Lucene search

K
oraclelinuxOracleLinuxELSA-2021-0706
HistoryMar 05, 2021 - 12:00 a.m.

container-tools:2.0 security update

2021-03-0500:00:00
linux.oracle.com
165

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

9.3 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

buildah
[1.11.6-8.0.1]

  • Reduce unnecessary writable mounts in NaiveDiffDriver [Orabug: 31025483]
  • Fixes troubles with oracle registry login [Orabug: 29937283]
    [1.11.6-8]
  • exclude i686 arch
  • Related: #1821193
    [1.11.6-7]
  • fix ‘CVE-2020-10696 buildah: crafted input tar file may lead to local file overwriting during image build process’
  • Resolves: #1819393
    [1.11.6-6]
  • fix ‘COPY command takes long time with buildah’
  • Resolves: #1806118
    [1.11.6-5]
  • fix CVE-2020-1702
  • Resolves: #1801930
  • adding the first phase of FIPS fix
  • Related: #1784952
    [1.11.6-4]
  • compile in FIPS mode
  • Related: RHELPLAN-25139
    [1.11.6-3]
  • be sure to use golang >= 1.12.12-4
  • Related: RHELPLAN-25139
    [1.11.6-2]
  • fix chroot: unmount with MNT_DETACH instead of UnmountMountpoints()
  • bug reference 1772179
  • Related: RHELPLAN-25139
    [1.11.6-1]
  • update to buildah 1.11.6
  • Related: RHELPLAN-25139
    [1.11.5-1]
  • update to buildah 1.11.5
  • Related: RHELPLAN-25139
    [1.11.4-2]
  • fix %gobuild macro to not to ignore BUILDTAGS
  • Related: RHELPLAN-25139
    [1.11.4-1]
  • update to 1.11.4
  • Related: RHELPLAN-25139
    [1.9.0-5]
  • Use autosetup macro again.
    [1.9.0-4]
  • Fix CVE-2019-10214 (#1734653).
    [1.9.0-3]
  • Resolves: #1721247 - enable fips mode
    [1.9.0-2]
  • Resolves: #1720654 - tests subpackage depends on golang explicitly
    [1.9.0-1]
  • Resolves: #1720654 - rebase to v1.9.0
    [1.8.3-1]
  • Resolves: #1720654 - rebase to v1.8.3
    [1.8-0.git021d607]
  • package system tests
    [1.5-3.gite94b4f9]
  • re-enable debuginfo
    [1.5-2.gite94b4f9]
  • go toolset not in scl anymore
    [1.5-1.gite94b4f9]
  • rebase
    [1.4-3.git608fa84]
  • fedora-like go compiler macro in buildrequires is enough
    [1.4-2.git608fa84]
  • rebase
    [1.3-3.git4888163]
  • Resolves: #1615611 - rebuild with gobuild tag ‘no_openssl’
    [1.3-2.git4888163]
  • Resolves: #1614009 - built with updated scl-ized go-toolset dep
  • build with %gobuild
    [1.3-1]
  • Bump to v1.3
  • Vendor in lates containers/image
  • build-using-dockerfile: let -t include transports again
  • Block use of /proc/acpi and /proc/keys from inside containers
  • Fix handling of --registries-conf
  • Fix becoming a maintainer link
  • add optional CI test fo darwin
  • Don’t pass a nil error to errors.Wrapf()
  • image filter test: use kubernetes/pause as a ‘since’
  • Add --cidfile option to from
  • vendor: update containers/storage
  • Contributors need to find the CONTRIBUTOR.md file easier
  • Add a --loglevel option to build-with-dockerfile
  • Create Development plan
  • cmd: Code improvement
  • allow buildah cross compile for a darwin target
  • Add unused function param lint check
  • docs: Follow man-pages(7) suggestions for SYNOPSIS
  • Start using github.com/seccomp/containers-golang
  • umount: add all option to umount all mounted containers
  • runConfigureNetwork(): remove an unused parameter
  • Update github.com/opencontainers/selinux
  • Fix buildah bud --layers
  • Force ownership of /etc/hosts and /etc/resolv.conf to 0:0
  • main: if unprivileged, reexec in a user namespace
  • Vendor in latest imagebuilder
  • Reduce the complexity of the buildah.Run function
  • mount: output it before replacing lastError
  • Vendor in latest selinux-go code
  • Implement basic recognition of the ‘–isolation’ option
  • Run(): try to resolve non-absolute paths using /usr/local/bin:/usr/bin:/usr/local/sbin:/usr/sbin:/home/opc/.local/bin:/home/opc/bin
  • Run(): don’t include any default environment variables
  • build without seccomp
  • vendor in latest runtime-tools
  • bind/mount_unsupported.go: remove import errors
  • Update github.com/opencontainers/runc
  • Add Capabilities lists to BuilderInfo
  • Tweaks for commit tests
  • commit: recognize committing to second storage locations
  • Fix ARGS parsing for run commands
  • Add info on registries.conf to from manpage
  • Switch from using docker to podman for testing in .papr
  • buildah: set the HTTP User-Agent
  • ONBUILD tutorial
  • Add information about the configuration files to the install docs
  • Makefile: add uninstall
  • Add tilde info for push to troubleshooting
  • mount: support multiple inputs
  • Use the right formatting when adding entries to /etc/hosts
  • Vendor in latest go-selinux bindings
  • Allow --userns-uid-map/–userns-gid-map to be global options
