Headline

RHSA-2022:4651: Red Hat Security Advisory: container-tools:2.0 security update

An update for the container-tools:2.0 module is now available for Red Hat Enterprise Linux 8.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

Related CVEs:

CVE-2022-1227: psgo: Privilege escalation in ‘podman top’
CVE-2022-27649: podman: Default inheritable capabilities for linux container should be empty
CVE-2022-27651: buildah: Default inheritable capabilities for linux container should be empty

2 years ago

Red Hat Security Data

Open in Source

#vulnerability #linux #red_hat #git #ibm #docker #sap

Synopsis

Important: container-tools:2.0 security update

Type/Severity

Security Advisory: Important

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for the container-tools:2.0 module is now available for Red Hat Enterprise Linux 8.2 Extended Update Support.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

psgo: Privilege escalation in ‘podman top’ (CVE-2022-1227)
podman: Default inheritable capabilities for linux container should be empty (CVE-2022-27649)
buildah: Default inheritable capabilities for linux container should be empty (CVE-2022-27651)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected Products

Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.2 x86_64
Red Hat Enterprise Linux Server - AUS 8.2 x86_64
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.2 s390x
Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.2 ppc64le
Red Hat Enterprise Linux Server - TUS 8.2 x86_64
Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.2 aarch64
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.2 ppc64le
Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions 8.2 x86_64

Fixes

BZ - 2066568 - CVE-2022-27649 podman: Default inheritable capabilities for linux container should be empty
BZ - 2066840 - CVE-2022-27651 buildah: Default inheritable capabilities for linux container should be empty
BZ - 2070368 - CVE-2022-1227 psgo: Privilege escalation in ‘podman top’

References

https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/security/cve/cve-2022-1227
https://access.redhat.com/security/cve/cve-2022-27649
https://access.redhat.com/security/cve/cve-2022-27651

Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.2

SRPM

buildah-1.11.6-8.module+el8.2.0+14896+bf621b2a.src.rpm

SHA-256: 0336a596d32cd9e6ef831b806bb56aa1de760b572b8d1e26ebeb72658fe18ab8

cockpit-podman-11-1.module+el8.2.0+14896+bf621b2a.src.rpm

SHA-256: ba23e085743e83493ca52a028932753794588e0c6107b1f368ed8acd6585cd0f

conmon-2.0.6-1.module+el8.2.0+14896+bf621b2a.src.rpm

SHA-256: 60c139df878d6505c78c22af8680df756da4492671d1cd37a51628dc186b49d5

container-selinux-2.124.0-1.module+el8.2.0+14896+bf621b2a.src.rpm

SHA-256: 0ea7f0a16fbcff00377def565b1aa2f3abe74edf9e3d1612b0bddd609bd5f198

containernetworking-plugins-0.8.3-4.module+el8.2.0+14896+bf621b2a.src.rpm

SHA-256: 3155973fa9cba0007b6a7ecff6c4976479d2b2661424be20bef9455c1c56d186

criu-3.12-9.module+el8.2.0+14896+bf621b2a.src.rpm

SHA-256: 6f3ae0616695fdd72ffc4e74064265cb786318f58b5edee7c7af47df8ed601fd

fuse-overlayfs-0.7.2-5.module+el8.2.0+14896+bf621b2a.src.rpm

SHA-256: 438a462cd80d5f58c9a567eca7f08d61c169807b83954266352d7919920d2df6

podman-1.6.4-24.module+el8.2.0+14896+bf621b2a.src.rpm

SHA-256: c7a8be58d6b334c6cc63d04c60be4d3a08aea80e0b8952c9b38f346ab32bd3ee

python-podman-api-1.2.0-0.2.gitd0a45fe.module+el8.2.0+14896+bf621b2a.src.rpm

SHA-256: 480c4f39a455be6261c127d8564ed1435a9fc4155f9d37f96b5498df8b8cf727

runc-1.0.0-65.rc10.module+el8.2.0+14896+bf621b2a.src.rpm

SHA-256: 8cd99168118f9e3d18d8f903b38fdd644ca36b7f0dedfb2d982211c4a558ef20

skopeo-0.1.40-9.module+el8.2.0+14896+bf621b2a.src.rpm

SHA-256: d73c3cf6319116eb672c9d634be5fc87f0d7264d13fe2d9aaf9ab3ee8972a5a4

slirp4netns-0.4.2-3.git21fdece.module+el8.2.0+14896+bf621b2a.src.rpm

SHA-256: 5e0ff82f64cae90defaed9f8a099e535ba6ce0407e1001deab15a50e2ff5cca1

toolbox-0.0.7-1.module+el8.2.0+14896+bf621b2a.src.rpm

SHA-256: 22cf4f8d553468bd92b5a94d91dba77049045eba39b530aee073bd59f2a29028

udica-0.2.1-2.module+el8.2.0+14896+bf621b2a.src.rpm

SHA-256: 1319ec80870bcea1f014458a07254f9aaf3d9bdccadb07cf89f163e325aaadb6

x86_64

cockpit-podman-11-1.module+el8.2.0+14896+bf621b2a.noarch.rpm

SHA-256: 9d619bce9a487ea46f76dcb12b7ef712153f3680bd9e97655a275604cdabc66f

container-selinux-2.124.0-1.module+el8.2.0+14896+bf621b2a.noarch.rpm

SHA-256: ca6a5073e6184d5f6bea3df127530243763a6acc55ef1e6baceec09ba67523dd

podman-docker-1.6.4-24.module+el8.2.0+14896+bf621b2a.noarch.rpm

SHA-256: b2111735c0e63d72174eaf8778497dc83c62b3548f008e39c8473f115ab13744

python-podman-api-1.2.0-0.2.gitd0a45fe.module+el8.2.0+14896+bf621b2a.noarch.rpm

SHA-256: fdd54bdae5726fbd3815fcd0c6761910d6ab89311d44b6f576cce2f4e40a4873

toolbox-0.0.7-1.module+el8.2.0+14896+bf621b2a.noarch.rpm

SHA-256: a9d63bc8abf4e8c96b3d6f901e3a19f3d135ba8a9f2ec4050952f45aad38bd9f

udica-0.2.1-2.module+el8.2.0+14896+bf621b2a.noarch.rpm

SHA-256: 879318c1b29b38a564d968043b2eb444a2294d3e3bf5ff589698fbbfae060290

buildah-1.11.6-8.module+el8.2.0+14896+bf621b2a.x86_64.rpm

SHA-256: 0982f6a3e28d59a53bfe50ef16945232029835d39322a8ca9e0ab680d80c9f8c

buildah-debuginfo-1.11.6-8.module+el8.2.0+14896+bf621b2a.x86_64.rpm

SHA-256: e7374dddb73032b6064c3a2e86b6b66d93fed12cde72dea72beecad555898947

buildah-debugsource-1.11.6-8.module+el8.2.0+14896+bf621b2a.x86_64.rpm

SHA-256: c070b8207108b0b2bd18373fff853c2d7232de0d61bf3c00754876367f1e8ed1

buildah-tests-1.11.6-8.module+el8.2.0+14896+bf621b2a.x86_64.rpm

SHA-256: 69970cf88ef8a045600a3ba2402361d060df17461c6253b2ab78b0bb68d8fa81

buildah-tests-debuginfo-1.11.6-8.module+el8.2.0+14896+bf621b2a.x86_64.rpm

SHA-256: 4681e3029d2a694032a03114bb72eca8d84929bb39da9500b3e5d830982fe8a6

conmon-2.0.6-1.module+el8.2.0+14896+bf621b2a.x86_64.rpm

SHA-256: d2ea6bc9a6bfe2fea1230f6de961d4a9a34bd10d338a986f386793163e5b73e0

containernetworking-plugins-0.8.3-4.module+el8.2.0+14896+bf621b2a.x86_64.rpm

SHA-256: 9064fc16b3f54f8230cbbe5a31a7286918fd4c16803dae572089824c8b3f04fe

containernetworking-plugins-debuginfo-0.8.3-4.module+el8.2.0+14896+bf621b2a.x86_64.rpm

SHA-256: 76a34a39b0882d65b2e852fb87dcfdcc55c804d8efc0c07b42d02355bbd0946d

containernetworking-plugins-debugsource-0.8.3-4.module+el8.2.0+14896+bf621b2a.x86_64.rpm

