerignore and .dockerignore results in information disclosure.

podman github.com/containers/podman/v4 github.com/containers/podman/v3 github.com/containers/podman/v2 Debian Ubuntu Azure Linux Go

Dec 8, 2022

References

article
https://access.redhat.com/security/updates/classification/#important
report
https://bugzilla.redhat.com/show_bug.cgi?id=2134010
report
https://bugzilla.redhat.com/show_bug.cgi?id=2144983
report
https://bugzilla.redhat.com/show_bug.cgi?id=2265513
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2077.json
report
https://access.redhat.com/security/cve/CVE-2022-4122
advisory
https://www.cve.org/CVERecord?id=CVE-2022-4122
advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-4122
article
https://github.com/containers/podman/pull/16315
report
https://access.redhat.com/security/cve/CVE-2022-32149
advisory
https://www.cve.org/CVERecord?id=CVE-2022-32149
advisory
https://nvd.nist.gov/vuln/detail/CVE-2022-32149
article
https://go.dev/issue/56152
article
https://groups.google.com/g/golang-dev/c/qfPIly0X7aU
report
https://access.redhat.com/security/cve/CVE-2024-1753
advisory
https://www.cve.org/CVERecord?id=CVE-2024-1753
advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-1753
article
https://github.com/containers/buildah/security/advisories/GHSA-pmf3-c36m-g5cf
article
https://github.com/containers/podman/security/advisories/GHSA-874v-pj72-92f3
advisory
https://pkg.go.dev/vuln/GO-2024-2658

Red Hat Security Advisory: container-tools:rhel8 security and bug fix update

Fixed packages 65

Vulnerabilities 3

Buildah: buildah: container escape via improper bind mount validation

Denial of service via crafted Accept-Language header in golang.org/x/text/language

Buildah (as part of Podman) vulnerable to Link Following

References