  • bind: factor out UnmountMountpoints
  • Run(): simplify runCopyStdio()
  • Run(): handle POLLNVAL results
  • Run(): tweak terminal mode handling
  • Run(): rename ‘copyStdio’ to ‘copyPipes’
  • Run(): don’t set a Pdeathsig for the runtime
  • Run(): add options for adding and removing capabilities
  • Run(): don’t use a callback when a slice will do
  • setupSeccomp(): refactor
  • Change RunOptions.Stdin/Stdout/Stderr to just be Reader/Writers
  • Escape use of ‘_’ in .md docs
  • Break out getProcIDMappings()
  • Break out SetupIntermediateMountNamespace()
  • Add Multi From Demo
  • Use the c/image conversion code instead of converting configs manually
  • Don’t throw away the manifest MIME type and guess again
  • Consolidate loading manifest and config in initConfig
  • Pass a types.Image to Builder.initConfig
  • Require an image ID in importBuilderDataFromImage
  • Use c/image/manifest.GuessMIMEType instead of a custom heuristic
  • Do not ignore any parsing errors in initConfig
  • Explicitly handle ‘from scratch’ images in Builder.initConfig
  • Fix parsing of OCI images
  • Simplify dead but dangerous-looking error handling
  • Don’t ignore v2s1 history if docker_version is not set
  • Add --rm and --force-rm to buildah bud
  • Add --all,-a flag to buildah images
  • Separate stdio buffering from writing
  • Remove tty check from images --format
  • Add environment variable BUILDAH_RUNTIME
  • Add --layers and --no-cache to buildah bud
  • Touch up images man
  • version.md: fix DESCRIPTION
  • tests: add containers test
  • tests: add images test
  • images: fix usage
  • fix make clean error
  • Change ‘registries’ to ‘container registries’ in man
  • add commit test
  • Add(): learn to record hashes of what we add
  • Minor update to buildah config documentation for entrypoint
  • Bump to v1.2-dev
  • Add registries.conf link to a few man pages
    [1.2-3]
  • do not depend on btrfs-progs for rhel8
    [1.2-2]
  • buildah does not require ostree
    [1.2-1]
  • Vendor in latest containers/image
  • build-using-dockerfile: let -t include transports again
  • Block use of /proc/acpi and /proc/keys from inside containers
  • Fix handling of --registries-conf
  • Fix becoming a maintainer link
  • add optional CI test fo darwin
  • Don’t pass a nil error to errors.Wrapf()
  • image filter test: use kubernetes/pause as a ‘since’
  • Add --cidfile option to from
  • vendor: update containers/storage
  • Contributors need to find the CONTRIBUTOR.md file easier
  • Add a --loglevel option to build-with-dockerfile
  • Create Development plan
  • cmd: Code improvement
  • allow buildah cross compile for a darwin target
  • Add unused function param lint check
  • docs: Follow man-pages(7) suggestions for SYNOPSIS
  • Start using github.com/seccomp/containers-golang
  • umount: add all option to umount all mounted containers
  • runConfigureNetwork(): remove an unused parameter
  • Update github.com/opencontainers/selinux
  • Fix buildah bud --layers
  • Force ownership of /etc/hosts and /etc/resolv.conf to 0:0
  • main: if unprivileged, reexec in a user namespace
  • Vendor in latest imagebuilder
  • Reduce the complexity of the buildah.Run function
  • mount: output it before replacing lastError
  • Vendor in latest selinux-go code
  • Implement basic recognition of the ‘–isolation’ option
  • Run(): try to resolve non-absolute paths using /usr/local/bin:/usr/bin:/usr/local/sbin:/usr/sbin:/home/opc/.local/bin:/home/opc/bin
  • Run(): don’t include any default environment variables
  • build without seccomp
  • vendor in latest runtime-tools
  • bind/mount_unsupported.go: remove import errors
  • Update github.com/opencontainers/runc
  • Add Capabilities lists to BuilderInfo
  • Tweaks for commit tests
  • commit: recognize committing to second storage locations
  • Fix ARGS parsing for run commands
  • Add info on registries.conf to from manpage
  • Switch from using docker to podman for testing in .papr
  • buildah: set the HTTP User-Agent
  • ONBUILD tutorial
  • Add information about the configuration files to the install docs
  • Makefile: add uninstall
  • Add tilde info for push to troubleshooting
  • mount: support multiple inputs
  • Use the right formatting when adding entries to /etc/hosts
  • Vendor in latest go-selinux bindings
  • Allow --userns-uid-map/–userns-gid-map to be global options
  • bind: factor out UnmountMountpoints
  • Run(): simplify runCopyStdio()
  • Run(): handle POLLNVAL results
  • Run(): tweak terminal mode handling
  • Run(): rename ‘copyStdio’ to ‘copyPipes’
  • Run(): don’t set a Pdeathsig for the runtime
  • Run(): add options for adding and removing capabilities
