Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

oracle-oval логотип

ELSA-2025-1372

Опубликовано: 13 фев. 2025
Источник: oracle-oval
Платформа: Oracle Linux 8

Описание

ELSA-2025-1372: container-tools:ol8 security update (IMPORTANT)

aardvark-dns buildah [2:1.33.12-1]

cockpit-podman conmon containernetworking-plugins containers-common [1-82.0.1]

  • Updated removed references [Orabug: 33473101] (Alex Burmashev)
  • Adjust registries.conf (Nikita Gerasimov)
  • remove references to RedHat registry (Nikita Gerasimov)

[2:1-82]

  • update vendored components
  • Resolves: RHEL-40801

[2:1-81]

  • Update shortnames from Pyxis
  • Related: Jira:RHEL-2110

[2:1-80]

  • bump release to preserve upgrade path
  • Resolves: Jira:RHEL-12277

[2:1-59]

  • update vendored components
  • Related: Jira:RHEL-2110

[2:1-58]

  • update vendored components
  • Related: Jira:RHEL-2110

[2:1-57]

  • fix shortnames for rhel-minimal
  • Related: Jira:RHEL-2110

[2:1-56]

  • implement GPG auto updating mechanism from redhat-release
  • Resolves: #RHEL-2110

[2:1-55]

  • update GPG keys to the current content of redhat-release
  • Resolves: #RHEL-3164

[2:1-54]

  • update vendored components and shortnames
  • Related: #2176055

[2:1-53]

  • update vendored components
  • Related: #2176055

[2:1-52]

  • update vendored components
  • Related: #2176055

[2:1-51]

  • be sure default_capabilities contain SYS_CHROOT
  • Resolves: #2166195

[2:1-50]

  • improve shortnames generation
  • Related: #2176055

[2:1-49]

  • update vendored components and configuration files
  • Related: #2123641

[2:1-48]

  • update vendored components and configuration files
  • Related: #2123641

[2:1-47]

  • enable NET_RAW capability for RHEL8 only
  • Related: #2123641

[2:1-46]

  • update vendored components and configuration files
  • Related: #2123641

[2:1-45]

  • update vendored components and configuration files
  • Related: #2123641

[2:1-44]

  • update vendored components and configuration files
  • Related: #2123641

[2:1-43]

  • update vendored components and configuration files
  • Related: #2123641

[2:1-42]

  • update vendored components and configuration files
  • Related: #2123641

[2:1-41]

  • add beta GPG key
  • Related: #2123641

[2:1-40]

  • add beta keys to default-policy.json
  • Related: #2061390

[2:1-39]

  • update shortnames
  • Related: #2061390

[2:1-38]

  • arch limitation because of go-md2man (missing on i686)
  • Related: #2061390

[2:1-37]

  • add install section
  • update vendored components
  • Related: #2061390

[2:1-36]

  • remove aardvark-dns and netavark - packaged separately
  • update vendored components and configuration files
  • Related: #2061390

[2:1-35]

  • update vendored components and configuration files
  • Related: #2061390

[2:1-34]

  • remove rhel-els and update shortnames
  • Related: #2061390

[2:1-33]

  • update shortnames
  • Related: #2061390

[2:1-32]

  • additional fix for unqualified registries
  • Related: #2061390

[2:1-31]

  • fix unqualified registries
  • Related: #2061390

[2:1-30]

  • update vendored components and configuration files
  • Related: #2061390

[2:1-29]

  • update unqualified registries list
  • Related: #2061390

[2:1-28]

  • update aardvark-dns and netavark to 1.0.3
  • update vendored components
  • Related: #2061390

[2:1-27]

  • add man page sources too
  • Related: #2061390

[2:1-26]

  • add missing man pages from Fedora
  • Related: #2061390

[2:1-25]

  • allow consuming aardvark-dns and netavark from upstream branch
  • Related: #2061390

[2:1-24]

  • update to netavark and aardvark-dns 1.0.2
  • update vendored components
  • Related: #2061390

[2:1-23]

  • update to netavark and aardvark-dns 1.0.1
  • Related: #2001445

[2:1-22]

  • build rust packages with RUSTFLAGS set to make ExecShield happy
  • Related: #2001445

[2:1-21]

  • do not specify infra_image in containers.conf
  • needed to resolve gating test failures
  • Related: #2001445

[2:1-20]

  • update to netavark-1.0.0 and aardvark-dns-1.0.0
  • Related: #2001445

[2:1-19]

  • package aarvark-dns and netavark as part of the containers-common
  • Related: #2001445

