Headline

Red Hat Security Advisory 2022-4651-01

Red Hat Security Advisory 2022-4651-01 - The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Issues addressed include a privilege escalation vulnerability.

2 years ago

Packet Storm

Open in Source

#vulnerability #linux #red_hat #js #git #docker

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

====================================================================
Red Hat Security Advisory

Synopsis: Important: container-tools:2.0 security update
Advisory ID: RHSA-2022:4651-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2022:4651
Issue date: 2022-05-18
CVE Names: CVE-2022-1227 CVE-2022-27649 CVE-2022-27651
====================================================================

Summary:

An update for the container-tools:2.0 module is now available for Red Hat
Enterprise Linux 8.2 Extended Update Support.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

Relevant releases/architectures:

Red Hat Enterprise Linux AppStream EUS (v. 8.2) - aarch64, noarch, ppc64le, s390x, x86_64

Description:

The container-tools module contains tools for working with containers,
notably podman, buildah, skopeo, and runc.

Security Fix(es):

psgo: Privilege escalation in ‘podman top’ (CVE-2022-1227)
podman: Default inheritable capabilities for linux container should be
empty (CVE-2022-27649)
buildah: Default inheritable capabilities for linux container should be
empty (CVE-2022-27651)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

Bugs fixed (https://bugzilla.redhat.com/):

2066568 - CVE-2022-27649 podman: Default inheritable capabilities for linux container should be empty
2066840 - CVE-2022-27651 buildah: Default inheritable capabilities for linux container should be empty
2070368 - CVE-2022-1227 psgo: Privilege escalation in ‘podman top’

Package List:

Red Hat Enterprise Linux AppStream EUS (v. 8.2):

Source:
buildah-1.11.6-8.module+el8.2.0+14896+bf621b2a.src.rpm
cockpit-podman-11-1.module+el8.2.0+14896+bf621b2a.src.rpm
conmon-2.0.6-1.module+el8.2.0+14896+bf621b2a.src.rpm
container-selinux-2.124.0-1.module+el8.2.0+14896+bf621b2a.src.rpm
containernetworking-plugins-0.8.3-4.module+el8.2.0+14896+bf621b2a.src.rpm
criu-3.12-9.module+el8.2.0+14896+bf621b2a.src.rpm
fuse-overlayfs-0.7.2-5.module+el8.2.0+14896+bf621b2a.src.rpm
podman-1.6.4-24.module+el8.2.0+14896+bf621b2a.src.rpm
python-podman-api-1.2.0-0.2.gitd0a45fe.module+el8.2.0+14896+bf621b2a.src.rpm
runc-1.0.0-65.rc10.module+el8.2.0+14896+bf621b2a.src.rpm
skopeo-0.1.40-9.module+el8.2.0+14896+bf621b2a.src.rpm
slirp4netns-0.4.2-3.git21fdece.module+el8.2.0+14896+bf621b2a.src.rpm
toolbox-0.0.7-1.module+el8.2.0+14896+bf621b2a.src.rpm
udica-0.2.1-2.module+el8.2.0+14896+bf621b2a.src.rpm

