Headline
Red Hat Security Advisory 2022-4816-01
Red Hat Security Advisory 2022-4816-01 - The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Issues addressed include a privilege escalation vulnerability.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
====================================================================
Red Hat Security Advisory
Synopsis: Important: container-tools:3.0 security update
Advisory ID: RHSA-2022:4816-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2022:4816
Issue date: 2022-05-31
CVE Names: CVE-2022-1227 CVE-2022-27649 CVE-2022-27651
====================================================================
- Summary:
An update for the container-tools:3.0 module is now available for Red Hat
Enterprise Linux 8.4 Extended Update Support.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
- Relevant releases/architectures:
Red Hat Enterprise Linux AppStream EUS (v.8.4) - aarch64, noarch, ppc64le, s390x, x86_64
- Description:
The container-tools module contains tools for working with containers,
notably podman, buildah, skopeo, and runc.
Security Fix(es):
psgo: Privilege escalation in ‘podman top’ (CVE-2022-1227)
podman: Default inheritable capabilities for linux container should be
empty (CVE-2022-27649)buildah: Default inheritable capabilities for linux container should be
empty (CVE-2022-27651)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
- Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
- Bugs fixed (https://bugzilla.redhat.com/):
1972343 - podman’s image index corrupted during WAN emulation tests [rhel-8.4.0.z]
2066568 - CVE-2022-27649 podman: Default inheritable capabilities for linux container should be empty
2066840 - CVE-2022-27651 buildah: Default inheritable capabilities for linux container should be empty
2070368 - CVE-2022-1227 psgo: Privilege escalation in ‘podman top’
- Package List:
Red Hat Enterprise Linux AppStream EUS (v.8.4):
Source:
buildah-1.19.9-1.module+el8.4.0+14872+9efa52a3.src.rpm
cockpit-podman-29-2.module+el8.4.0+14872+9efa52a3.src.rpm
conmon-2.0.26-1.module+el8.4.0+14872+9efa52a3.src.rpm
container-selinux-2.167.0-1.module+el8.4.0+14872+9efa52a3.src.rpm
containernetworking-plugins-0.9.1-1.module+el8.4.0+14872+9efa52a3.src.rpm
criu-3.15-1.module+el8.4.0+14872+9efa52a3.src.rpm
crun-0.18-2.module+el8.4.0+14872+9efa52a3.src.rpm
fuse-overlayfs-1.4.0-2.module+el8.4.0+14872+9efa52a3.src.rpm
libslirp-4.3.1-1.module+el8.4.0+14872+9efa52a3.src.rpm
oci-seccomp-bpf-hook-1.2.0-1.module+el8.4.0+14872+9efa52a3.src.rpm
podman-3.0.1-9.module+el8.4.0+14872+9efa52a3.src.rpm
runc-1.0.0-76.rc95.module+el8.4.0+14872+9efa52a3.src.rpm
skopeo-1.2.2-8.module+el8.4.0+14872+9efa52a3.src.rpm
slirp4netns-1.1.8-1.module+el8.4.0+14872+9efa52a3.src.rpm
toolbox-0.0.8-1.module+el8.4.0+14872+9efa52a3.src.rpm
