container-tools:rhel8 security update

An update is available for libslirp, module.runc, module.libslirp, runc. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The container-tools module contains tool...

SUSE-SU-2024:0441-1 Security update for kubevirt, virt-api-container, virt-controller-container, virt-exportproxy-container, virt-exportserver-container, virt-handler-container, virt-launcher-container, virt-libguestfs-tools-container, virt-operator-container, virt-pr-helper-container

This update for kubevirt, virt-api-container, virt-controller-container, virt-exportproxy-container, virt-exportserver-container, virt-handler-container, virt-launcher-container, virt-libguestfs-tools-container, virt-operator-container, virt-pr-helper-container fixes the following issues: Update ...

Privilege Escalation

github.com/openshift/apiserver-library-go is vulnerable to Privilege Escalation. The vulnerability is caused due to improper input validation within strategy.go. This could allow low-privileged users to set the seccomp profile for pods they control to unconfined...

kernel: Unprivileged users may use PTRACE_SEIZE to set PTRACE_O_SUSPEND_SECCOMP option

A flaw was found in the Linux kernel. The PTRACESEIZE code path allows attackers to bypass intended restrictions on setting the PTSUSPENDSECCOMP flag, possibly disabling seccomp...

container-tools:4.0 security update

buildah 1:1.24.6-7 - rebuild for CVE-2023-29406 - Related: 2176055 cockpit-podman 46-1 - update to https://github.com/cockpit-project/cockpit-podman/releases/tag/46 - Related: 2061390 conmon 2:2.1.4-2 - update to https://github.com/containers/conmon/releases/tag/v2.1.4 - Related: 2176055...

Security Bulletin: CICS Transaction Gateway Containers are vulnerable to unwanted system calls such as unshare() (CVE-2022-0185).

Summary CICS Transaction Gateway Containers are vulnerable to CVE-2022-0185 if the SECCOMP profile is not configured so as to disable unwanted system calls such as unshare. Vulnerability Details CVEID:CVE-2022-0185 DESCRIPTION: Linux Kernel is vulnerable to a heap-based buffer overflow, caused by...

SUSE-SU-2023:4868-1 Security update for tracker-miners

This update for tracker-miners fixes the following issues: - CVE-2023-5557: Fixed a sandbox escape by adding seccomp rules and applying it to the whole process bsc1216199 - rebuild against current ICU 73...

tracker-miners security update

2.1.5-2.1 - Bump dist 2.1.5-2 - Backport stricter seccomp jail Resolves: RHEL-12466...

tracker-miners security update

3.1.2-4 - Backport stricter seccomp jail Resolves: RHEL-12469...

container-tools:rhel8 bug fix update

An update is available for libslirp, module.buildah, module.crun, buildah, fuse-overlayfs, udica, module.oci-seccomp-bpf-hook, module.netavark, module.runc, conmon, module.containers-common, python-podman, module.libslirp, module.aardvark-dns, module.fuse-overlayfs, runc, criu, aardvark-dns,...

container-tools:4.0 security and bug fix update

buildah 1:1.24.6-7 - rebuild for CVE-2023-29406 - Related: 2176055 1:1.24.6-6 - rebuild for following CVEs: CVE-2022-41724 CVE-2022-41725 CVE-2023-24538 CVE-2023-24534 CVE-2023-24536 CVE-2022-41723 CVE-2023-24539 CVE-2023-24540 CVE-2023-29400 - Resolves: 2179943 - Resolves: 2187341 - Resolves:...

Rocky Linux 9 : kernel-rt (RLSA-2022:7319)

The remote Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:7319 advisory. - The Linux kernel before 5.17.2 mishandles seccomp permissions. The PTRACESEIZE code path allows attackers to bypass intended restrictions on setting t...

Rocky Linux 9 : kernel (RLSA-2022:7318)

The remote Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:7318 advisory. - The Linux kernel before 5.17.2 mishandles seccomp permissions. The PTRACESEIZE code path allows attackers to bypass intended restrictions on setting t...

container-tools:rhel8 bug fix and enhancement update

An update is available for libslirp, module.buildah, module.crun, buildah, fuse-overlayfs, udica, module.oci-seccomp-bpf-hook, module.netavark, module.runc, conmon, module.containers-common, python-podman, module.libslirp, module.aardvark-dns, module.fuse-overlayfs, runc, criu, aardvark-dns,...

kernel: seccomp: Move copy_seccomp() to no failure path

A memory leak flaw was found in the Linux kernel's seccomp subsystem. When a process using seccomp filters is interrupted by a fatal signal during clone, the seccompfilter structure and associated BPF program memory are not properly freed. This occurs because copyseccomp is called before the...

container-tools:rhel8 bug fix and enhancement update

An update is available for libslirp, module.buildah, module.crun, buildah, fuse-overlayfs, udica, module.oci-seccomp-bpf-hook, module.netavark, module.runc, conmon, module.containers-common, python-podman, module.libslirp, module.aardvark-dns, module.fuse-overlayfs, runc, criu, aardvark-dns,...

The vulnerability of the online business analytics service IBM Cognos Analytics, which is part of the IBM Cloud Pak for Data (CP4D) cloud platform for data analysis, organization, and management, allows a perpetrator to influence the integrity of protected information.

The vulnerability of the online business analytics service IBM Cognos Analytics, which is part of the IBM Cloud Pak for Data CP4D platform for data analysis, organization, and management, relates to insufficient protection of operational data during the processing of the seccomp parameter...

Security Bulletin: IBM Cloud Kubernetes Service is affected by a kubelet security vulnerability (CVE-2023-2431)

Summary IBM Cloud Kubernetes Service is affected by a security vulnerability in the kubelet that allows pods to bypass the seccomp profile enforcement CVE-2023-2431 Vulnerability Details CVEID: CVE-2023-2431 Description: Kubernetes could allow a local authenticated attacker to bypass security...

OESA-2023-1414 kubernetes security update

Container cluster management. Security Fixes: Users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different type in the same API group without authorization. Clusters are impacted by this vulnerability if all of the following are...

OESA-2023-1413 kubernetes security update

Container cluster management. Security Fixes: Users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different type in the same API group without authorization. Clusters are impacted by this vulnerability if all of the following are...