aarch64:
buildah-1.11.6-8.module+el8.2.0+14896+bf621b2a.aarch64.rpm
buildah-debuginfo-1.11.6-8.module+el8.2.0+14896+bf621b2a.aarch64.rpm
buildah-debugsource-1.11.6-8.module+el8.2.0+14896+bf621b2a.aarch64.rpm
buildah-tests-1.11.6-8.module+el8.2.0+14896+bf621b2a.aarch64.rpm
buildah-tests-debuginfo-1.11.6-8.module+el8.2.0+14896+bf621b2a.aarch64.rpm
conmon-2.0.6-1.module+el8.2.0+14896+bf621b2a.aarch64.rpm
containernetworking-plugins-0.8.3-4.module+el8.2.0+14896+bf621b2a.aarch64.rpm
containernetworking-plugins-debuginfo-0.8.3-4.module+el8.2.0+14896+bf621b2a.aarch64.rpm
containernetworking-plugins-debugsource-0.8.3-4.module+el8.2.0+14896+bf621b2a.aarch64.rpm
containers-common-0.1.40-9.module+el8.2.0+14896+bf621b2a.aarch64.rpm
crit-3.12-9.module+el8.2.0+14896+bf621b2a.aarch64.rpm
criu-3.12-9.module+el8.2.0+14896+bf621b2a.aarch64.rpm
criu-debuginfo-3.12-9.module+el8.2.0+14896+bf621b2a.aarch64.rpm
criu-debugsource-3.12-9.module+el8.2.0+14896+bf621b2a.aarch64.rpm
fuse-overlayfs-0.7.2-5.module+el8.2.0+14896+bf621b2a.aarch64.rpm
fuse-overlayfs-debuginfo-0.7.2-5.module+el8.2.0+14896+bf621b2a.aarch64.rpm
fuse-overlayfs-debugsource-0.7.2-5.module+el8.2.0+14896+bf621b2a.aarch64.rpm
podman-1.6.4-24.module+el8.2.0+14896+bf621b2a.aarch64.rpm
podman-debuginfo-1.6.4-24.module+el8.2.0+14896+bf621b2a.aarch64.rpm
podman-debugsource-1.6.4-24.module+el8.2.0+14896+bf621b2a.aarch64.rpm
podman-remote-1.6.4-24.module+el8.2.0+14896+bf621b2a.aarch64.rpm
podman-remote-debuginfo-1.6.4-24.module+el8.2.0+14896+bf621b2a.aarch64.rpm
podman-tests-1.6.4-24.module+el8.2.0+14896+bf621b2a.aarch64.rpm
python3-criu-3.12-9.module+el8.2.0+14896+bf621b2a.aarch64.rpm
runc-1.0.0-65.rc10.module+el8.2.0+14896+bf621b2a.aarch64.rpm
runc-debuginfo-1.0.0-65.rc10.module+el8.2.0+14896+bf621b2a.aarch64.rpm
runc-debugsource-1.0.0-65.rc10.module+el8.2.0+14896+bf621b2a.aarch64.rpm
skopeo-0.1.40-9.module+el8.2.0+14896+bf621b2a.aarch64.rpm
skopeo-debuginfo-0.1.40-9.module+el8.2.0+14896+bf621b2a.aarch64.rpm
skopeo-debugsource-0.1.40-9.module+el8.2.0+14896+bf621b2a.aarch64.rpm
skopeo-tests-0.1.40-9.module+el8.2.0+14896+bf621b2a.aarch64.rpm
slirp4netns-0.4.2-3.git21fdece.module+el8.2.0+14896+bf621b2a.aarch64.rpm
slirp4netns-debuginfo-0.4.2-3.git21fdece.module+el8.2.0+14896+bf621b2a.aarch64.rpm
slirp4netns-debugsource-0.4.2-3.git21fdece.module+el8.2.0+14896+bf621b2a.aarch64.rpm

noarch:
cockpit-podman-11-1.module+el8.2.0+14896+bf621b2a.noarch.rpm
container-selinux-2.124.0-1.module+el8.2.0+14896+bf621b2a.noarch.rpm
podman-docker-1.6.4-24.module+el8.2.0+14896+bf621b2a.noarch.rpm
python-podman-api-1.2.0-0.2.gitd0a45fe.module+el8.2.0+14896+bf621b2a.noarch.rpm
toolbox-0.0.7-1.module+el8.2.0+14896+bf621b2a.noarch.rpm
udica-0.2.1-2.module+el8.2.0+14896+bf621b2a.noarch.rpm

