Headline

RHSA-2022:4816: Red Hat Security Advisory: container-tools:3.0 security update

An update for the container-tools:3.0 module is now available for Red Hat Enterprise Linux 8.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

Related CVEs:

CVE-2022-1227: psgo: Privilege escalation in ‘podman top’
CVE-2022-27649: podman: Default inheritable capabilities for linux container should be empty
CVE-2022-27651: buildah: Default inheritable capabilities for linux container should be empty

2 years ago

Red Hat Security Data

Open in Source

#vulnerability #linux #red_hat #ibm #docker #sap

Synopsis

Important: container-tools:3.0 security update

Type/Severity

Security Advisory: Important

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for the container-tools:3.0 module is now available for Red Hat Enterprise Linux 8.4 Extended Update Support.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

psgo: Privilege escalation in ‘podman top’ (CVE-2022-1227)
podman: Default inheritable capabilities for linux container should be empty (CVE-2022-27649)
buildah: Default inheritable capabilities for linux container should be empty (CVE-2022-27651)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected Products

Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.4 x86_64
Red Hat Enterprise Linux Server - AUS 8.4 x86_64
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.4 s390x
Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.4 ppc64le
Red Hat Enterprise Linux Server - TUS 8.4 x86_64
Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.4 aarch64
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.4 ppc64le
Red Hat Enterprise Linux Server for x86_64 - Update Services for SAP Solutions 8.4 x86_64

Fixes

BZ - 1972343 - podman’s image index corrupted during WAN emulation tests [rhel-8.4.0.z]
BZ - 2066568 - CVE-2022-27649 podman: Default inheritable capabilities for linux container should be empty
BZ - 2066840 - CVE-2022-27651 buildah: Default inheritable capabilities for linux container should be empty
BZ - 2070368 - CVE-2022-1227 psgo: Privilege escalation in ‘podman top’

Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.4

SRPM

buildah-1.19.9-1.module+el8.4.0+14872+9efa52a3.src.rpm

SHA-256: 8362482d3bbea89635dfb07b3b4a22eb9a2801115e1a7fcf6e334b6455cca8b1

cockpit-podman-29-2.module+el8.4.0+14872+9efa52a3.src.rpm

SHA-256: 80a1356251fdfd6a2ac871d7b6eb7fcd483aafba1a85135734c4789aa4208107

conmon-2.0.26-1.module+el8.4.0+14872+9efa52a3.src.rpm

SHA-256: 618cb8654b06975526c9ef87e399814ce4082b89824765404b4d0b6afdea7a35

container-selinux-2.167.0-1.module+el8.4.0+14872+9efa52a3.src.rpm

SHA-256: da77631140d939f57dfe3ea27b95c521194c670288e9784c071ae3953058698f

containernetworking-plugins-0.9.1-1.module+el8.4.0+14872+9efa52a3.src.rpm

SHA-256: 404e123d493582a5774071b5171d04f81b2561202cf4509fd712a7aa8ce3546f

criu-3.15-1.module+el8.4.0+14872+9efa52a3.src.rpm

SHA-256: e9cfad480a083af0826c6ce2cb468833fe38da85c37c88cd346b0e3c483a6911

crun-0.18-2.module+el8.4.0+14872+9efa52a3.src.rpm

SHA-256: ffdd9246022d07719ad52a71e674b7f5c10b7900d3b7f4512fedf695c30111aa

fuse-overlayfs-1.4.0-2.module+el8.4.0+14872+9efa52a3.src.rpm

SHA-256: 9a0b4646f315e44f729d55960dfe3bf63aaa5e788fb22a96c12191dee3721d9c

libslirp-4.3.1-1.module+el8.4.0+14872+9efa52a3.src.rpm

SHA-256: 0a6da121c22376f2628aa5c4479734920abb1a205e1a1b40eb169726b47aa683

oci-seccomp-bpf-hook-1.2.0-1.module+el8.4.0+14872+9efa52a3.src.rpm

SHA-256: 09cdde59bddba9963b0e3b3356156c4625e747d455f4f3ef79f01608fca0c53c

podman-3.0.1-9.module+el8.4.0+14872+9efa52a3.src.rpm

SHA-256: 0793d622e509037683500fe4bb2009c4f24bba1cf3fb43e18292890494a50c44

runc-1.0.0-76.rc95.module+el8.4.0+14872+9efa52a3.src.rpm

SHA-256: ae0be298fb40a3389665574103a6efc0e0eae6a4fed554a372c18104f62be62b

skopeo-1.2.2-8.module+el8.4.0+14872+9efa52a3.src.rpm

SHA-256: 2c0b98f2782c53aa0e50b70424ca7c65f6a05aa166c1159eaf3d47ae89d4bd91

slirp4netns-1.1.8-1.module+el8.4.0+14872+9efa52a3.src.rpm

SHA-256: 22cf46ae3d7cfd39dd2f91117093ed4a3f63756719aa81fc9f16c8e5e8846b3e

toolbox-0.0.8-1.module+el8.4.0+14872+9efa52a3.src.rpm

SHA-256: f9e300fc50ecc5881ffa7ee229b8d1fe16dcd2af514922fca5fa38533f75fb5a

udica-0.2.4-1.module+el8.4.0+14872+9efa52a3.src.rpm

SHA-256: ca87c4308f802c19d01e19bde9539cf1f6d82d4bf884a11b44a5b35d37290f38

x86_64

cockpit-podman-29-2.module+el8.4.0+14872+9efa52a3.noarch.rpm

SHA-256: 5df90968c35c830ea39af8a27d20de375573fb0dc9fa0a1a31047858a66ac67f

container-selinux-2.167.0-1.module+el8.4.0+14872+9efa52a3.noarch.rpm

SHA-256: 0321bf778f2e8a0468e87c58471675c1707de2395b1e7cb1aa49d8ea1c3e6486

podman-docker-3.0.1-9.module+el8.4.0+14872+9efa52a3.noarch.rpm

SHA-256: 4fc8d5cda1c7aa71536c8b04bb39c46202584630f2166b0e4073600c3cedfe3b

toolbox-0.0.8-1.module+el8.4.0+14872+9efa52a3.noarch.rpm

SHA-256: a462fd1703303038099b9a6aa28ec8561531cfe5ef0f0e38831bd2863d964032

udica-0.2.4-1.module+el8.4.0+14872+9efa52a3.noarch.rpm

SHA-256: 721613140750122d855e2bdb3ac16e63e5d124d26418ac56169651688cefb866

buildah-1.19.9-1.module+el8.4.0+14872+9efa52a3.x86_64.rpm

SHA-256: 2107db7d538b6c9cb6e5943d4420c06401e7805ee7a559b8c674fabfc6242eba

buildah-debuginfo-1.19.9-1.module+el8.4.0+14872+9efa52a3.x86_64.rpm

SHA-256: 39695a0642a4e40e8f52a1a2c465edad89a057c1cf23367473eb0d67c63dbe22

buildah-debugsource-1.19.9-1.module+el8.4.0+14872+9efa52a3.x86_64.rpm

SHA-256: c94f5e3cd69c02f27e9823ecf5abb7263ff4c5c2be8325bf5a4a02eb089e9eea

buildah-tests-1.19.9-1.module+el8.4.0+14872+9efa52a3.x86_64.rpm

SHA-256: 17255a0d1cbee9f15b3848a1417e5d8a2f1d4759d066fe696951a40e4fe71cb9

buildah-tests-debuginfo-1.19.9-1.module+el8.4.0+14872+9efa52a3.x86_64.rpm

SHA-256: 0b98f0623f61aea5be7ee4b7acd75b22dd706c95b464cb49e828d58b4bdf07a6

conmon-2.0.26-1.module+el8.4.0+14872+9efa52a3.x86_64.rpm

SHA-256: 668c51e83e01ec2ddf149b3a5573afb0456fd1a5d26b4c913305e48daca74a3b

conmon-debuginfo-2.0.26-1.module+el8.4.0+14872+9efa52a3.x86_64.rpm

SHA-256: f1b0c57ca39f978a07e8dff2555a775501ee968f95156e688f89dce42c9964c2

conmon-debugsource-2.0.26-1.module+el8.4.0+14872+9efa52a3.x86_64.rpm

SHA-256: ca67febe891b3f41732bc2172ea6c1e39b1df8fe30f3bd1ef25c25ef0e1e3928

containernetworking-plugins-0.9.1-1.module+el8.4.0+14872+9efa52a3.x86_64.rpm

SHA-256: 14b2a795396132899945ac7a97b9350478c73d0bb770dcf561815fe2f1ec2121

containernetworking-plugins-debuginfo-0.9.1-1.module+el8.4.0+14872+9efa52a3.x86_64.rpm

SHA-256: 2bc8a92505add4cd71b899235a805eec182b9e9966c85fac072422b2ee51b191

containernetworking-plugins-debugsource-0.9.1-1.module+el8.4.0+14872+9efa52a3.x86_64.rpm