  • Run(): don’t use a callback when a slice will do
  • setupSeccomp(): refactor
  • Change RunOptions.Stdin/Stdout/Stderr to just be Reader/Writers
  • Escape use of ‘_’ in .md docs
  • Break out getProcIDMappings()
  • Break out SetupIntermediateMountNamespace()
  • Add Multi From Demo
  • Use the c/image conversion code instead of converting configs manually
  • Don’t throw away the manifest MIME type and guess again
  • Consolidate loading manifest and config in initConfig
  • Pass a types.Image to Builder.initConfig
  • Require an image ID in importBuilderDataFromImage
  • Use c/image/manifest.GuessMIMEType instead of a custom heuristic
  • Do not ignore any parsing errors in initConfig
  • Explicitly handle ‘from scratch’ images in Builder.initConfig
  • Fix parsing of OCI images
  • Simplify dead but dangerous-looking error handling
  • Don’t ignore v2s1 history if docker_version is not set
  • Add --rm and --force-rm to buildah bud
  • Add --all,-a flag to buildah images
  • Separate stdio buffering from writing
  • Remove tty check from images --format
  • Add environment variable BUILDAH_RUNTIME
  • Add --layers and --no-cache to buildah bud
  • Touch up images man
  • version.md: fix DESCRIPTION
  • tests: add containers test
  • tests: add images test
  • images: fix usage
  • fix make clean error
  • Change ‘registries’ to ‘container registries’ in man
  • add commit test
  • Add(): learn to record hashes of what we add
  • Minor update to buildah config documentation for entrypoint
  • Add registries.conf link to a few man pages
    [1.1-1]
  • Drop capabilities if running container processes as non root
  • Print Warning message if cmd will not be used based on entrypoint
  • Update 01-intro.md
  • Shouldn’t add insecure registries to list of search registries
  • Report errors on bad transports specification when pushing images
  • Move parsing code out of common for namespaces and into pkg/parse.go
  • Add disable-content-trust noop flag to bud
  • Change freenode chan to buildah
  • runCopyStdio(): don’t close stdin unless we saw POLLHUP
  • Add registry errors for pull
  • runCollectOutput(): just read until the pipes are closed on us
  • Run(): provide redirection for stdio
  • rmi, rm: add test
  • add mount test
  • Add parameter judgment for commands that do not require parameters
  • Add context dir to bud command in baseline test
  • run.bats: check that we can run with symlinks in the bundle path
  • Give better messages to users when image can not be found
  • use absolute path for bundlePath
  • Add environment variable to buildah --format
  • rm: add validation to args and all option
  • Accept json array input for config entrypoint
  • Run(): process RunOptions.Mounts, and its flags
  • Run(): only collect error output from stdio pipes if we created some
  • Add OnBuild support for Dockerfiles
  • Quick fix on demo readme
  • run: fix validate flags
  • buildah bud should require a context directory or URL
  • Touchup tutorial for run changes
  • Validate common bud and from flags
  • images: Error if the specified imagename does not exist
  • inspect: Increase err judgments to avoid panic
  • add test to inspect
  • buildah bud picks up ENV from base image
  • Extend the amount of time travis_wait should wait
  • Add a make target for Installing CNI plugins
  • Add tests for namespace control flags
  • copy.bats: check ownerships in the container
  • Fix SELinux test errors when SELinux is enabled
  • Add example CNI configurations
  • Run: set supplemental group IDs
  • Run: use a temporary mount namespace
  • Use CNI to configure container networks
  • add/secrets/commit: Use mappings when setting permissions on added content
  • Add CLI options for specifying namespace and cgroup setup
  • Always set mappings when using user namespaces
  • Run(): break out creation of stdio pipe descriptors
  • Read UID/GID mapping information from containers and images
  • Additional bud CI tests
  • Run integration tests under travis_wait in Travis
  • build-using-dockerfile: add --annotation
  • Implement --squash for build-using-dockerfile and commit
  • Vendor in latest container/storage for devicemapper support
  • add test to inspect
  • Vendor github.com/onsi/ginkgo and github.com/onsi/gomega
  • Test with Go 1.10, too
  • Add console syntax highlighting to troubleshooting page
  • bud.bats: print ‘’ before checking its contents
  • Manage ‘Run’ containers more closely
  • Break Builder.Run()'s ‘run runc’ bits out
  • util.ResolveName(): handle completion for tagged/digested image names
  • Handle /etc/hosts and /etc/resolv.conf properly in container
  • Documentation fixes
  • Make it easier to parse our temporary directory as an image name