SHA-256: 11ab6ed87fa9817b99c02ab66ef65518c9f0490eeb56cd564ffb574569953cb2

containers-common-0.1.40-9.module+el8.2.0+14896+bf621b2a.x86_64.rpm

SHA-256: 70ca194c69d8766c25c6b2c7ab5cf89d1e40600f787447d5118c8bc0f2c8aa4c

crit-3.12-9.module+el8.2.0+14896+bf621b2a.x86_64.rpm

SHA-256: a3893d864fbec720c764a5435c311fa53bba5085c3dd44cc4eaf72a23f1cf34e

criu-3.12-9.module+el8.2.0+14896+bf621b2a.x86_64.rpm

SHA-256: 58552bae25afda830227bc6864e32138b5a2e0ca0f4bcbf3d17a6f9d4b70557d

criu-debuginfo-3.12-9.module+el8.2.0+14896+bf621b2a.x86_64.rpm

SHA-256: 25f61185aad06b2d30121f87b21af9c12d476327bafd7b813b6221fbc220e3fb

criu-debugsource-3.12-9.module+el8.2.0+14896+bf621b2a.x86_64.rpm

SHA-256: 1de8ac3345047f2099bd9b51b752d4c198ddfe0147de60071c6c9c1a2c430f12

fuse-overlayfs-0.7.2-5.module+el8.2.0+14896+bf621b2a.x86_64.rpm

SHA-256: d6f297e85cc2dea2360ba6bf0914b134aead154a0f45435482988da26bb90afa

fuse-overlayfs-debuginfo-0.7.2-5.module+el8.2.0+14896+bf621b2a.x86_64.rpm

SHA-256: 6c6562371d4d24cb33f79868d0e7838477d02b65721177b1257c7859631b122f

fuse-overlayfs-debugsource-0.7.2-5.module+el8.2.0+14896+bf621b2a.x86_64.rpm

SHA-256: efa82e5600aefc114596d76e5a01a5f9f8af34e992b3b499f563c65040f57a10

podman-1.6.4-24.module+el8.2.0+14896+bf621b2a.x86_64.rpm

SHA-256: 56ccec3e6365817b1f0f51dfe445d60bbd41579e7c170e44aead1e812b64fd5a

podman-debuginfo-1.6.4-24.module+el8.2.0+14896+bf621b2a.x86_64.rpm

SHA-256: 4b9452cb17e29ac09381086ba2115078c780ee9d0c14f8fa4c3505444e33cfec

podman-debugsource-1.6.4-24.module+el8.2.0+14896+bf621b2a.x86_64.rpm

SHA-256: 60b30039c88478047c215d747bba0ccbcf4536fe0ff0f57fc5fa18872fa436ea

podman-remote-1.6.4-24.module+el8.2.0+14896+bf621b2a.x86_64.rpm

SHA-256: f6a3038d82101765dbe09e7eec1d3265e23bafd79df28ebc5120a96a2c284270

podman-remote-debuginfo-1.6.4-24.module+el8.2.0+14896+bf621b2a.x86_64.rpm

SHA-256: 591c96464486fedfecf7055410e242b32f5124c2629fe25464fe0dab0145bab6

podman-tests-1.6.4-24.module+el8.2.0+14896+bf621b2a.x86_64.rpm

SHA-256: 7e7242b265f4631f3708f6f94ae4227dc2fac332988f4766fdf9513c1b2df181

python3-criu-3.12-9.module+el8.2.0+14896+bf621b2a.x86_64.rpm

SHA-256: b8c126efb4db543bc06e54e390677a204c21ca32b1b63e85f3a3f1c255a64cf4

runc-1.0.0-65.rc10.module+el8.2.0+14896+bf621b2a.x86_64.rpm

SHA-256: 0e6cb8654099952d374182aa750cddd88431b426509556f2a0177a944c9a45a5

runc-debuginfo-1.0.0-65.rc10.module+el8.2.0+14896+bf621b2a.x86_64.rpm

SHA-256: b79817147796fd2d5667cef0258a09fdf1b8c83c707d907aa807ab7e6d940d39

runc-debugsource-1.0.0-65.rc10.module+el8.2.0+14896+bf621b2a.x86_64.rpm

SHA-256: c7c92e6ed073931d05f68ba331be4642afd411f4ef81225933f20e25be2a6817

skopeo-0.1.40-9.module+el8.2.0+14896+bf621b2a.x86_64.rpm

SHA-256: edb2e7c5de718516c57375cfad77ec8b8ee5d1ecd5e256b28d6a74ba07f01fe1

skopeo-debuginfo-0.1.40-9.module+el8.2.0+14896+bf621b2a.x86_64.rpm

SHA-256: 7d1e8c19bb75d7f136c179d9dd3bff1f31e79a691f1b651b5ace6a86aa24fdfd

skopeo-debugsource-0.1.40-9.module+el8.2.0+14896+bf621b2a.x86_64.rpm

SHA-256: 5f733601578da316e9ef0c31261f82c2b9f4c63d19480d4ee7597d0503361096

skopeo-tests-0.1.40-9.module+el8.2.0+14896+bf621b2a.x86_64.rpm

SHA-256: 932ed95aa8624c31b354987259d82d7db488f04da704617770e9918a98bf526b

slirp4netns-0.4.2-3.git21fdece.module+el8.2.0+14896+bf621b2a.x86_64.rpm

SHA-256: 0299c9af79d9ae4cae66eb909e38d18abe9cf04f5741e8410913606f305239a2

slirp4netns-debuginfo-0.4.2-3.git21fdece.module+el8.2.0+14896+bf621b2a.x86_64.rpm

SHA-256: e65a7cd86e23f62a7869aba4a624ae63abc8910849bfa25449191333e0b5fdaf

slirp4netns-debugsource-0.4.2-3.git21fdece.module+el8.2.0+14896+bf621b2a.x86_64.rpm

SHA-256: d3e008e5d868453ea890957d4f24c1cffe96ebc421a7defc84c9cb28a71a6a25

Red Hat Enterprise Linux Server - AUS 8.2