SHA-256: 8fc321594f514f4e2d8617b4f7aae2db21cbaf84a3441ed3535113399a619e07

containers-common-1.2.2-8.module+el8.4.0+14872+9efa52a3.x86_64.rpm

SHA-256: c056a092df26f886a59524282761876aa889cf36fdadbf6a68757a1af6f02db0

crit-3.15-1.module+el8.4.0+14872+9efa52a3.x86_64.rpm

SHA-256: 5d58087864fcfa81dc983a38a81869e568cbe9ff56541a7e06b6b21b082d981d

criu-3.15-1.module+el8.4.0+14872+9efa52a3.x86_64.rpm

SHA-256: 8394fb774f9f0cf4eaf121a64da4e27531b6798c8d70b9172ac04d1e9daa6aac

criu-debuginfo-3.15-1.module+el8.4.0+14872+9efa52a3.x86_64.rpm

SHA-256: 710bc229de9f12097d5a1f642f6d9993e906bf2c64d413ee15801672b0cb9913

criu-debugsource-3.15-1.module+el8.4.0+14872+9efa52a3.x86_64.rpm

SHA-256: 01a46192e37214b6b531c07cceef84f36b7510f624735f2472dfafa93a9c36d4

crun-0.18-2.module+el8.4.0+14872+9efa52a3.x86_64.rpm

SHA-256: f872fbcacf14e2a4ca6ea729eb21729ad427ff10fecf94352e192dfb5c41ce9a

crun-debuginfo-0.18-2.module+el8.4.0+14872+9efa52a3.x86_64.rpm

SHA-256: 9c026620a42793d08880ecc04f925640d4c1f7fc78ebd0f3f74e3dfdb788a33e

crun-debugsource-0.18-2.module+el8.4.0+14872+9efa52a3.x86_64.rpm

SHA-256: 40ba9960a8bfea1c9f68ace5fdd83c60e8ae99dcb35017d7809a9e5abc2a46cb

fuse-overlayfs-1.4.0-2.module+el8.4.0+14872+9efa52a3.x86_64.rpm

SHA-256: 4a20d0a86ec87f3ad83da67f71aee9f80e9d5cc45fbc8121174e3c29bf65fdaf

fuse-overlayfs-debuginfo-1.4.0-2.module+el8.4.0+14872+9efa52a3.x86_64.rpm

SHA-256: 69662c9c4325bfa7771a1f50389a9b3becb9f0dfbf59d2af93c5ad07338c9c9d

fuse-overlayfs-debugsource-1.4.0-2.module+el8.4.0+14872+9efa52a3.x86_64.rpm

SHA-256: a393deda4309736a8d5028d55c8261bcdeef2d55d477cadfe011d39e6cb81be9

libslirp-4.3.1-1.module+el8.4.0+14872+9efa52a3.x86_64.rpm

SHA-256: 4aaddf293196ffc9f1224fec7acc9a16b7173cd77f2bb6eb19c9fae6b7419669

libslirp-debuginfo-4.3.1-1.module+el8.4.0+14872+9efa52a3.x86_64.rpm

SHA-256: 85bea24636dbdb57b177d7b4971e0034f650778444e399a1d988eeeceb7602a9

libslirp-debugsource-4.3.1-1.module+el8.4.0+14872+9efa52a3.x86_64.rpm

SHA-256: 23a15295a86435f0f1eb9fa5fdfb477b0c1c53cb8fedf34d26c12b8602c855ea

libslirp-devel-4.3.1-1.module+el8.4.0+14872+9efa52a3.x86_64.rpm

SHA-256: f1db6037fb8f0b6bf621f9c33fd9bad1eb27037332e60dd44a5aef111b527962

oci-seccomp-bpf-hook-1.2.0-1.module+el8.4.0+14872+9efa52a3.x86_64.rpm

SHA-256: c935632a3fceeabeb76d943b94c83fc121166975c39a1f5734a4fb8c55d20397

oci-seccomp-bpf-hook-debuginfo-1.2.0-1.module+el8.4.0+14872+9efa52a3.x86_64.rpm

SHA-256: 108a8454d6780176dc6cd6756a70223b698fcad3f46ddb815c773bb36be70a9f

oci-seccomp-bpf-hook-debugsource-1.2.0-1.module+el8.4.0+14872+9efa52a3.x86_64.rpm

