Skip to content
OpenAdvisories
Medium RLSA-2022:7457 6 CVEs

Moderate: container-tools:rhel8 security, bug fix, and enhancement update

Published Nov 8, 2022 · Updated Feb 5, 2026

Ecosystem: Rocky Linux

Summary

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

* golang: net/http/httputil: panic due to racy read of persistConn after handler panic (CVE-2021-36221)

* cri-o: memory exhaustion on the node when access to the kube api (CVE-2022-1708)

* golang: crash in a golang.org/x/crypto/ssh server (CVE-2022-27191)

* opencontainers: OCI manifest and index parsing confusion (CVE-2021-41190)

* buildah: possible information disclosure and modification (CVE-2022-2990)

* runc: incorrect handling of inheritable capabilities (CVE-2022-29162)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.7 Release Notes linked from the References section.

Fixed packages 25

ReleasePackageFixed in
Rocky Linux · 8 cockpit-podman 0:53-1.module+el8.7.0+1078+e72fcd4f
Rocky Linux · 8 conmon 2:2.1.4-1.module+el8.7.0+1077+0e4f03d4
Rocky Linux · 8 container-selinux 2:2.189.0-1.module+el8.7.0+1076+9b1c11c1
Rocky Linux · 8 container-selinux 2:2.189.0-1.module+el8.6.0+1054+50b00ff4
Rocky Linux · 8 containernetworking-plugins 1:1.1.1-3.module+el8.7.0+1078+e72fcd4f
Rocky Linux · 8 containernetworking-plugins 1:1.1.1-3.module+el8.6.0+1054+50b00ff4
Rocky Linux · 8 criu 0:3.15-3.module+el8.7.0+1077+0e4f03d4
Rocky Linux · 8 criu 0:3.15-3.module+el8.5.0+710+4c471e88
Rocky Linux · 8 criu 0:3.15-3.module+el8.6.0+1054+50b00ff4
Rocky Linux · 8 crun 0:1.5-1.module+el8.7.0+1077+0e4f03d4
Rocky Linux · 8 crun 0:1.5-1.module+el8.6.0+1054+50b00ff4
Rocky Linux · 8 fuse-overlayfs 0:1.9-1.module+el8.7.0+1077+0e4f03d4
Rocky Linux · 8 fuse-overlayfs 0:1.9-1.module+el8.6.0+1054+50b00ff4
Rocky Linux · 8 libslirp 0:4.4.0-1.module+el8.7.0+1077+0e4f03d4
Rocky Linux · 8 libslirp 0:4.4.0-1.module+el8.5.0+710+4c471e88
Rocky Linux · 8 libslirp 0:4.4.0-1.module+el8.6.0+1054+50b00ff4
Rocky Linux · 8 oci-seccomp-bpf-hook 0:1.2.6-1.module+el8.7.0+1078+e72fcd4f
Rocky Linux · 8 oci-seccomp-bpf-hook 0:1.2.6-1.module+el8.6.0+1054+50b00ff4
Rocky Linux · 8 runc 1:1.1.4-1.module+el8.7.0+1077+0e4f03d4
Rocky Linux · 8 slirp4netns 0:1.2.0-2.module+el8.7.0+1078+e72fcd4f
Rocky Linux · 8 slirp4netns 0:1.2.0-2.module+el8.6.0+1054+50b00ff4
Rocky Linux · 8 toolbox 0:0.0.99.3-0.6.module+el8.7.0+1078+e72fcd4f
Rocky Linux · 8 toolbox 0:0.0.99.3-0.6.module+el8.6.0+1054+50b00ff4
Rocky Linux · 8 udica 0:0.2.6-3.module+el8.7.0+1077+0e4f03d4
Rocky Linux · 8 udica 0:0.2.6-3.module+el8.6.0+971+69b94baf

Vulnerabilities 6

  • High 7.5
    CVE-2022-1708

    Node DOS by way of memory exhaustion through ExecSync request in CRI-O

    A vulnerability was found in CRI-O that causes memory or disk space exhaustion on the node for anyone with access to the Kube API. The ExecSync request runs commands in a container and logs the output of the command. This output is then read by CRI-O after co…

    cri-o github.com/cri-o/cri-o cri-o Azure Linux Alpine Go
  • High 7.5
    CVE-2022-27191

    golang.org/x/crypto/ssh Denial of service via crafted Signer

    The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey.

    go k3d k3d-proxy k3d-tools Debian Ubuntu Alpine Wolfi Go
  • High 7.1
    CVE-2022-2990

    Buildah's incorrect handling of the supplementary groups may lead to data disclosure, modification

    An incorrect handling of the supplementary groups in the Buildah container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used t…

    buildah buildah golang-github-containers-buildah golang-github-containers-buildah Debian Ubuntu Azure Linux Alpine Go
  • Medium 5.9
    CVE-2022-29162

    Incorrect Default Permissions in runc

    runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. A bug was found in runc prior to version 1.1.2 where `runc exec --cap` created processes with non-empty inheritable Linux process capabilities, creating an aty…

    opencontainers runc ctop podman Debian Ubuntu Azure Linux Alpine Wolfi Go
  • Low 3.0
    CVE-2021-41190

    Clarify Content-Type handling in OCI spec

    The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution of content. In the OCI Distribution Specification version 1.0.0 and prior, the Content-Type header alone was used to determine the type of document during…

    opencontainers distribution-spec buildah docker.io Ubuntu Azure Linux Alpine Go
  • Unscored —
    CVE-2021-36221

    Panic in ReverseProxy in net/http/httputil

    Go before 1.15.15 and 1.16.x before 1.16.7 has a race condition that can lead to a net/http/httputil ReverseProxy panic upon an ErrAbortHandler abort.

    go stdlib golang-1.8 golang-1.13 Debian Ubuntu Alpine Go

References

  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1820551
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1941727
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1945929
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1974423
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1995656
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1996050
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2005866
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2009264
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2009346
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2024938
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2027662
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2028408
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2030195
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2039045
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2052697
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2053990
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2055313
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2059666
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2062697
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2064702
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2066145
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2068006
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2072452
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2073958
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2078925
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2079759
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2079761
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2081836
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2083570
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2083997
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2085361
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2086398
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2086757
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2090609
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2090920
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2093079
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2094610
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2094875
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2095097