  • Makefile: list new pkg/ subdirectoris as dependencies for buildah
  • containerImageSource: return more-correct errors
  • API cleanup: PullPolicy and TerminalPolicy should be types
  • Make ‘run --terminal’ and ‘run -t’ aliases for ‘run --tty’
  • Vendor github.com/containernetworking/cni v0.6.0
  • Update github.com/containers/storage
  • Update github.com/projectatomic/libpod
  • Add support for buildah bud --label
  • buildah push/from can push and pull images with no reference
  • Vendor in latest containers/image
  • Update gometalinter to fix install.tools error
  • Update troubleshooting with new run workaround
  • Added a bud demo and tidied up
  • Attempt to download file from url, if fails assume Dockerfile
  • Add buildah bud CI tests for ENV variables
  • Re-enable rpm .spec version check and new commit test
  • Update buildah scratch demo to support el7
  • Added Docker compatibility demo
  • Update to F28 and new run format in baseline test
  • Touchup man page short options across man pages
  • Added demo dir and a demo. chged distrorlease
  • builder-inspect: fix format option
  • Add cpu-shares short flag (-c) and cpu-shares CI tests
  • Minor fixes to formatting in rpm spec changelog
  • Fix rpm .spec changelog formatting
  • CI tests and minor fix for cache related noop flags
  • buildah-from: add effective value to mount propagation
    [1.0-1]
  • Remove buildah run cmd and entrypoint execution
  • Add Files section with registries.conf to pertinent man pages
  • Force ‘localhost’ as a default registry
  • Add --compress, --rm, --squash flags as a noop for bud
  • Add FIPS mode secret to buildah run and bud
  • Add config --comment/–domainname/–history-comment/–hostname
  • Add support for --iidfile to bud and commit
  • Add /bin/sh -c to entrypoint in config
  • buildah images and podman images are listing different sizes
  • Remove tarball as an option from buildah push --help
  • Update entrypoint behaviour to match docker
  • Display imageId after commit
  • config: add support for StopSignal
  • Allow referencing stages as index and names
  • Add multi-stage builds support
  • Vendor in latest imagebuilder, to get mixed case AS support
  • Allow umount to have multi-containers
  • Update buildah push doc
  • buildah bud walks symlinks
  • Imagename is required for commit atm, update manpage
    [0.16-3.git532e267]
  • Resolves: #1573681
  • built commit 532e267
    [0.16.0-2.git6f7d05b]
  • built commit 6f7d05b
    [0.16-1]
  • Add support for shell
  • Vendor in latest containers/image
  •    docker-archive generates docker legacy compatible images
    
  • Do not create subdirectories for layers with no configs
  • Ensure the layer IDs in legacy docker/tarfile metadata are unique
  • docker-archive: repeated layers are symlinked in the tar file
  • sysregistries: remove all trailing slashes
  • Improve docker/* error messages
  • Fix failure to make auth directory
  • Create a new slice in Schema1.UpdateLayerInfos
  • Drop unused storageImageDestination.{image,systemContext}
  • Load a *storage.Image only once in storageImageSource
  • Support gzip for docker-archive files
  • Remove .tar extension from blob and config file names
  • ostree, src: support copy of compressed layers
  • ostree: re-pull layer if it misses uncompressed_digest|uncompressed_size
  • image: fix docker schema v1 -> OCI conversion
  • Add /etc/containers/certs.d as default certs directory
  • Change image time to locale, add troubleshooting.md, add logo to other mds
  • Allow --cmd parameter to have commands as values
  • Document the mounts.conf file
  • Fix man pages to format correctly
  • buildah from now supports pulling images using the following transports:
  • docker-archive, oci-archive, and dir.
  • If the user overrides the storage driver, the options should be dropped
  • Show Config/Manifest as JSON string in inspect when format is not set
  • Adds feature to pull compressed docker-archive files
    [0.15-1]
  • Fix handling of buildah run command options
    [0.14-1]
  • If commonOpts do not exist, we should return rather then segfault
  • Display full error string instead of just status
  • Implement --volume and --shm-size for bud and from
  • Fix secrets patch for buildah bud
  • Fixes the naming issue of blobs and config for the dir transport by removing the .tar extension
    [0.13-1.git99066e0]
  • use correct version
    [0.12-4.git99066e0]
  • enable debuginfo
    [0.12-3.git99066e0]
  • BR: libseccomp-devel
    [0.12-2.git99066e0]
  • Resolves: #1548535
  • built commit 99066e0
    [0.12-1]
  • Added handing for simpler error message for Unknown Dockerfile instructions.