SHA-256: b80f36585cb267eb4b593c5cd31cb1317f8e502c385997abde925bf354edb871

podman-3.0.1-9.module+el8.4.0+14872+9efa52a3.x86_64.rpm

SHA-256: e9d07720dd90cb631ac47dccafc2075f045bd13226c3a5e33691bcf34a48ba94

podman-catatonit-3.0.1-9.module+el8.4.0+14872+9efa52a3.x86_64.rpm

SHA-256: 8509a298f118e9a475a8e13ff26f1b00e3f1aa3f3c129adb7c4df2a3dc6f79a2

podman-catatonit-debuginfo-3.0.1-9.module+el8.4.0+14872+9efa52a3.x86_64.rpm

SHA-256: 9cb4cb360cd82528d59b32772c80342eb2ca3ac4e83b9e9f5d8d850a87ba8df1

podman-debuginfo-3.0.1-9.module+el8.4.0+14872+9efa52a3.x86_64.rpm

SHA-256: d00b45047c977cff58da7be7669e2f20e381d73947f83a1cefcc263077c05bca

podman-debugsource-3.0.1-9.module+el8.4.0+14872+9efa52a3.x86_64.rpm

SHA-256: 5d61a31b24b469343b1178362ab4b26555281c6d0c178920c0607f74f9dc2dd1

podman-plugins-3.0.1-9.module+el8.4.0+14872+9efa52a3.x86_64.rpm

SHA-256: 458c1dfbb23e60fc8d5b204841963fc1641b0ae537b0c158446143f18f442e60

podman-plugins-debuginfo-3.0.1-9.module+el8.4.0+14872+9efa52a3.x86_64.rpm

SHA-256: b84980073a9fe72667ab8cd3c8e75ae1aa0bad04ab46f2fc4d12d43f97da6910

podman-remote-3.0.1-9.module+el8.4.0+14872+9efa52a3.x86_64.rpm

SHA-256: 3ae0e5a9d71c0d8ac04f5df5b8f0146f22f764860543d17f595521cb4eaafeec

podman-remote-debuginfo-3.0.1-9.module+el8.4.0+14872+9efa52a3.x86_64.rpm

SHA-256: d7de9890946062477d74a4b5c525813e73e6951f7adefe02d3ae5d3c69f73fc4

podman-tests-3.0.1-9.module+el8.4.0+14872+9efa52a3.x86_64.rpm

SHA-256: 6222997cda0aceb41fdf1cf5752288eb65cd71f3c7c5224c65a07e233416d578

python3-criu-3.15-1.module+el8.4.0+14872+9efa52a3.x86_64.rpm

SHA-256: f7e49f00d0c61f8dd218aef9dfa93fd43f9ddb511a5bf605a270746fbdf20202

runc-1.0.0-76.rc95.module+el8.4.0+14872+9efa52a3.x86_64.rpm

SHA-256: 8dcc1d67b032864f9d7888cd0ca5201baad038751a4f92b0a9fd8e6c8743d271

runc-debuginfo-1.0.0-76.rc95.module+el8.4.0+14872+9efa52a3.x86_64.rpm

SHA-256: eb7ec2f772c30bc01d9ed54c3b0b6b3f908a05bb46b2df33582f854dd35052ab

runc-debugsource-1.0.0-76.rc95.module+el8.4.0+14872+9efa52a3.x86_64.rpm

SHA-256: d9f14fd64c459630f4464395cacb2c66f7986629928ff8800b8cc64d2a44cc40

skopeo-1.2.2-8.module+el8.4.0+14872+9efa52a3.x86_64.rpm

SHA-256: a309fefc4c525161c94fe0ad56ae592cb653831910fb9d58b6146dc896a43096

skopeo-debuginfo-1.2.2-8.module+el8.4.0+14872+9efa52a3.x86_64.rpm

SHA-256: ab0452c9dea2d1f2c0b7b49449a9f8552751e5ec9154ae7f5fff2fc97957fb52

skopeo-debugsource-1.2.2-8.module+el8.4.0+14872+9efa52a3.x86_64.rpm

SHA-256: b1764d46a53dde97fc9f6e6349cbfbabfbeff39f908b97d339c3216006623d18

skopeo-tests-1.2.2-8.module+el8.4.0+14872+9efa52a3.x86_64.rpm

SHA-256: bba357cea9283534c2e2895c6e9b230d1ff34c7acccf9027da55bbc1184c921c

slirp4netns-1.1.8-1.module+el8.4.0+14872+9efa52a3.x86_64.rpm

SHA-256: f864acbf0812a481df9ef75c4f507ef0ec4b6c253018a6af86fa7b353e60a62b

slirp4netns-debuginfo-1.1.8-1.module+el8.4.0+14872+9efa52a3.x86_64.rpm

SHA-256: 31fb9b23624e5332584aee872c8ec23dd5c81d150ab2979cac2d5b5633d748c2

slirp4netns-debugsource-1.1.8-1.module+el8.4.0+14872+9efa52a3.x86_64.rpm

SHA-256: a5faba81647a70d1e53f12660f9cbada3d9af634ddcb69027e3e88391ebb43bb

Red Hat Enterprise Linux Server - AUS 8.4