udica-0.2.4-1.module+el8.4.0+14872+9efa52a3.src.rpm
aarch64:
buildah-1.19.9-1.module+el8.4.0+14872+9efa52a3.aarch64.rpm
buildah-debuginfo-1.19.9-1.module+el8.4.0+14872+9efa52a3.aarch64.rpm
buildah-debugsource-1.19.9-1.module+el8.4.0+14872+9efa52a3.aarch64.rpm
buildah-tests-1.19.9-1.module+el8.4.0+14872+9efa52a3.aarch64.rpm
buildah-tests-debuginfo-1.19.9-1.module+el8.4.0+14872+9efa52a3.aarch64.rpm
conmon-2.0.26-1.module+el8.4.0+14872+9efa52a3.aarch64.rpm
conmon-debuginfo-2.0.26-1.module+el8.4.0+14872+9efa52a3.aarch64.rpm
conmon-debugsource-2.0.26-1.module+el8.4.0+14872+9efa52a3.aarch64.rpm
containernetworking-plugins-0.9.1-1.module+el8.4.0+14872+9efa52a3.aarch64.rpm
containernetworking-plugins-debuginfo-0.9.1-1.module+el8.4.0+14872+9efa52a3.aarch64.rpm
containernetworking-plugins-debugsource-0.9.1-1.module+el8.4.0+14872+9efa52a3.aarch64.rpm
containers-common-1.2.2-8.module+el8.4.0+14872+9efa52a3.aarch64.rpm
crit-3.15-1.module+el8.4.0+14872+9efa52a3.aarch64.rpm
criu-3.15-1.module+el8.4.0+14872+9efa52a3.aarch64.rpm
criu-debuginfo-3.15-1.module+el8.4.0+14872+9efa52a3.aarch64.rpm
criu-debugsource-3.15-1.module+el8.4.0+14872+9efa52a3.aarch64.rpm
crun-0.18-2.module+el8.4.0+14872+9efa52a3.aarch64.rpm
crun-debuginfo-0.18-2.module+el8.4.0+14872+9efa52a3.aarch64.rpm
crun-debugsource-0.18-2.module+el8.4.0+14872+9efa52a3.aarch64.rpm
fuse-overlayfs-1.4.0-2.module+el8.4.0+14872+9efa52a3.aarch64.rpm
fuse-overlayfs-debuginfo-1.4.0-2.module+el8.4.0+14872+9efa52a3.aarch64.rpm
fuse-overlayfs-debugsource-1.4.0-2.module+el8.4.0+14872+9efa52a3.aarch64.rpm
libslirp-4.3.1-1.module+el8.4.0+14872+9efa52a3.aarch64.rpm
libslirp-debuginfo-4.3.1-1.module+el8.4.0+14872+9efa52a3.aarch64.rpm
libslirp-debugsource-4.3.1-1.module+el8.4.0+14872+9efa52a3.aarch64.rpm
libslirp-devel-4.3.1-1.module+el8.4.0+14872+9efa52a3.aarch64.rpm
oci-seccomp-bpf-hook-1.2.0-1.module+el8.4.0+14872+9efa52a3.aarch64.rpm
oci-seccomp-bpf-hook-debuginfo-1.2.0-1.module+el8.4.0+14872+9efa52a3.aarch64.rpm
oci-seccomp-bpf-hook-debugsource-1.2.0-1.module+el8.4.0+14872+9efa52a3.aarch64.rpm
podman-3.0.1-9.module+el8.4.0+14872+9efa52a3.aarch64.rpm
podman-catatonit-3.0.1-9.module+el8.4.0+14872+9efa52a3.aarch64.rpm
podman-catatonit-debuginfo-3.0.1-9.module+el8.4.0+14872+9efa52a3.aarch64.rpm
podman-debuginfo-3.0.1-9.module+el8.4.0+14872+9efa52a3.aarch64.rpm
podman-debugsource-3.0.1-9.module+el8.4.0+14872+9efa52a3.aarch64.rpm
podman-plugins-3.0.1-9.module+el8.4.0+14872+9efa52a3.aarch64.rpm
podman-plugins-debuginfo-3.0.1-9.module+el8.4.0+14872+9efa52a3.aarch64.rpm
podman-remote-3.0.1-9.module+el8.4.0+14872+9efa52a3.aarch64.rpm
podman-remote-debuginfo-3.0.1-9.module+el8.4.0+14872+9efa52a3.aarch64.rpm
podman-tests-3.0.1-9.module+el8.4.0+14872+9efa52a3.aarch64.rpm
python3-criu-3.15-1.module+el8.4.0+14872+9efa52a3.aarch64.rpm
runc-1.0.0-76.rc95.module+el8.4.0+14872+9efa52a3.aarch64.rpm
