Important: Red Hat Security Advisory: Updated 8.0 container image is now available in the Red Hat Ecosystem Catalog.

Updated rhceph-8.0 container image is now available in the Red Hat Ecosystem Catalog. Red Hat Ceph Storage is a scalable, open, software-defined storage platform that combines the most stable version of the Ceph storage system with a Ceph management platform, deployment utilities, and support...

Moderate: Red Hat Bug Fix Advisory: Updated rhel9/firefox-flatpak container image

An updated rhel9/firefox-flatpak container image is now available in the Red Hat container registry. Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Flatpak is a system for running graphical applications as containers. Installing an...

Moderate: Red Hat Bug Fix Advisory: Updated rhel9/thunderbird-flatpak container image

An updated rhel9/thunderbird-flatpak container image is now available in the Red Hat container registry. Mozilla Thunderbird is a standalone mail and newsgroup client. Flatpak is a system for running graphical applications as containers. Installing an application as a Flatpak rather than as an...

Security Bulletin: IBM Instana Observability is affected by multiple vulnerabilities within Instana Agent container image

Summary Multiple vulnerabilities were remediated in IBM Observability with Instana within Instana Agent container image build 286 Vulnerability Details CVEID:CVE-2024-43382 DESCRIPTION: Snowflake JDBC driver could provide weaker than expected security, caused by an incorrect security setting. A...

Arbitrary File Creation

github.com/nvidia/nvidia-container-toolkit is vulnerable to arbitrary file creation. The vulnerability is due to the default mode of operation, which allows a specially crafted container image to interact with the host file system and create empty files...

ALSA-2024:9098 Moderate: skopeo security update

The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files. Security Fixes: containers/image: digest type does not guarantee valid type CVE-2024-3727 golang: net: malformed DNS message can cause infinite...

ALSA-2024:9097 Moderate: buildah security update

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a...

RHEL 9 : buildah (RHSA-2024:9459)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:9459 advisory. The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a...

RHEL 9 : podman (RHSA-2024:9102)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:9102 advisory. The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use contain...

Moderate: skopeo security update

The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files. Security Fixes: containers/image: digest type does not guarantee valid type CVE-2024-3727 golang: net: malformed DNS message can cause infinite...

Low: Red Hat Bug Fix Advisory: updated el9/flatpak-sdk container image

Updated el9/flatpak-sdk container image is now available for Red Hat Enterprise Linux 9. The el9/flatpak-sdk container image has been updated for Red Hat Enterprise Linux 9 to address the following security advisory: RHSA-2024:8617 see References Users of el9/flatpak-sdk container images are...

AZL-52393 CVE-2024-0134 affecting package nvidia-container-toolkit for versions less than 1.17.1-1

NVIDIA Container Toolkit and NVIDIA GPU Operator for Linux contain a UNIX vulnerability where a specially crafted container image can lead to the creation of unauthorized files on the host. The name and location of the files cannot be controlled by an attacker. A successful exploit of this...

NVIDIA Container Toolkit contains a Time-of-check Time-of-Use (TOCTOU) vulnerability

NVIDIA Container Toolkit 1.16.1 or earlier contains a Time-of-check Time-of-Use TOCTOU vulnerability when used with default configuration where a specifically crafted container image may gain access to the host file system. This does not impact use cases where CDI is used. A successful exploit of...

NVIDIA Container Toolkit allows specially crafted container image to create empty files on the host file system

NVIDIA Container Toolkit 1.16.1 or earlier contains a vulnerability in the default mode of operation allowing a specially crafted container image to create empty files on the host file system. This does not impact use cases where CDI is used. A successful exploit of this vulnerability may lead to...

skopeo security update

An update is available for skopeo. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The skopeo command lets you inspect images from container image registries, ge...

Moderate: Red Hat Bug Fix Advisory: Updated rhel8/gimp-flatpak container image

An updated rhel8/gimp-flatpak container image is now available in the Red Hat container registry. To pull a container image, run the following command: podman pull registry.redhat.io/...

Important: Red Hat Bug Fix Advisory: Updated rhel9/thunderbird-flatpak container image

An updated rhel9/thunderbird-flatpak container image is now available in the Red Hat container registry. Mozilla Thunderbird is a standalone mail and newsgroup client. Flatpak is a system for running graphical applications as containers. Installing an application as a Flatpak rather than as an...

Important: Red Hat Security Advisory: skopeo security update

An update for skopeo is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

RHEL 9 : skopeo (RHSA-2024:8111)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:8111 advisory. The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify file...

CentOS 7 : buildah (RHSA-2020:2116)

The remote CentOS Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2020:2116 advisory. - A path traversal flaw was found in Buildah in versions before 1.14.5. This flaw allows an attacker to trick a user into building a malicious containe...