  • Change default certs directory to /etc/containers/certs.dir
  • Vendor in latest containers/image
  • Vendor in latest containers/storage
  • build-using-dockerfile: set the ‘author’ field for MAINTAINER
  • Return exit code 1 when buildah-rmi fails
  • Trim the image reference to just its name before calling getImageName
  • Touch up rmi -f usage statement
  • Add --format and --filter to buildah containers
  • Add --prune,-p option to rmi command
  • Add authfile param to commit
  • Fix --runtime-flag for buildah run and bud
  • format should override quiet for images
  • Allow all auth params to work with bud
  • Do not overwrite directory permissions on --chown
  • Unescape HTML characters output into the terminal
  • Fix: setting the container name to the image
  • Prompt for un/pwd if not supplied with --creds
  • Make bud be really quiet
  • Return a better error message when failed to resolve an image
  • Update auth tests and fix bud man page
    [0.11-3.git49095a8]
  • Resolves: #1542236 - add ostree and bump runc dep
    [0.11-2.git49095a8]
  • rebased to 49095a83f8622cf69532352d183337635562e261
    [0.11-1]
  • Add --all to remove containers
  • Add --all functionality to rmi
  • Show ctrid when doing rm -all
  • Ignore sequential duplicate layers when reading v2s1
  • Lots of minor bug fixes
  • Vendor in latest containers/image and containers/storage
    [0.10-2]
  • Fix checkin
    [0.10-1]
  • Display Config and Manifest as strings
  • Bump containers/image
  • Use configured registries to resolve image names
  • Update to work with newer image library
  • Add --chown option to add/copy commands
    [0.9-2.git04ea079]
  • build for all arches
    [0.9-1]
  • Allow push to use the image id
  • Make sure builtin volumes have the correct label
    [0.8-1]
  • Buildah bud was failing on SELinux machines, this fixes this
  • Block access to certain kernel file systems inside of the container
    [0.7-1]
  • Ignore errors when trying to read containers buildah.json for loading SELinux reservations
  • Use credentials from kpod login for buildah
    
  • Adds support for converting manifest types when using the dir transport
  • Rework how we do UID resolution in images
  • Bump github.com/vbatts/tar-split
  • Set option.terminal appropriately in run
    [0.5-5.gitf7dc659]
  • revert building for s390x, it is intended for rhel 7.5
    [0.5-4]
  • Add requires for container-selinux
    [0.5-3.gitf7dc659]
  • build for s390x, https://bugzilla.redhat.com/show_bug.cgi?id=1482234
    [0.5-2]
  • Bump github.com/vbatts/tar-split
  • Fixes CVE That could allow a container image to cause a DOS
    [0.5-1]
  • Add secrets patch to buildah
  • Add proper SELinux labeling to buildah run
  • Add tls-verify to bud command
  • Make filtering by date use the image’s date
  • images: don’t list unnamed images twice
  • Fix timeout issue
  • Add further tty verbiage to buildah run
  • Make inspect try an image on failure if type not specified
  • Add support for
  • Tons of bug fixes and code cleanup
    [0.4-2.git01db066]
  • bump to latest version
  • set GIT_COMMIT at build-time
    [0.4-1.git9cbccf88c]
  • Add default transport to push if not provided
  • Avoid trying to print a nil ImageReference
  • Add authentication to commit and push
  • Add information on buildah from man page on transports
  • Remove --transport flag
  • Run: do not complain about missing volume locations
  • Add credentials to buildah from
  • Remove export command
  • Run(): create the right working directory
  • Improve ‘from’ behavior with unnamed references
  • Avoid parsing image metadata for dates and layers
  • Read the image’s creation date from public API
  • Bump containers/storage and containers/image
  • Don’t panic if an image’s ID can’t be parsed
  • Turn on --enable-gc when running gometalinter
  • rmi: handle truncated image IDs
    [0.4-1.git9cbccf8]
  • bump to v0.4
    [0.3-4.gitb9b2a8a]
  • Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
    [0.3-3.gitb9b2a8a]
  • Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
    [0.3-2.gitb9b2a8a7e]
  • Bump for inclusion of OCI 1.0 Runtime and Image Spec
    [0.2.0-1.gitac2aad6]
  • buildah run: Add support for – ending options parsing
  • buildah Add/Copy support for glob syntax
  • buildah commit: Add flag to remove containers on commit
  • buildah push: Improve man page and help information
  • buildah run: add a way to disable PTY allocation
  • Buildah docs: clarify --runtime-flag of run command
  • Update to match newer storage and image-spec APIs
  • Update containers/storage and containers/image versions
  • buildah export: add support
  • buildah images: update commands
  • buildah images: Add JSON output option
  • buildah rmi: update commands
  • buildah containers: Add JSON output option
  • buildah version: add command
  • buildah run: Handle run without an explicit command correctly
  • Ensure volume points get created, and with perms
  • buildah containers: Add a -a/–all option
    [0.1.0-2.git597d2ab9]
  • Release Candidate 1
  • All features have now been implemented.