runc-debuginfo-1.0.0-76.rc95.module+el8.4.0+14872+9efa52a3.aarch64.rpm
runc-debugsource-1.0.0-76.rc95.module+el8.4.0+14872+9efa52a3.aarch64.rpm
skopeo-1.2.2-8.module+el8.4.0+14872+9efa52a3.aarch64.rpm
skopeo-debuginfo-1.2.2-8.module+el8.4.0+14872+9efa52a3.aarch64.rpm
skopeo-debugsource-1.2.2-8.module+el8.4.0+14872+9efa52a3.aarch64.rpm
skopeo-tests-1.2.2-8.module+el8.4.0+14872+9efa52a3.aarch64.rpm
slirp4netns-1.1.8-1.module+el8.4.0+14872+9efa52a3.aarch64.rpm
slirp4netns-debuginfo-1.1.8-1.module+el8.4.0+14872+9efa52a3.aarch64.rpm
slirp4netns-debugsource-1.1.8-1.module+el8.4.0+14872+9efa52a3.aarch64.rpm
noarch:
cockpit-podman-29-2.module+el8.4.0+14872+9efa52a3.noarch.rpm
container-selinux-2.167.0-1.module+el8.4.0+14872+9efa52a3.noarch.rpm
podman-docker-3.0.1-9.module+el8.4.0+14872+9efa52a3.noarch.rpm
toolbox-0.0.8-1.module+el8.4.0+14872+9efa52a3.noarch.rpm
udica-0.2.4-1.module+el8.4.0+14872+9efa52a3.noarch.rpm
ppc64le:
buildah-1.19.9-1.module+el8.4.0+14872+9efa52a3.ppc64le.rpm
buildah-debuginfo-1.19.9-1.module+el8.4.0+14872+9efa52a3.ppc64le.rpm
buildah-debugsource-1.19.9-1.module+el8.4.0+14872+9efa52a3.ppc64le.rpm
buildah-tests-1.19.9-1.module+el8.4.0+14872+9efa52a3.ppc64le.rpm
buildah-tests-debuginfo-1.19.9-1.module+el8.4.0+14872+9efa52a3.ppc64le.rpm
conmon-2.0.26-1.module+el8.4.0+14872+9efa52a3.ppc64le.rpm
conmon-debuginfo-2.0.26-1.module+el8.4.0+14872+9efa52a3.ppc64le.rpm
conmon-debugsource-2.0.26-1.module+el8.4.0+14872+9efa52a3.ppc64le.rpm
containernetworking-plugins-0.9.1-1.module+el8.4.0+14872+9efa52a3.ppc64le.rpm
containernetworking-plugins-debuginfo-0.9.1-1.module+el8.4.0+14872+9efa52a3.ppc64le.rpm
containernetworking-plugins-debugsource-0.9.1-1.module+el8.4.0+14872+9efa52a3.ppc64le.rpm
containers-common-1.2.2-8.module+el8.4.0+14872+9efa52a3.ppc64le.rpm
crit-3.15-1.module+el8.4.0+14872+9efa52a3.ppc64le.rpm
criu-3.15-1.module+el8.4.0+14872+9efa52a3.ppc64le.rpm
criu-debuginfo-3.15-1.module+el8.4.0+14872+9efa52a3.ppc64le.rpm
criu-debugsource-3.15-1.module+el8.4.0+14872+9efa52a3.ppc64le.rpm
crun-0.18-2.module+el8.4.0+14872+9efa52a3.ppc64le.rpm
crun-debuginfo-0.18-2.module+el8.4.0+14872+9efa52a3.ppc64le.rpm
crun-debugsource-0.18-2.module+el8.4.0+14872+9efa52a3.ppc64le.rpm
fuse-overlayfs-1.4.0-2.module+el8.4.0+14872+9efa52a3.ppc64le.rpm
fuse-overlayfs-debuginfo-1.4.0-2.module+el8.4.0+14872+9efa52a3.ppc64le.rpm
fuse-overlayfs-debugsource-1.4.0-2.module+el8.4.0+14872+9efa52a3.ppc64le.rpm
libslirp-4.3.1-1.module+el8.4.0+14872+9efa52a3.ppc64le.rpm
libslirp-debuginfo-4.3.1-1.module+el8.4.0+14872+9efa52a3.ppc64le.rpm
libslirp-debugsource-4.3.1-1.module+el8.4.0+14872+9efa52a3.ppc64le.rpm
libslirp-devel-4.3.1-1.module+el8.4.0+14872+9efa52a3.ppc64le.rpm
oci-seccomp-bpf-hook-1.2.0-1.module+el8.4.0+14872+9efa52a3.ppc64le.rpm