ppc64le:
buildah-1.11.6-8.module+el8.2.0+14896+bf621b2a.ppc64le.rpm
buildah-debuginfo-1.11.6-8.module+el8.2.0+14896+bf621b2a.ppc64le.rpm
buildah-debugsource-1.11.6-8.module+el8.2.0+14896+bf621b2a.ppc64le.rpm
buildah-tests-1.11.6-8.module+el8.2.0+14896+bf621b2a.ppc64le.rpm
buildah-tests-debuginfo-1.11.6-8.module+el8.2.0+14896+bf621b2a.ppc64le.rpm
conmon-2.0.6-1.module+el8.2.0+14896+bf621b2a.ppc64le.rpm
containernetworking-plugins-0.8.3-4.module+el8.2.0+14896+bf621b2a.ppc64le.rpm
containernetworking-plugins-debuginfo-0.8.3-4.module+el8.2.0+14896+bf621b2a.ppc64le.rpm
containernetworking-plugins-debugsource-0.8.3-4.module+el8.2.0+14896+bf621b2a.ppc64le.rpm
containers-common-0.1.40-9.module+el8.2.0+14896+bf621b2a.ppc64le.rpm
crit-3.12-9.module+el8.2.0+14896+bf621b2a.ppc64le.rpm
criu-3.12-9.module+el8.2.0+14896+bf621b2a.ppc64le.rpm
criu-debuginfo-3.12-9.module+el8.2.0+14896+bf621b2a.ppc64le.rpm
criu-debugsource-3.12-9.module+el8.2.0+14896+bf621b2a.ppc64le.rpm
fuse-overlayfs-0.7.2-5.module+el8.2.0+14896+bf621b2a.ppc64le.rpm
fuse-overlayfs-debuginfo-0.7.2-5.module+el8.2.0+14896+bf621b2a.ppc64le.rpm
fuse-overlayfs-debugsource-0.7.2-5.module+el8.2.0+14896+bf621b2a.ppc64le.rpm
podman-1.6.4-24.module+el8.2.0+14896+bf621b2a.ppc64le.rpm
podman-debuginfo-1.6.4-24.module+el8.2.0+14896+bf621b2a.ppc64le.rpm
podman-debugsource-1.6.4-24.module+el8.2.0+14896+bf621b2a.ppc64le.rpm
podman-remote-1.6.4-24.module+el8.2.0+14896+bf621b2a.ppc64le.rpm
podman-remote-debuginfo-1.6.4-24.module+el8.2.0+14896+bf621b2a.ppc64le.rpm
podman-tests-1.6.4-24.module+el8.2.0+14896+bf621b2a.ppc64le.rpm
python3-criu-3.12-9.module+el8.2.0+14896+bf621b2a.ppc64le.rpm
runc-1.0.0-65.rc10.module+el8.2.0+14896+bf621b2a.ppc64le.rpm
runc-debuginfo-1.0.0-65.rc10.module+el8.2.0+14896+bf621b2a.ppc64le.rpm
runc-debugsource-1.0.0-65.rc10.module+el8.2.0+14896+bf621b2a.ppc64le.rpm
skopeo-0.1.40-9.module+el8.2.0+14896+bf621b2a.ppc64le.rpm
skopeo-debuginfo-0.1.40-9.module+el8.2.0+14896+bf621b2a.ppc64le.rpm
skopeo-debugsource-0.1.40-9.module+el8.2.0+14896+bf621b2a.ppc64le.rpm
skopeo-tests-0.1.40-9.module+el8.2.0+14896+bf621b2a.ppc64le.rpm
slirp4netns-0.4.2-3.git21fdece.module+el8.2.0+14896+bf621b2a.ppc64le.rpm
slirp4netns-debuginfo-0.4.2-3.git21fdece.module+el8.2.0+14896+bf621b2a.ppc64le.rpm
slirp4netns-debugsource-0.4.2-3.git21fdece.module+el8.2.0+14896+bf621b2a.ppc64le.rpm

