Important: container-tools:rhel8 security update

2024-05-2200:00:00

errata.almalinux.org

container-tools rhel8 security podman buildah skopeo runc cve-2024-1753 cve-2022-2880 cve-2022-41715 cve-2024-24786 cve-2024-28180

8.6 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

6.9 Medium

AI Score

Confidence

Low

0.002 Low

EPSS

Percentile

60.1%

JSON

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

buildah: full container escape at build time (CVE-2024-1753)
golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters (CVE-2022-2880)
golang: regexp/syntax: limit memory used by parsing regexps (CVE-2022-41715)
golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON (CVE-2024-24786)
jose-go: improper handling of highly compressed data (CVE-2024-28180)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

OSVersionArchitecturePackageVersionFilename
almalinux8noarchudica< 0.2.6-21.module_el8.10.0+3845+87b84552udica-0.2.6-21.module_el8.10.0+3845+87b84552.noarch.rpm
almalinux8noarchpython3-podman< 4.9.0-1.module_el8.10.0+3792+03eaed9cpython3-podman-4.9.0-1.module_el8.10.0+3792+03eaed9c.noarch.rpm
almalinux8noarchcontainer-selinux< 2.229.0-2.module_el8.10.0+3792+03eaed9ccontainer-selinux-2.229.0-2.module_el8.10.0+3792+03eaed9c.noarch.rpm
almalinux8aarch64podman-gvproxy< 4.9.4-1.module_el8.10.0+3845+87b84552podman-gvproxy-4.9.4-1.module_el8.10.0+3845+87b84552.aarch64.rpm
almalinux8aarch64runc< 1.1.12-1.module_el8.10.0+3845+87b84552runc-1.1.12-1.module_el8.10.0+3845+87b84552.aarch64.rpm
almalinux8aarch64crun< 1.14.3-2.module_el8.10.0+3845+87b84552crun-1.14.3-2.module_el8.10.0+3845+87b84552.aarch64.rpm
almalinux8aarch64skopeo< 1.14.3-2.module_el8.10.0+3845+87b84552skopeo-1.14.3-2.module_el8.10.0+3845+87b84552.aarch64.rpm
almalinux8aarch64toolbox-tests< 0.0.99.5-2.module_el8.10.0+3845+87b84552toolbox-tests-0.0.99.5-2.module_el8.10.0+3845+87b84552.aarch64.rpm
almalinux8aarch64conmon< 2.1.10-1.module_el8.10.0+3845+87b84552conmon-2.1.10-1.module_el8.10.0+3845+87b84552.aarch64.rpm
almalinux8noarchcockpit-podman< 84.1-1.module_el8.10.0+3792+03eaed9ccockpit-podman-84.1-1.module_el8.10.0+3792+03eaed9c.noarch.rpm

OS	Version	Architecture	Package	Version	Filename
almalinux	8	noarch	udica	< 0.2.6-21.module_el8.10.0+3845+87b84552	udica-0.2.6-21.module_el8.10.0+3845+87b84552.noarch.rpm
almalinux	8	noarch	python3-podman	< 4.9.0-1.module_el8.10.0+3792+03eaed9c	python3-podman-4.9.0-1.module_el8.10.0+3792+03eaed9c.noarch.rpm
almalinux	8	noarch	container-selinux	< 2.229.0-2.module_el8.10.0+3792+03eaed9c	container-selinux-2.229.0-2.module_el8.10.0+3792+03eaed9c.noarch.rpm
almalinux	8	aarch64	podman-gvproxy	< 4.9.4-1.module_el8.10.0+3845+87b84552	podman-gvproxy-4.9.4-1.module_el8.10.0+3845+87b84552.aarch64.rpm
almalinux	8	aarch64	runc	< 1.1.12-1.module_el8.10.0+3845+87b84552	runc-1.1.12-1.module_el8.10.0+3845+87b84552.aarch64.rpm
almalinux	8	aarch64	crun	< 1.14.3-2.module_el8.10.0+3845+87b84552	crun-1.14.3-2.module_el8.10.0+3845+87b84552.aarch64.rpm
almalinux	8	aarch64	skopeo	< 1.14.3-2.module_el8.10.0+3845+87b84552	skopeo-1.14.3-2.module_el8.10.0+3845+87b84552.aarch64.rpm
almalinux	8	aarch64	toolbox-tests	< 0.0.99.5-2.module_el8.10.0+3845+87b84552	toolbox-tests-0.0.99.5-2.module_el8.10.0+3845+87b84552.aarch64.rpm
almalinux	8	aarch64	conmon	< 2.1.10-1.module_el8.10.0+3845+87b84552	conmon-2.1.10-1.module_el8.10.0+3845+87b84552.aarch64.rpm
almalinux	8	noarch	cockpit-podman	< 84.1-1.module_el8.10.0+3792+03eaed9c	cockpit-podman-84.1-1.module_el8.10.0+3792+03eaed9c.noarch.rpm