[2:1-18]

  • update shortnames and vendored components
  • Related: #2001445

[2:1-17]

  • containers.conf should contain network_backend = 'cni' in RHEL8.6
  • Related: #2001445

[2:1-16]

  • update vendored components and configuration files
  • Related: #2001445

[2:1-15]

  • sync vendored components
  • Related: #2001445

[2:1-14]

  • sync vendored components
  • Related: #2001445

[2:1-13]

  • update shortnames from Pyxis
  • Related: #2001445

[2:1-12]

  • do not allow broken content from Pyxis to land in shortnames.conf
  • Related: #2001445

[2:1-11]

  • sync vendored components
  • update shortnames from Pyxis
  • Related: #2001445

[2:1-10]

  • use log_driver = 'journald' and events_logger = 'journald' for RHEL9
  • Related: #2001445

[2:1-9]

  • consume seccomp.json from the oldest vendored version of c/common, not main branch
  • Related: #2001445

[2:1-8]

  • update vendored components
  • Related: #2001445

[2:1-7]

  • make log_driver = 'k8s-file' default in containers.conf
  • Related: #2001445

[2:1-6]

  • sync vendored components
  • Related: #2001445

[2:1-5]

  • update to the new vendored components
  • Related: #2001445

[2:1-4]

  • update to the new vendored components
  • Related: #2001445

[2:1-3]

  • update to the new vendored components
  • Related: #2001445

[2:1-2]

  • synchronize config files for RHEL-8.5
  • Related: #1934415

[2:1-1]

  • initial import
  • Related: #1934415

container-selinux criu crun fuse-overlayfs libslirp netavark oci-seccomp-bpf-hook podman [4.9.4-19.0.1]

  • Fixes issue of container created in cgroupv2 not start in cgroupv1 [Orabug: 36136813]
  • Fixes container memory limit not set after host is rebooted with cgroupv2 [Orabug: 36136802]
  • Fixes issue of podman execvp error while using podmansh [Orabug: 36756665]

[4:4.9.4-19]

python-podman [4.9.0-3]

  • sync with release-4.9 branch
  • Resolves: RHEL-31069

runc [1:1.1.12-6]