s390x:
buildah-1.11.6-8.module+el8.2.0+14896+bf621b2a.s390x.rpm
buildah-debuginfo-1.11.6-8.module+el8.2.0+14896+bf621b2a.s390x.rpm
buildah-debugsource-1.11.6-8.module+el8.2.0+14896+bf621b2a.s390x.rpm
buildah-tests-1.11.6-8.module+el8.2.0+14896+bf621b2a.s390x.rpm
buildah-tests-debuginfo-1.11.6-8.module+el8.2.0+14896+bf621b2a.s390x.rpm
conmon-2.0.6-1.module+el8.2.0+14896+bf621b2a.s390x.rpm
containernetworking-plugins-0.8.3-4.module+el8.2.0+14896+bf621b2a.s390x.rpm
containernetworking-plugins-debuginfo-0.8.3-4.module+el8.2.0+14896+bf621b2a.s390x.rpm
containernetworking-plugins-debugsource-0.8.3-4.module+el8.2.0+14896+bf621b2a.s390x.rpm
containers-common-0.1.40-9.module+el8.2.0+14896+bf621b2a.s390x.rpm
crit-3.12-9.module+el8.2.0+14896+bf621b2a.s390x.rpm
criu-3.12-9.module+el8.2.0+14896+bf621b2a.s390x.rpm
criu-debuginfo-3.12-9.module+el8.2.0+14896+bf621b2a.s390x.rpm
criu-debugsource-3.12-9.module+el8.2.0+14896+bf621b2a.s390x.rpm
fuse-overlayfs-0.7.2-5.module+el8.2.0+14896+bf621b2a.s390x.rpm
fuse-overlayfs-debuginfo-0.7.2-5.module+el8.2.0+14896+bf621b2a.s390x.rpm
fuse-overlayfs-debugsource-0.7.2-5.module+el8.2.0+14896+bf621b2a.s390x.rpm
podman-1.6.4-24.module+el8.2.0+14896+bf621b2a.s390x.rpm
podman-debuginfo-1.6.4-24.module+el8.2.0+14896+bf621b2a.s390x.rpm
podman-debugsource-1.6.4-24.module+el8.2.0+14896+bf621b2a.s390x.rpm
podman-remote-1.6.4-24.module+el8.2.0+14896+bf621b2a.s390x.rpm
podman-remote-debuginfo-1.6.4-24.module+el8.2.0+14896+bf621b2a.s390x.rpm
podman-tests-1.6.4-24.module+el8.2.0+14896+bf621b2a.s390x.rpm
python3-criu-3.12-9.module+el8.2.0+14896+bf621b2a.s390x.rpm
runc-1.0.0-65.rc10.module+el8.2.0+14896+bf621b2a.s390x.rpm
runc-debuginfo-1.0.0-65.rc10.module+el8.2.0+14896+bf621b2a.s390x.rpm
runc-debugsource-1.0.0-65.rc10.module+el8.2.0+14896+bf621b2a.s390x.rpm
skopeo-0.1.40-9.module+el8.2.0+14896+bf621b2a.s390x.rpm
skopeo-debuginfo-0.1.40-9.module+el8.2.0+14896+bf621b2a.s390x.rpm
skopeo-debugsource-0.1.40-9.module+el8.2.0+14896+bf621b2a.s390x.rpm
skopeo-tests-0.1.40-9.module+el8.2.0+14896+bf621b2a.s390x.rpm
slirp4netns-0.4.2-3.git21fdece.module+el8.2.0+14896+bf621b2a.s390x.rpm
slirp4netns-debuginfo-0.4.2-3.git21fdece.module+el8.2.0+14896+bf621b2a.s390x.rpm
slirp4netns-debugsource-0.4.2-3.git21fdece.module+el8.2.0+14896+bf621b2a.s390x.rpm