oci-seccomp-bpf-hook-debuginfo-1.2.0-1.module+el8.4.0+14872+9efa52a3.ppc64le.rpm
oci-seccomp-bpf-hook-debugsource-1.2.0-1.module+el8.4.0+14872+9efa52a3.ppc64le.rpm
podman-3.0.1-9.module+el8.4.0+14872+9efa52a3.ppc64le.rpm
podman-catatonit-3.0.1-9.module+el8.4.0+14872+9efa52a3.ppc64le.rpm
podman-catatonit-debuginfo-3.0.1-9.module+el8.4.0+14872+9efa52a3.ppc64le.rpm
podman-debuginfo-3.0.1-9.module+el8.4.0+14872+9efa52a3.ppc64le.rpm
podman-debugsource-3.0.1-9.module+el8.4.0+14872+9efa52a3.ppc64le.rpm
podman-plugins-3.0.1-9.module+el8.4.0+14872+9efa52a3.ppc64le.rpm
podman-plugins-debuginfo-3.0.1-9.module+el8.4.0+14872+9efa52a3.ppc64le.rpm
podman-remote-3.0.1-9.module+el8.4.0+14872+9efa52a3.ppc64le.rpm
podman-remote-debuginfo-3.0.1-9.module+el8.4.0+14872+9efa52a3.ppc64le.rpm
podman-tests-3.0.1-9.module+el8.4.0+14872+9efa52a3.ppc64le.rpm
python3-criu-3.15-1.module+el8.4.0+14872+9efa52a3.ppc64le.rpm
runc-1.0.0-76.rc95.module+el8.4.0+14872+9efa52a3.ppc64le.rpm
runc-debuginfo-1.0.0-76.rc95.module+el8.4.0+14872+9efa52a3.ppc64le.rpm
runc-debugsource-1.0.0-76.rc95.module+el8.4.0+14872+9efa52a3.ppc64le.rpm
skopeo-1.2.2-8.module+el8.4.0+14872+9efa52a3.ppc64le.rpm
skopeo-debuginfo-1.2.2-8.module+el8.4.0+14872+9efa52a3.ppc64le.rpm
skopeo-debugsource-1.2.2-8.module+el8.4.0+14872+9efa52a3.ppc64le.rpm
skopeo-tests-1.2.2-8.module+el8.4.0+14872+9efa52a3.ppc64le.rpm
slirp4netns-1.1.8-1.module+el8.4.0+14872+9efa52a3.ppc64le.rpm
slirp4netns-debuginfo-1.1.8-1.module+el8.4.0+14872+9efa52a3.ppc64le.rpm
slirp4netns-debugsource-1.1.8-1.module+el8.4.0+14872+9efa52a3.ppc64le.rpm
s390x:
buildah-1.19.9-1.module+el8.4.0+14872+9efa52a3.s390x.rpm
buildah-debuginfo-1.19.9-1.module+el8.4.0+14872+9efa52a3.s390x.rpm
buildah-debugsource-1.19.9-1.module+el8.4.0+14872+9efa52a3.s390x.rpm
buildah-tests-1.19.9-1.module+el8.4.0+14872+9efa52a3.s390x.rpm
buildah-tests-debuginfo-1.19.9-1.module+el8.4.0+14872+9efa52a3.s390x.rpm
conmon-2.0.26-1.module+el8.4.0+14872+9efa52a3.s390x.rpm
conmon-debuginfo-2.0.26-1.module+el8.4.0+14872+9efa52a3.s390x.rpm
conmon-debugsource-2.0.26-1.module+el8.4.0+14872+9efa52a3.s390x.rpm
containernetworking-plugins-0.9.1-1.module+el8.4.0+14872+9efa52a3.s390x.rpm
containernetworking-plugins-debuginfo-0.9.1-1.module+el8.4.0+14872+9efa52a3.s390x.rpm
containernetworking-plugins-debugsource-0.9.1-1.module+el8.4.0+14872+9efa52a3.s390x.rpm
containers-common-1.2.2-8.module+el8.4.0+14872+9efa52a3.s390x.rpm
crit-3.15-1.module+el8.4.0+14872+9efa52a3.s390x.rpm
criu-3.15-1.module+el8.4.0+14872+9efa52a3.s390x.rpm
criu-debuginfo-3.15-1.module+el8.4.0+14872+9efa52a3.s390x.rpm
criu-debugsource-3.15-1.module+el8.4.0+14872+9efa52a3.s390x.rpm
crun-0.18-2.module+el8.4.0+14872+9efa52a3.s390x.rpm
crun-debuginfo-0.18-2.module+el8.4.0+14872+9efa52a3.s390x.rpm
crun-debugsource-0.18-2.module+el8.4.0+14872+9efa52a3.s390x.rpm
fuse-overlayfs-1.4.0-2.module+el8.4.0+14872+9efa52a3.s390x.rpm
