Skip to content
OpenAdvisories
Medium RLSA-2020:1650 3 CVEs

Moderate: container-tools:rhel8 security, bug fix, and enhancement update

Published Apr 28, 2020 · Updated Feb 5, 2026

Ecosystem: Rocky Linux

Summary

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

* runc: volume mount race condition with shared mounts leads to information leak/integrity manipulation (CVE-2019-19921)

* containers/image: Container images read entire image manifest into memory (CVE-2020-1702)

* podman: incorrectly allows existing files in volumes to be overwritten by a container when it is created (CVE-2020-1726)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.2 Release Notes linked from the References section.

Fixed packages 16

ReleasePackageFixed in
Rocky Linux · 8 container-selinux 2:2.124.0-1.gitf958d0c.module+el8.5.0+681+c9a1951f
Rocky Linux · 8 criu 0:3.12-9.module+el8.5.0+681+c9a1951f
Rocky Linux · 8 criu 0:3.12-9.module+el8.4.0+557+48ba8b2f
Rocky Linux · 8 python-podman-api 0:1.2.0-0.2.gitd0a45fe.module+el8.5.0+770+e2f49861
Rocky Linux · 8 python-podman-api 0:1.2.0-0.2.gitd0a45fe.module+el8.4.0+559+c02fa3b2
Rocky Linux · 8 python-podman-api 0:1.2.0-0.2.gitd0a45fe.module+el8.5.0+708+6758137d
Rocky Linux · 8 runc 0:1.0.0-65.rc10.module+el8.4.0+559+c02fa3b2
Rocky Linux · 8 slirp4netns 0:0.4.2-3.git21fdece.module+el8.5.0+770+e2f49861
Rocky Linux · 8 slirp4netns 0:0.4.2-3.git21fdece.module+el8.4.0+536+994a2182
Rocky Linux · 8 slirp4netns 0:0.4.2-3.git21fdece.module+el8.5.0+708+6758137d
Rocky Linux · 8 toolbox 0:0.0.7-1.module+el8.5.0+770+e2f49861
Rocky Linux · 8 toolbox 0:0.0.7-1.module+el8.4.0+559+c02fa3b2
Rocky Linux · 8 toolbox 0:0.0.7-1.module+el8.5.0+708+6758137d
Rocky Linux · 8 udica 0:0.2.1-2.module+el8.5.0+770+e2f49861
Rocky Linux · 8 udica 0:0.2.1-2.module+el8.4.0+559+c02fa3b2
Rocky Linux · 8 udica 0:0.2.1-2.module+el8.5.0+708+6758137d

Vulnerabilities 3

  • Medium 5.9
    CVE-2019-19921

    opencontainers runc contains procfs race condition with a shared volume mount

    runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run cus…

    containerd runc github.com/opencontainers/runc runc Debian Ubuntu Alpine Go
  • Medium 5.9
    CVE-2020-1726

    Podman has Files or Directories Accessible to External Parties

    A flaw was discovered in Podman where it incorrectly allows containers when created to overwrite existing files in volumes, even if they are mounted as read-only. When a user runs a malicious container or a container based on a malicious image with an attache…

    The podman podman github.com/containers/podman Debian Alpine Go
  • Unscored —
    CVE-2020-1702

    A malicious container image can consume an unbounded amount of memory when being pulled to a container runtime host, su…

References

  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1703245
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1717357
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1731107
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1732704
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1732713
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1748519
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1749999
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1754744
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1754763
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1755119
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1756919
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1757693
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1757845
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1763454
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1766774
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1768930
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1769469
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1771990
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1774755
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1775307
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1776112
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1779834
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1783267
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1783268
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1783270
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1783272
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1783274
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1784267
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1784952
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1788539
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1792796
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1793084
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1793598
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1796107
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1801152
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1802907
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1803496
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1804849
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1805017