x86_64:
buildah-1.11.6-8.module+el8.2.0+14896+bf621b2a.x86_64.rpm
buildah-debuginfo-1.11.6-8.module+el8.2.0+14896+bf621b2a.x86_64.rpm
buildah-debugsource-1.11.6-8.module+el8.2.0+14896+bf621b2a.x86_64.rpm
buildah-tests-1.11.6-8.module+el8.2.0+14896+bf621b2a.x86_64.rpm
buildah-tests-debuginfo-1.11.6-8.module+el8.2.0+14896+bf621b2a.x86_64.rpm
conmon-2.0.6-1.module+el8.2.0+14896+bf621b2a.x86_64.rpm
containernetworking-plugins-0.8.3-4.module+el8.2.0+14896+bf621b2a.x86_64.rpm
containernetworking-plugins-debuginfo-0.8.3-4.module+el8.2.0+14896+bf621b2a.x86_64.rpm
containernetworking-plugins-debugsource-0.8.3-4.module+el8.2.0+14896+bf621b2a.x86_64.rpm
containers-common-0.1.40-9.module+el8.2.0+14896+bf621b2a.x86_64.rpm
crit-3.12-9.module+el8.2.0+14896+bf621b2a.x86_64.rpm
criu-3.12-9.module+el8.2.0+14896+bf621b2a.x86_64.rpm
criu-debuginfo-3.12-9.module+el8.2.0+14896+bf621b2a.x86_64.rpm
criu-debugsource-3.12-9.module+el8.2.0+14896+bf621b2a.x86_64.rpm
fuse-overlayfs-0.7.2-5.module+el8.2.0+14896+bf621b2a.x86_64.rpm
fuse-overlayfs-debuginfo-0.7.2-5.module+el8.2.0+14896+bf621b2a.x86_64.rpm
fuse-overlayfs-debugsource-0.7.2-5.module+el8.2.0+14896+bf621b2a.x86_64.rpm
podman-1.6.4-24.module+el8.2.0+14896+bf621b2a.x86_64.rpm
podman-debuginfo-1.6.4-24.module+el8.2.0+14896+bf621b2a.x86_64.rpm
podman-debugsource-1.6.4-24.module+el8.2.0+14896+bf621b2a.x86_64.rpm
podman-remote-1.6.4-24.module+el8.2.0+14896+bf621b2a.x86_64.rpm
podman-remote-debuginfo-1.6.4-24.module+el8.2.0+14896+bf621b2a.x86_64.rpm
podman-tests-1.6.4-24.module+el8.2.0+14896+bf621b2a.x86_64.rpm
python3-criu-3.12-9.module+el8.2.0+14896+bf621b2a.x86_64.rpm
runc-1.0.0-65.rc10.module+el8.2.0+14896+bf621b2a.x86_64.rpm
runc-debuginfo-1.0.0-65.rc10.module+el8.2.0+14896+bf621b2a.x86_64.rpm
runc-debugsource-1.0.0-65.rc10.module+el8.2.0+14896+bf621b2a.x86_64.rpm
skopeo-0.1.40-9.module+el8.2.0+14896+bf621b2a.x86_64.rpm
skopeo-debuginfo-0.1.40-9.module+el8.2.0+14896+bf621b2a.x86_64.rpm
skopeo-debugsource-0.1.40-9.module+el8.2.0+14896+bf621b2a.x86_64.rpm
skopeo-tests-0.1.40-9.module+el8.2.0+14896+bf621b2a.x86_64.rpm
slirp4netns-0.4.2-3.git21fdece.module+el8.2.0+14896+bf621b2a.x86_64.rpm
slirp4netns-debuginfo-0.4.2-3.git21fdece.module+el8.2.0+14896+bf621b2a.x86_64.rpm
slirp4netns-debugsource-0.4.2-3.git21fdece.module+el8.2.0+14896+bf621b2a.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

References:

https://access.redhat.com/security/cve/CVE-2022-1227
https://access.redhat.com/security/cve/CVE-2022-27649
https://access.redhat.com/security/cve/CVE-2022-27651
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/security/cve/cve-2022-1227
https://access.redhat.com/security/cve/cve-2022-27649
https://access.redhat.com/security/cve/cve-2022-27651

Contact:

The Red Hat security contact is [email protected]. More contact
details at https://access.redhat.com/security/team/contact/

iQIVAwUBYoWMsdzjgjWX9erEAQhnUA//c+KE1m9Vd3QLQ20ai1Y+EHG6aGLT4QY0
/ZW6vyN/2kLRYiOh5O+RGurLQE7IPmfJHWTuHzWylIvAdNw9B3/lo7G3oupIv8k9
YfP6PgbLW/jDisXDPK40L+u68/YkWTO/yToiavnyhf1C13ISM5KtKV1FDS1Wuh5b
AfYySN5H79o+K6IyLRcnqem1sTr4NYYuta8lFmoFVlXD9JF/85Lw9dEC7IuCKKuT
gvmjj0a76klTQvuaKV7IzauNG/QnyU6LiiIApihTQNINwjovdm72WhvNJ0lSiFR8
KJA3shiVwVD3MMNOW7n1/cR1lSCLAt1AovLb31j0WKUED6UMrMn4oLgJm7SvfRRU
SxyRZ9DSo+Izyjv3fVCS2Lpd5dQ5n9B6UKIEUGSWGOUOdcOQ4Xpd7ziYevFaFkXf
uTY2GLhsv3vN9PBYATDTKoehTvhpg13ngwSA4YKGDq2fAJ8RDuy8G6LoYsW32/D1
aG0FAZvYMt/dI0Z65Htqo0lOdsC/M94MiSXJujKHe5TIMD+zT46P//1dWMzHLbfJ
TFlHCl5bK0CkfmRYKYTHw0ACnTbImSQ+HAo6mi8gKkrheOSOi9djZjZFRO8dM2PE
uK633gci0fn9zCB7gTUpu/jQ9MyAjSr+AI9AJPvEFkfhWhly6pjh+yBllX2Fgxz9
gR7CvwQYiEA=fHV+
-----END PGP SIGNATURE-----
–
RHSA-announce mailing list
[email protected]
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Related news

Red Hat Security Advisory 2022-5622-01

Red Hat Security Advisory 2022-5622-01 - The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Issues addressed include a privilege escalation vulnerability.

2 years ago

Packet Storm

Open in Source

#vulnerability #linux #red_hat #docker

RHSA-2022:5622: Red Hat Security Advisory: container-tools:rhel8 security and bug fix update

An update for the container-tools:rhel8 module is now available for Red Hat Enterprise Linux 8.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-1227: psgo: Privilege escalation in 'podman top'

2 years ago

Red Hat Security Data

Open in Source

#vulnerability #linux #red_hat #ibm #docker #sap

Red Hat Security Advisory 2022-4816-01

Red Hat Security Advisory 2022-4816-01 - The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Issues addressed include a privilege escalation vulnerability.

2 years ago

Packet Storm

Open in Source

#vulnerability #linux #red_hat #js #pdf #docker

RHSA-2022:4816: Red Hat Security Advisory: container-tools:3.0 security update

An update for the container-tools:3.0 module is now available for Red Hat Enterprise Linux 8.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-1227: psgo: Privilege escalation in 'podman top' * CVE-2022-27649: podman: Default inheritable capabilities for linux container should be empty * CVE-2022-27651: buildah: Default inheritable capabilities for linux container should be empty

2 years ago

Red Hat Security Data

Open in Source

#vulnerability #linux #red_hat #ibm #docker #sap

Red Hat Security Advisory 2022-2263-01

Red Hat Security Advisory 2022-2263-01 - Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.6.58. Issues addressed include a privilege escalation vulnerability.

2 years ago

Packet Storm

Open in Source

#vulnerability #red_hat #js #kubernetes #rpm #docker

RHSA-2022:2263: Red Hat Security Advisory: OpenShift Container Platform 4.6.58 packages and security update

Red Hat OpenShift Container Platform release 4.6.58 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-1227: psgo: Privilege escalation in 'podman top'

2 years ago

Red Hat Security Data

Open in Source

#vulnerability #web #linux #red_hat #nodejs #js #java #kubernetes #aws #ibm #rpm #docker

RHSA-2022:4651: Red Hat Security Advisory: container-tools:2.0 security update

An update for the container-tools:2.0 module is now available for Red Hat Enterprise Linux 8.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-1227: psgo: Privilege escalation in 'podman top' * CVE-2022-27649: podman: Default inheritable capabilities for linux container should be empty * CVE-2022-27651: buildah: Default inheritable capabilities for linux container should be empty