fuse-overlayfs-debuginfo-1.4.0-2.module+el8.4.0+14872+9efa52a3.s390x.rpm
fuse-overlayfs-debugsource-1.4.0-2.module+el8.4.0+14872+9efa52a3.s390x.rpm
libslirp-4.3.1-1.module+el8.4.0+14872+9efa52a3.s390x.rpm
libslirp-debuginfo-4.3.1-1.module+el8.4.0+14872+9efa52a3.s390x.rpm
libslirp-debugsource-4.3.1-1.module+el8.4.0+14872+9efa52a3.s390x.rpm
libslirp-devel-4.3.1-1.module+el8.4.0+14872+9efa52a3.s390x.rpm
oci-seccomp-bpf-hook-1.2.0-1.module+el8.4.0+14872+9efa52a3.s390x.rpm
oci-seccomp-bpf-hook-debuginfo-1.2.0-1.module+el8.4.0+14872+9efa52a3.s390x.rpm
oci-seccomp-bpf-hook-debugsource-1.2.0-1.module+el8.4.0+14872+9efa52a3.s390x.rpm
podman-3.0.1-9.module+el8.4.0+14872+9efa52a3.s390x.rpm
podman-catatonit-3.0.1-9.module+el8.4.0+14872+9efa52a3.s390x.rpm
podman-catatonit-debuginfo-3.0.1-9.module+el8.4.0+14872+9efa52a3.s390x.rpm
podman-debuginfo-3.0.1-9.module+el8.4.0+14872+9efa52a3.s390x.rpm
podman-debugsource-3.0.1-9.module+el8.4.0+14872+9efa52a3.s390x.rpm
podman-plugins-3.0.1-9.module+el8.4.0+14872+9efa52a3.s390x.rpm
podman-plugins-debuginfo-3.0.1-9.module+el8.4.0+14872+9efa52a3.s390x.rpm
podman-remote-3.0.1-9.module+el8.4.0+14872+9efa52a3.s390x.rpm
podman-remote-debuginfo-3.0.1-9.module+el8.4.0+14872+9efa52a3.s390x.rpm
podman-tests-3.0.1-9.module+el8.4.0+14872+9efa52a3.s390x.rpm
python3-criu-3.15-1.module+el8.4.0+14872+9efa52a3.s390x.rpm
runc-1.0.0-76.rc95.module+el8.4.0+14872+9efa52a3.s390x.rpm
runc-debuginfo-1.0.0-76.rc95.module+el8.4.0+14872+9efa52a3.s390x.rpm
runc-debugsource-1.0.0-76.rc95.module+el8.4.0+14872+9efa52a3.s390x.rpm
skopeo-1.2.2-8.module+el8.4.0+14872+9efa52a3.s390x.rpm
skopeo-debuginfo-1.2.2-8.module+el8.4.0+14872+9efa52a3.s390x.rpm
skopeo-debugsource-1.2.2-8.module+el8.4.0+14872+9efa52a3.s390x.rpm
skopeo-tests-1.2.2-8.module+el8.4.0+14872+9efa52a3.s390x.rpm
slirp4netns-1.1.8-1.module+el8.4.0+14872+9efa52a3.s390x.rpm
slirp4netns-debuginfo-1.1.8-1.module+el8.4.0+14872+9efa52a3.s390x.rpm
slirp4netns-debugsource-1.1.8-1.module+el8.4.0+14872+9efa52a3.s390x.rpm
x86_64:
buildah-1.19.9-1.module+el8.4.0+14872+9efa52a3.x86_64.rpm
buildah-debuginfo-1.19.9-1.module+el8.4.0+14872+9efa52a3.x86_64.rpm
buildah-debugsource-1.19.9-1.module+el8.4.0+14872+9efa52a3.x86_64.rpm
buildah-tests-1.19.9-1.module+el8.4.0+14872+9efa52a3.x86_64.rpm
buildah-tests-debuginfo-1.19.9-1.module+el8.4.0+14872+9efa52a3.x86_64.rpm
conmon-2.0.26-1.module+el8.4.0+14872+9efa52a3.x86_64.rpm
conmon-debuginfo-2.0.26-1.module+el8.4.0+14872+9efa52a3.x86_64.rpm
conmon-debugsource-2.0.26-1.module+el8.4.0+14872+9efa52a3.x86_64.rpm
containernetworking-plugins-0.9.1-1.module+el8.4.0+14872+9efa52a3.x86_64.rpm
containernetworking-plugins-debuginfo-0.9.1-1.module+el8.4.0+14872+9efa52a3.x86_64.rpm
containernetworking-plugins-debugsource-0.9.1-1.module+el8.4.0+14872+9efa52a3.x86_64.rpm