    [0.0.1-1.git7a0a5333]
  • First package for Fedora
    cockpit-podman
    conmon
    containernetworking-plugins
    [0.8.3-4.0.1]
  • Disable debuginfo
    [0.8.3-4]
  • compile with no_openssl
  • Related: RHELPLAN-25139
    [0.8.3-3]
  • compile in FIPS mode
  • Related: RHELPLAN-25139
    [0.8.3-2]
  • be sure to use golang >= 1.12.12-4
  • Related: RHELPLAN-25139
    [0.8.3-1]
  • update to 0.8.3
  • Related: RHELPLAN-25139
    [0.8.1-2]
  • backport https://github.com/coreos/go-iptables/pull/62
    from Michael Cambria
  • Resolves: #1627561
    [0.8.1-1]
  • Resolves: #1720319 - bump to v0.8.1
    [0.7.5-1]
  • Resolves: #1616063
  • bump to v0.7.5
    [0.7.4-3.git9ebe139]
  • re-enable debuginfo
    [0.7.4-2.git9ebe139]
  • rebase, removed patch that is already upstream
    [0.7.3-7.git19f2f28]
  • go tools not in scl anymore
    [0.7.3-6.git19f2f28]
  • correct tag specification format in %gobuild macro
    [0.7.3-5.git19f2f28]
  • Resolves: #1616062 - patch to revert coreos/go-iptables bump
    [0.7.3-4.git19f2f28]
  • Resolves:#1603012
  • fix versioning, upstream got it wrong at 7.2
    [0.7.2-3.git19f2f28]
  • disable i686 temporarily for appstream builds
  • update golang deps and gobuild definition
    [0.7.2-2.git19f2f28]
  • rebase
    [0.7.0-103.gitdd8ff8a]
  • enable scl with the toolset
    [0.7.0-102.gitdd8ff8a]
  • remove devel and unittest subpackages
  • use new go-toolset deps
    [0.7.0-101]
  • rebase
  • patches already upstream, removed
    [0.6.0-6]
  • Imported from Fedora
  • Renamed CNI -> plugins
    [0.6.0-4]
  • Own the libexec cni directory
    [0.6.0-3]
  • Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
    [0.6.0-2]
  • skip settling IPv4 addresses
    [0.6.0-1]
  • rebased to 7480240de9749f9a0a5c8614b17f1f03e0c06ab9
    [0.5.2-7]
  • do not install to /opt (against Fedora Guidelines)
    [0.5.2-6]
  • Enable devel subpackage
    [0.5.2-5]
  • Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
    [0.5.2-4]
  • Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
    [0.5.2-3]
  • excludearch: ppc64 as it’s not in goarches anymore
  • re-enable s390x
    [0.5.2-2]
  • upstream moved to github.com/containernetworking/plugins
  • built commit dcf7368
  • provides: containernetworking-plugins
  • use vendored deps because they’re a lot less of a PITA
  • excludearch: s390x for now (rhbz#1466865)
    [0.5.2-1]
  • Update to 0.5.2
  • Softlink to default /opt/cni/bin directories
    [0.5.1-1]
  • Initial package
    container-selinux
    criu
    fuse-overlayfs
    podman
    [1.6.4-26.0.1]
  • Reduce unnecessary writable mounts in NaiveDiffDriver [Orabug: 31025483]
  • delivering fix for [Orabug: 29874238] by Nikita Gerasimov
    [1.6.4-26]
  • update to the latest content of https://github.com/containers/podman/tree/v1.6.4-rhel
    (https://github.com/containers/podman/commit/bcbbbc4)
  • Related: #1920382
    [1.6.4-25]
  • fix CVE-2021-20188
  • update to the latest content of https://github.com/containers/podman/tree/v1.6.4-rhel
    (https://github.com/containers/podman/commit/2c7b579)
  • Related: #1920382
    python-podman-api
    [1.2.0-0.2.gitd0a45fe]
  • revert update to 1.6.0 due to new python3-pbr dependency which
    is not in RHEL
  • Related: RHELPLAN-25139
    [1.2.0-0.1.gitd0a45fe]
  • Initial package
    runc
    skopeo
    [1:0.1.41-4.0.1]
  • Reduce unnecessary writable mounts in NaiveDiffDriver [Orabug: 31025483]
  • Add oracle registry into the conf file [Orabug: 29845934 31306708]
  • Fix oracle registry login issues [Orabug: 29937192]
    [1:0.1.41-4]
  • add docker.io into the default registry list
  • Resolves: #1886443
    [1:0.1.41-3]
  • patch broken gating tests: improper ‘jq’ usage, and use ‘registry:2.6’
    (instead of :2) to work around broken image pushed by docker
    [1:0.1.41-2]
  • exclude i686 arch
  • Related: #1821193
    [1:0.1.41-1]
  • update to 0.1.41
  • Related: #1821193
    [1:0.1.40-8]
  • modify registries.conf default configuration to be more secure by default
  • Resolves: #1810056
    [1:0.1.40-7]
  • Fix CVE-2020-1702.