  • Add CPU affinity feature from Kir Kolishkin
  • Resolves: RHEL-74865

skopeo slirp4netns udica

Обновленные пакеты

Oracle Linux 8

Oracle Linux aarch64

Module container-tools:ol8 is enabled

aardvark-dns

1.10.1-2.module+el8.10.0+90449+0b7c8529

buildah

1.33.12-1.module+el8.10.0+90509+b5e1e789

buildah-tests

1.33.12-1.module+el8.10.0+90509+b5e1e789

cockpit-podman

84.1-1.module+el8.10.0+90449+0b7c8529

conmon

2.1.10-1.module+el8.10.0+90449+0b7c8529

container-selinux

2.229.0-2.module+el8.10.0+90449+0b7c8529

containernetworking-plugins

1.4.0-5.module+el8.10.0+90449+0b7c8529

containers-common

1-82.0.1.module+el8.10.0+90449+0b7c8529

crit

3.18-5.module+el8.10.0+90449+0b7c8529

criu

3.18-5.module+el8.10.0+90449+0b7c8529

criu-devel

3.18-5.module+el8.10.0+90449+0b7c8529

criu-libs

3.18-5.module+el8.10.0+90449+0b7c8529

crun

1.14.3-2.module+el8.10.0+90449+0b7c8529

fuse-overlayfs

1.13-1.module+el8.10.0+90449+0b7c8529

libslirp

4.4.0-2.module+el8.10.0+90449+0b7c8529

libslirp-devel

4.4.0-2.module+el8.10.0+90449+0b7c8529

netavark

1.10.3-1.module+el8.10.0+90449+0b7c8529

oci-seccomp-bpf-hook

1.2.10-1.module+el8.10.0+90449+0b7c8529

podman

4.9.4-19.0.1.module+el8.10.0+90509+b5e1e789

podman-catatonit

4.9.4-19.0.1.module+el8.10.0+90509+b5e1e789

podman-docker

4.9.4-19.0.1.module+el8.10.0+90509+b5e1e789

podman-gvproxy

4.9.4-19.0.1.module+el8.10.0+90509+b5e1e789

podman-plugins

4.9.4-19.0.1.module+el8.10.0+90509+b5e1e789

podman-remote

4.9.4-19.0.1.module+el8.10.0+90509+b5e1e789

podman-tests

4.9.4-19.0.1.module+el8.10.0+90509+b5e1e789

python3-criu

3.18-5.module+el8.10.0+90449+0b7c8529

python3-podman

4.9.0-3.module+el8.10.0+90449+0b7c8529

runc

1.1.12-6.module+el8.10.0+90509+b5e1e789

skopeo

1.14.5-3.module+el8.10.0+90449+0b7c8529

skopeo-tests

1.14.5-3.module+el8.10.0+90449+0b7c8529

slirp4netns

1.2.3-1.module+el8.10.0+90449+0b7c8529

udica

0.2.6-21.module+el8.10.0+90449+0b7c8529

Oracle Linux x86_64

Module container-tools:ol8 is enabled

aardvark-dns

1.10.1-2.module+el8.10.0+90449+0b7c8529

buildah

1.33.12-1.module+el8.10.0+90509+b5e1e789

buildah-tests

1.33.12-1.module+el8.10.0+90509+b5e1e789

cockpit-podman

84.1-1.module+el8.10.0+90449+0b7c8529

conmon

2.1.10-1.module+el8.10.0+90449+0b7c8529

container-selinux

2.229.0-2.module+el8.10.0+90449+0b7c8529

containernetworking-plugins

1.4.0-5.module+el8.10.0+90449+0b7c8529

containers-common

1-82.0.1.module+el8.10.0+90449+0b7c8529

crit

3.18-5.module+el8.10.0+90449+0b7c8529

criu-devel

3.18-5.module+el8.10.0+90449+0b7c8529

criu-libs

3.18-5.module+el8.10.0+90449+0b7c8529

libslirp

4.4.0-2.module+el8.10.0+90449+0b7c8529

libslirp-devel

4.4.0-2.module+el8.10.0+90449+0b7c8529

netavark

1.10.3-1.module+el8.10.0+90449+0b7c8529

oci-seccomp-bpf-hook

1.2.10-1.module+el8.10.0+90449+0b7c8529

podman

4.9.4-19.0.1.module+el8.10.0+90509+b5e1e789

podman-catatonit

4.9.4-19.0.1.module+el8.10.0+90509+b5e1e789

podman-docker

4.9.4-19.0.1.module+el8.10.0+90509+b5e1e789

podman-gvproxy

4.9.4-19.0.1.module+el8.10.0+90509+b5e1e789

podman-plugins

4.9.4-19.0.1.module+el8.10.0+90509+b5e1e789

podman-remote

4.9.4-19.0.1.module+el8.10.0+90509+b5e1e789

podman-tests

4.9.4-19.0.1.module+el8.10.0+90509+b5e1e789

python3-criu

3.18-5.module+el8.10.0+90449+0b7c8529

python3-podman

4.9.0-3.module+el8.10.0+90449+0b7c8529

runc

1.1.12-6.module+el8.10.0+90509+b5e1e789

skopeo

1.14.5-3.module+el8.10.0+90449+0b7c8529

skopeo-tests

1.14.5-3.module+el8.10.0+90449+0b7c8529

slirp4netns

1.2.3-1.module+el8.10.0+90449+0b7c8529

udica

0.2.6-21.module+el8.10.0+90449+0b7c8529

criu

3.18-5.module+el8.10.0+90449+0b7c8529

crun

1.14.3-2.module+el8.10.0+90449+0b7c8529

fuse-overlayfs

1.13-1.module+el8.10.0+90449+0b7c8529

Связанные CVE

Связанные уязвимости

CVSS3: 8.6
ubuntu
5 месяцев назад

A vulnerability was found in `podman build` and `buildah.` This issue occurs in a container breakout by using --jobs=2 and a race condition when building a malicious Containerfile. SELinux might mitigate it, but even with SELinux on, it still allows the enumeration of files and directories on the host.

CVSS3: 8.6
redhat
5 месяцев назад

A vulnerability was found in `podman build` and `buildah.` This issue occurs in a container breakout by using --jobs=2 and a race condition when building a malicious Containerfile. SELinux might mitigate it, but even with SELinux on, it still allows the enumeration of files and directories on the host.

CVSS3: 8.6
nvd
5 месяцев назад

A vulnerability was found in `podman build` and `buildah.` This issue occurs in a container breakout by using --jobs=2 and a race condition when building a malicious Containerfile. SELinux might mitigate it, but even with SELinux on, it still allows the enumeration of files and directories on the host.

CVSS3: 8.6
debian
5 месяцев назад

A vulnerability was found in `podman build` and `buildah.` This issue ...

suse-cvrf
4 месяца назад

Security update for podman

Уязвимость ELSA-2025-1372