containers-common-1.2.2-8.module+el8.4.0+14872+9efa52a3.x86_64.rpm
crit-3.15-1.module+el8.4.0+14872+9efa52a3.x86_64.rpm
criu-3.15-1.module+el8.4.0+14872+9efa52a3.x86_64.rpm
criu-debuginfo-3.15-1.module+el8.4.0+14872+9efa52a3.x86_64.rpm
criu-debugsource-3.15-1.module+el8.4.0+14872+9efa52a3.x86_64.rpm
crun-0.18-2.module+el8.4.0+14872+9efa52a3.x86_64.rpm
crun-debuginfo-0.18-2.module+el8.4.0+14872+9efa52a3.x86_64.rpm
crun-debugsource-0.18-2.module+el8.4.0+14872+9efa52a3.x86_64.rpm
fuse-overlayfs-1.4.0-2.module+el8.4.0+14872+9efa52a3.x86_64.rpm
fuse-overlayfs-debuginfo-1.4.0-2.module+el8.4.0+14872+9efa52a3.x86_64.rpm
fuse-overlayfs-debugsource-1.4.0-2.module+el8.4.0+14872+9efa52a3.x86_64.rpm
libslirp-4.3.1-1.module+el8.4.0+14872+9efa52a3.x86_64.rpm
libslirp-debuginfo-4.3.1-1.module+el8.4.0+14872+9efa52a3.x86_64.rpm
libslirp-debugsource-4.3.1-1.module+el8.4.0+14872+9efa52a3.x86_64.rpm
libslirp-devel-4.3.1-1.module+el8.4.0+14872+9efa52a3.x86_64.rpm
oci-seccomp-bpf-hook-1.2.0-1.module+el8.4.0+14872+9efa52a3.x86_64.rpm
oci-seccomp-bpf-hook-debuginfo-1.2.0-1.module+el8.4.0+14872+9efa52a3.x86_64.rpm
oci-seccomp-bpf-hook-debugsource-1.2.0-1.module+el8.4.0+14872+9efa52a3.x86_64.rpm
podman-3.0.1-9.module+el8.4.0+14872+9efa52a3.x86_64.rpm
podman-catatonit-3.0.1-9.module+el8.4.0+14872+9efa52a3.x86_64.rpm
podman-catatonit-debuginfo-3.0.1-9.module+el8.4.0+14872+9efa52a3.x86_64.rpm
podman-debuginfo-3.0.1-9.module+el8.4.0+14872+9efa52a3.x86_64.rpm
podman-debugsource-3.0.1-9.module+el8.4.0+14872+9efa52a3.x86_64.rpm
podman-plugins-3.0.1-9.module+el8.4.0+14872+9efa52a3.x86_64.rpm
podman-plugins-debuginfo-3.0.1-9.module+el8.4.0+14872+9efa52a3.x86_64.rpm
podman-remote-3.0.1-9.module+el8.4.0+14872+9efa52a3.x86_64.rpm
podman-remote-debuginfo-3.0.1-9.module+el8.4.0+14872+9efa52a3.x86_64.rpm
podman-tests-3.0.1-9.module+el8.4.0+14872+9efa52a3.x86_64.rpm
python3-criu-3.15-1.module+el8.4.0+14872+9efa52a3.x86_64.rpm
runc-1.0.0-76.rc95.module+el8.4.0+14872+9efa52a3.x86_64.rpm
runc-debuginfo-1.0.0-76.rc95.module+el8.4.0+14872+9efa52a3.x86_64.rpm
runc-debugsource-1.0.0-76.rc95.module+el8.4.0+14872+9efa52a3.x86_64.rpm
skopeo-1.2.2-8.module+el8.4.0+14872+9efa52a3.x86_64.rpm
skopeo-debuginfo-1.2.2-8.module+el8.4.0+14872+9efa52a3.x86_64.rpm
skopeo-debugsource-1.2.2-8.module+el8.4.0+14872+9efa52a3.x86_64.rpm
skopeo-tests-1.2.2-8.module+el8.4.0+14872+9efa52a3.x86_64.rpm
slirp4netns-1.1.8-1.module+el8.4.0+14872+9efa52a3.x86_64.rpm
slirp4netns-debuginfo-1.1.8-1.module+el8.4.0+14872+9efa52a3.x86_64.rpm
slirp4netns-debugsource-1.1.8-1.module+el8.4.0+14872+9efa52a3.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
- References:
https://access.redhat.com/security/cve/CVE-2022-1227
https://access.redhat.com/security/cve/CVE-2022-27649
https://access.redhat.com/security/cve/CVE-2022-27651