  • Resolves: #1801928
    [1:0.1.40-6]
  • change the search order of registries and remove quay.io (#1784267)
    [1:0.1.40-5]
  • compile in FIPS mode
  • Related: RHELPLAN-25139
    [1:0.1.40-4]
  • be sure to use golang >= 1.12.12-4
  • Related: RHELPLAN-25139
    [1:0.1.40-3]
  • fix file list
  • Related: RHELPLAN-25139
    [1:0.1.40-2]
  • comment out mountopt option in order to fix gating tests
    see bug 1769769
  • Related: RHELPLAN-25139
    [1:0.1.40-1]
  • update to 0.1.40
  • Related: RHELPLAN-25139
    [1:0.1.37-5]
  • Fix CVE-2019-10214 (#1734651).
    [1:0.1.37-4]
  • fix permissions of rhel/secrets
    Resolves: #1691543
    [1:0.1.37-3]
  • Resolves: #1719994 - add registry.access.redhat.com to registries.conf
    [1:0.1.37-2]
  • Resolves: #1721247 - enable fips mode
    [1:0.1.37-1]
  • Resolves: #1720654 - rebase to v0.1.37
    [1:0.1.36-1.git6307635]
  • built upstream tag v0.1.36, including system tests
    [1:0.1.32-4.git1715c90]
  • Fixes @openshift/machine-config-operator#669
  • install /etc/containers/oci/hooks.d and /etc/containers/certs.d
    [1:0.1.32-3.git1715c90]
  • rebase
    [1:0.1.32-2.git1715c90]
  • re-enable debuginfo
    [1:0.1.31-12.gitb0b750d]
  • go tools not in scl anymore
    [1:0.1.31-11.gitb0b750d]
  • Resolves: #1615609
  • built upstream tag v0.1.31
    [1:0.1.31-10.git0144aa8]
  • Resolves: #1616069 - correct order of registries
    [1:0.1.31-9.git0144aa8]
  • Resolves: #1615609 - rebuild with gobuild tag ‘no_openssl’
    [1:0.1.31-8.git0144aa8]
  • Resolves: #1614934 - containers-common soft dep on slirp4netns and
    fuse-overlayfs
    [1:0.1.31-7.git0144aa8]
  • build with %gobuild
  • use scl-ized go-toolset as dep
  • disable i686 builds temporarily because of go-toolset issues
    [1:0.1.31-6.git0144aa8]
  • add statx to seccomp.json to containers-config
  • add seccomp.json to containers-config
    [1:0.1.31-4.git0144aa8]
  • Resolves: #1597629 - handle dependency issue for skopeo-containers
  • rename skopeo-containers to containers-common as in Fedora
    [1:0.1.31-3.git0144aa8]
  • Resolves: #1583762 - btrfs dep removal needs exclude_graphdriver_btrfs
    buildtag
    [1:0.1.31-2.git0144aa8]
  • correct bz in previous changelog
    [1:0.1.31-1.git0144aa8]
  • Resolves: #1580938 - resolve FTBFS
  • Resolves: #1583762 - remove dependency on btrfs-progs-devel
  • bump to v0.1.31 (from master)
  • built commit ca3bff6
  • use go-toolset deps for rhel8
    [0.1.29-5.git7add6fc]
  • Fix small typo in registries.conf
    [0.1.29-4.git]
  • Add policy.json.5
    [0.1.29-3.git]
  • Add registries.conf
    [0.1.29-2.git]
  • Add registries.conf man page
    [0.1.29-1.git]
  • bump to 0.1.29-1
  • Updated containers/image
    docker-archive generates docker legacy compatible images
    Do not create subdirectories for layers with no configs
    Ensure the layer IDs in legacy docker/tarfile metadata are unique
    docker-archive: repeated layers are symlinked in the tar file
    sysregistries: remove all trailing slashes
    Improve docker/* error messages
    Fix failure to make auth directory
    Create a new slice in Schema1.UpdateLayerInfos
    Drop unused storageImageDestination.{image,systemContext}
    Load a *storage.Image only once in storageImageSource
    Support gzip for docker-archive files
    Remove .tar extension from blob and config file names
    ostree, src: support copy of compressed layers
    ostree: re-pull layer if it misses uncompressed_digest|uncompressed_size
    image: fix docker schema v1 -> OCI conversion
    Add /etc/containers/certs.d as default certs directory
    [0.1.28-2.git0270e56]
  • Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
    [0.1.28-1.git]
  • Vendor in fixed libraries in containers/image and containers/storage
    [0.1.27-1.git]
  • Fix Conflicts to Obsoletes
  • Add better docs to man pages.