2 years ago

Red Hat Security Data

Open in Source

#vulnerability #linux #red_hat #git #ibm #docker #sap

RHSA-2022:4651: Red Hat Security Advisory: container-tools:2.0 security update

2 years ago

Red Hat Security Data

Open in Source

#vulnerability #linux #red_hat #git #ibm #docker #sap

RHSA-2022:4651: Red Hat Security Advisory: container-tools:2.0 security update

2 years ago

Red Hat Security Data

Open in Source

#vulnerability #linux #red_hat #git #ibm #docker #sap

RHSA-2022:2190: Red Hat Security Advisory: podman security update

An update for podman is now available for Red Hat Enterprise Linux 7 Extras. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-1227: psgo: Privilege escalation in 'podman top'

2 years ago

Red Hat Security Data

Open in Source

#vulnerability #web #linux #red_hat #nodejs #js #java #kubernetes #aws #ibm #docker

Red Hat Security Advisory 2022-2143-01

Red Hat Security Advisory 2022-2143-01 - The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Issues addressed include a privilege escalation vulnerability.

2 years ago

Packet Storm

Open in Source

#vulnerability #linux #red_hat #docker

RHSA-2022:2143: Red Hat Security Advisory: container-tools:3.0 security update

An update for the container-tools:3.0 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-1227: psgo: Privilege escalation in 'podman top'

2 years ago

Red Hat Security Data

Open in Source

#vulnerability #linux #red_hat #ibm #docker #sap

RHSA-2022:1762: Red Hat Security Advisory: container-tools:rhel8 security, bug fix, and enhancement update

An update for the container-tools:rhel8 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-1227: psgo: Privilege escalation in 'podman top' * CVE-2022-21698: prometheus/client_golang: Denial of service using InstrumentHandlerCounter * CVE-2022-27649: podman: Default inheritable capabilities for linux container should be empty * CVE-2022-27650: crun: Default inheritable capabilities for linux container should be empty...

2 years ago

Red Hat Security Data

Open in Source

#vulnerability #linux #red_hat #dos #ibm #docker #sap

RHSA-2022:1762: Red Hat Security Advisory: container-tools:rhel8 security, bug fix, and enhancement update

2 years ago

Red Hat Security Data

Open in Source

#vulnerability #linux #red_hat #dos #ibm #docker #sap

RHSA-2022:1762: Red Hat Security Advisory: container-tools:rhel8 security, bug fix, and enhancement update

2 years ago

Red Hat Security Data

Open in Source

#vulnerability #linux #red_hat #dos #ibm #docker #sap

GHSA-66vw-v2x9-hw75: Podman publishes a malicious image to public registries

Podman is a tool for managing OCI containers and pods. A privilege escalation flaw was found in Podman. This flaw allows an attacker to publish a malicious image to a public registry. Once this image is downloaded by a potential victim, the vulnerability is triggered after a user runs the 'podman top' command. This action gives the attacker access to the host filesystem, leading to information disclosure or denial of service.

2 years ago

ghsa

Open in Source

#vulnerability #dos #git

CVE-2022-1227: Invalid Bug ID

A privilege escalation flaw was found in Podman. This flaw allows an attacker to publish a malicious image to a public registry. Once this image is downloaded by a potential victim, the vulnerability is triggered after a user runs the 'podman top' command. This action gives the attacker access to the host filesystem, leading to information disclosure or denial of service.

2 years ago

CVE

Open in Source

#vulnerability #dos

CVE-2022-27649: Invalid Bug ID

A flaw was found in Podman, where containers were started incorrectly with non-empty default permissions. A vulnerability was found in Moby (Docker Engine), where containers were started incorrectly with non-empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs.

2 years ago

CVE

Open in Source

#vulnerability #linux #docker

CVE-2022-27651: do not set the inheritable capabilities · containers/buildah@e7e55c9

A flaw was found in buildah where containers were incorrectly started with non-empty default permissions. A bug was found in Moby (Docker Engine) where containers were incorrectly started with non-empty inheritable Linux process capabilities, enabling an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs. This has the potential to impact confidentiality and integrity.

2 years ago

CVE

Open in Source

#linux #docker