https://access.redhat.com/security/updates/classification/#important
- Contact:
The Red Hat security contact is [email protected]. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2022 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBYpYjmNzjgjWX9erEAQg3xQ/+IKxvtpR4s+2jt/xcLmi+rw2XppDFf3Hm
lOF8K5Ri5QOEPYZfnm5qt1eeOoVaB+J3KRopZW5CnclK34LZ15DP3bVfcpiCAGrS
V7LL6kfGX5HC1GjFrvkSBZidijkDjNP03kwbw1YUsKGjyMqLV+1//Yf3f8iO1nTo
DeK03ok+igJFFBJrZ4BI/FqMwi+lD1Nu8LA/vry5OYL6FdmPVNJFRqExudttZPFi
CDO/QpwI94hZuJSUswKNeL9UXLZnY/pQwMsa4Ul9SSWzG4xG7b0uMR3O+2lQDVU0
dGDZf3mkdzrqElr8S2jHj9RfsElmM/hyup1d+7MoxqUiPSCSBPzw4KzYQ5pJdddR
+MlpiYFWFcrP4QXIRf7WHlUrH62MR+R3cCuGTlkxrohtdP/YygcFP9uz2JcT8Rki
0m8GSW+O3MPlbMxIpbEH+sflL1+L/7Ni6YdXdF21g34FuADcYBRQSYTUmmjpObNg
9ktp0GxmyvCW6f9HTCkzeljybr8JwkX5Zxr2oAGEFdrbCD0qqzTOIvR1979f+Q70
9ikftTiLPqdJd1QlzogDWwnXkYNMj9Jsr/VDDgRSLCcfwhIxY2wJQ6+x5d0KU6HW
Rget3q9pYXZJg1V9IWwYpvMV4WpDJFuk5DWrR3hJu2TgzQmnZK4nbuAaskCIlkg0
jtzkWy9UMDw=AVg2
-----END PGP SIGNATURE-----
–
RHSA-announce mailing list
[email protected]
https://listman.redhat.com/mailman/listinfo/rhsa-announce
Related news
Red Hat Security Advisory 2022-5622-01 - The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Issues addressed include a privilege escalation vulnerability.
An update for the container-tools:rhel8 module is now available for Red Hat Enterprise Linux 8.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-1227: psgo: Privilege escalation in 'podman top'
An update for the container-tools:3.0 module is now available for Red Hat Enterprise Linux 8.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-1227: psgo: Privilege escalation in 'podman top' * CVE-2022-27649: podman: Default inheritable capabilities for linux container should be empty * CVE-2022-27651: buildah: Default inheritable capabilities for linux container should be empty
An update for the container-tools:3.0 module is now available for Red Hat Enterprise Linux 8.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-1227: psgo: Privilege escalation in 'podman top' * CVE-2022-27649: podman: Default inheritable capabilities for linux container should be empty * CVE-2022-27651: buildah: Default inheritable capabilities for linux container should be empty
An update for the container-tools:3.0 module is now available for Red Hat Enterprise Linux 8.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-1227: psgo: Privilege escalation in 'podman top' * CVE-2022-27649: podman: Default inheritable capabilities for linux container should be empty * CVE-2022-27651: buildah: Default inheritable capabilities for linux container should be empty
Red Hat Security Advisory 2022-2263-01 - Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the RPM packages for Red Hat OpenShift Container Platform 4.6.58. Issues addressed include a privilege escalation vulnerability.