  • Use credentials from authfile for skopeo commands
  • Support storage=‘’ in /etc/containers/storage.conf
  • Add global --override-arch and --override-os options
    [0.1.25-2.git2e8377a7]
  • Add manifest type conversion to skopeo copy
  • User can select from 3 manifest types: oci, v2s1, or v2s2
  • e.g skopeo copy --format v2s1 --compress-blobs docker-archive:alp.tar dir:my-directory
    [0.1.25-2.git7fd6f66b]
  • Force storage.conf to default to overlay
    [0.1.25-1.git7fd6f66b]
  • Fix CVE in tar-split
  • copy: add shared blob directory support for OCI sources/destinations
  • Aligning Docker version between containers/image and skopeo
  • Update image-tools, and remove the duplicate Sirupsen/logrus vendor
  • makefile: use -buildmode=pie
    [0.1.24-8.git28d4e08a]
  • Add /usr/share/containers/mounts.conf
    [0.1.24-7.git28d4e08a]
  • Bug fixes
  • Update to release
    [0.1.24-6.dev.git28d4e08]
  • skopeo-containers conflicts with docker-rhsubscription <= 2:1.13.1-31
    [0.1.24-5.dev.git28d4e08]
  • Add rhel subscription secrets data to skopeo-containers
    [0.1.24-4.dev.git28d4e08]
  • Update container/storage.conf and containers-storage.conf man page
  • Default override to true so it is consistent with RHEL.
    [0.1.24-3.dev.git28d4e08]
  • built commit 28d4e08
    [0.1.24-2.dev.git875dd2e]
  • built commit 875dd2e
  • Resolves: gh#416
    [0.1.24-1.dev.gita41cd0]
  • bump to 0.1.24-dev
  • correct a prior bogus date
  • fix macro in comment warning
    [0.1.23-6.dev.git1bbd87]
  • Change name of storage.conf.5 man page to containers-storage.conf.5, since
    it conflicts with inn package
  • Also remove default to ‘overalay’ in the configuration, since we should
  • allow containers storage to pick the best default for the platform.
    [0.1.23-5.git1bbd87f]
  • Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild
    [0.1.23-4.git1bbd87f]
  • Rebuild with binutils fix for ppc64le (#1475636)
    [0.1.23-3.git1bbd87f]
  • Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild
    [0.1.23-2.dev.git1bbd87]
  • Fix storage.conf man page to be storage.conf.5.gz so that it works.
    [0.1.23-1.dev.git1bbd87]
  • Support for OCI V1.0 Images
  • Update to image-spec v1.0.0 and revendor
  • Fixes for authentication
    [0.1.22-2.dev.git5d24b67]
  • Epoch: 1 for CentOS as CentOS Extras’ build already has epoch set to 1
    [0.1.22-1.dev.git5d24b67]
  • Give more useful help when explaining usage
  • Also specify container-storage as a valid transport
  • Remove docker reference wherever possible
  • vendor in ostree fixes
    [0.1.21-1.dev.git0b73154]
  • Add support for storage.conf and storage-config.5.md from github container storage package
  • Bump to the latest version of skopeo
  • vendor.conf: add ostree-go
  • it is used by containers/image for pulling images to the OSTree storage.
  • fail early when image os does not match host os
  • Improve documentation on what to do with containers/image failures in test-skopeo
  • We now have the docker-archive: transport
  • Integration tests with built registries also exist
  • Support /etc/docker/certs.d
  • update image-spec to v1.0.0-rc6
    [0.1.20-1.dev.git0224d8c]
  • BZ #1380078 - New release
    [0.1.19-2.dev.git0224d8c]
  • No golang support for ppc64. Adding exclude arch. BZ #1445490
    [0.1.19-1.dev.git0224d8c]
  • bump to v0.1.19-dev
  • built commit 0224d8c
    [0.1.17-3.dev.git2b3af4a]
  • Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild
    [0.1.17-2.dev.git2b3af4a]
  • Rebuild for gpgme 1.18
    [0.1.17-1.dev.git2b3af4a]
  • bump to 0.1.17-dev
    [0.1.14-6.git550a480]
  • Fix BZ#1391932
    [0.1.14-5.git550a480]
  • Conflicts with atomic in skopeo-containers
    [0.1.14-4.git550a480]
  • built skopeo-containers
    [0.1.14-3.gitd830391]
  • built mtrmac/integrate-all-the-things commit d830391
    [0.1.14-2.git362bfc5]
  • built commit 362bfc5
    [0.1.14-1.gitffe92ed]
  • build origin/master commit ffe92ed
    [0.1.13-6]
  • https://fedoraproject.org/wiki/Changes/golang1.7
    [0.1.13-5]
  • include go-srpm-macros and compiler(go-compiler) in fedora conditionals
  • define %gobuild if not already
  • add patch to build with older version of golang
    [0.1.13-4]
  • update to v0.1.12
    [0.1.12-3]
  • fix go build source path
    [0.1.12-2]
  • update to v0.1.12
    [0.1.11-1]
  • update to v0.1.11
    [0.1.10-1]
  • update to v0.1.10
  • change runcom -> projectatomic
    [0.1.9-1]
  • update to v0.1.9
    [0.1.8-1]
  • update to v0.1.8
    [0.1.4-2]
  • https://fedoraproject.org/wiki/Changes/golang1.6
    [0.1.4]
  • First package for Fedora
    slirp4netns
    udica

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

9.3 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C