Red Hat OpenShift Container Platform release 4.6.58 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.6. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-1227: psgo: Privilege escalation in 'podman top'
Red Hat Security Advisory 2022-4651-01 - The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Issues addressed include a privilege escalation vulnerability.
Red Hat Security Advisory 2022-4651-01 - The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Issues addressed include a privilege escalation vulnerability.
Red Hat Security Advisory 2022-4651-01 - The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Issues addressed include a privilege escalation vulnerability.
An update for the container-tools:2.0 module is now available for Red Hat Enterprise Linux 8.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-1227: psgo: Privilege escalation in 'podman top' * CVE-2022-27649: podman: Default inheritable capabilities for linux container should be empty * CVE-2022-27651: buildah: Default inheritable capabilities for linux container should be empty
An update for the container-tools:2.0 module is now available for Red Hat Enterprise Linux 8.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-1227: psgo: Privilege escalation in 'podman top' * CVE-2022-27649: podman: Default inheritable capabilities for linux container should be empty * CVE-2022-27651: buildah: Default inheritable capabilities for linux container should be empty
An update for the container-tools:2.0 module is now available for Red Hat Enterprise Linux 8.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-1227: psgo: Privilege escalation in 'podman top' * CVE-2022-27649: podman: Default inheritable capabilities for linux container should be empty * CVE-2022-27651: buildah: Default inheritable capabilities for linux container should be empty
An update for podman is now available for Red Hat Enterprise Linux 7 Extras. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-1227: psgo: Privilege escalation in 'podman top'
Red Hat Security Advisory 2022-2143-01 - The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Issues addressed include a privilege escalation vulnerability.
An update for the container-tools:3.0 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-1227: psgo: Privilege escalation in 'podman top'
An update for the container-tools:rhel8 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-1227: psgo: Privilege escalation in 'podman top' * CVE-2022-21698: prometheus/client_golang: Denial of service using InstrumentHandlerCounter * CVE-2022-27649: podman: Default inheritable capabilities for linux container should be empty * CVE-2022-27650: crun: Default inheritable capabilities for linux container should be empty...
An update for the container-tools:rhel8 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-1227: psgo: Privilege escalation in 'podman top' * CVE-2022-21698: prometheus/client_golang: Denial of service using InstrumentHandlerCounter * CVE-2022-27649: podman: Default inheritable capabilities for linux container should be empty * CVE-2022-27650: crun: Default inheritable capabilities for linux container should be empty...
An update for the container-tools:rhel8 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-1227: psgo: Privilege escalation in 'podman top' * CVE-2022-21698: prometheus/client_golang: Denial of service using InstrumentHandlerCounter * CVE-2022-27649: podman: Default inheritable capabilities for linux container should be empty * CVE-2022-27650: crun: Default inheritable capabilities for linux container should be empty...
Podman is a tool for managing OCI containers and pods. A privilege escalation flaw was found in Podman. This flaw allows an attacker to publish a malicious image to a public registry. Once this image is downloaded by a potential victim, the vulnerability is triggered after a user runs the 'podman top' command. This action gives the attacker access to the host filesystem, leading to information disclosure or denial of service.
A privilege escalation flaw was found in Podman. This flaw allows an attacker to publish a malicious image to a public registry. Once this image is downloaded by a potential victim, the vulnerability is triggered after a user runs the 'podman top' command. This action gives the attacker access to the host filesystem, leading to information disclosure or denial of service.
A flaw was found in Podman, where containers were started incorrectly with non-empty default permissions. A vulnerability was found in Moby (Docker Engine), where containers were started incorrectly with non-empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs.
A flaw was found in buildah where containers were incorrectly started with non-empty default permissions. A bug was found in Moby (Docker Engine) where containers were incorrectly started with non-empty inheritable Linux process capabilities, enabling an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs. This has the potential to impact confidentiality and integrity.