Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

oracle-oval логотип

ELSA-2025-15904

Опубликовано: 17 сент. 2025
Источник: oracle-oval
Платформа: Oracle Linux 8

Описание

ELSA-2025-15904: container-tools:rhel8 security update (IMPORTANT)

aardvark-dns buildah cockpit-podman conmon containernetworking-plugins containers-common [1-82.0.1]

  • Updated removed references [Orabug: 33473101] (Alex Burmashev)
  • Adjust registries.conf (Nikita Gerasimov)
  • remove references to RedHat registry (Nikita Gerasimov)

[2:1-82]

  • update vendored components
  • Resolves: RHEL-40801

[2:1-81]

  • Update shortnames from Pyxis
  • Related: Jira:RHEL-2110

[2:1-80]

  • bump release to preserve upgrade path
  • Resolves: Jira:RHEL-12277

[2:1-59]

  • update vendored components
  • Related: Jira:RHEL-2110

[2:1-58]

  • update vendored components
  • Related: Jira:RHEL-2110

[2:1-57]

  • fix shortnames for rhel-minimal
  • Related: Jira:RHEL-2110

[2:1-56]

  • implement GPG auto updating mechanism from redhat-release
  • Resolves: #RHEL-2110

[2:1-55]

  • update GPG keys to the current content of redhat-release
  • Resolves: #RHEL-3164

[2:1-54]

  • update vendored components and shortnames
  • Related: #2176055

[2:1-53]

  • update vendored components
  • Related: #2176055

[2:1-52]

  • update vendored components
  • Related: #2176055

[2:1-51]

  • be sure default_capabilities contain SYS_CHROOT
  • Resolves: #2166195

[2:1-50]

  • improve shortnames generation
  • Related: #2176055

[2:1-49]

  • update vendored components and configuration files
  • Related: #2123641

[2:1-48]

  • update vendored components and configuration files
  • Related: #2123641

[2:1-47]

  • enable NET_RAW capability for RHEL8 only
  • Related: #2123641

[2:1-46]

  • update vendored components and configuration files
  • Related: #2123641

[2:1-45]

  • update vendored components and configuration files
  • Related: #2123641

[2:1-44]

  • update vendored components and configuration files
  • Related: #2123641

[2:1-43]

  • update vendored components and configuration files
  • Related: #2123641

[2:1-42]

  • update vendored components and configuration files
  • Related: #2123641

[2:1-41]

  • add beta GPG key
  • Related: #2123641

[2:1-40]

  • add beta keys to default-policy.json
  • Related: #2061390

[2:1-39]

  • update shortnames
  • Related: #2061390

[2:1-38]

  • arch limitation because of go-md2man (missing on i686)
  • Related: #2061390

[2:1-37]

  • add install section
  • update vendored components
  • Related: #2061390

[2:1-36]

  • remove aardvark-dns and netavark - packaged separately
  • update vendored components and configuration files
  • Related: #2061390

[2:1-35]

  • update vendored components and configuration files
  • Related: #2061390

[2:1-34]

  • remove rhel-els and update shortnames
  • Related: #2061390

[2:1-33]

  • update shortnames
  • Related: #2061390

[2:1-32]

  • additional fix for unqualified registries
  • Related: #2061390

[2:1-31]

  • fix unqualified registries
  • Related: #2061390

[2:1-30]

  • update vendored components and configuration files
  • Related: #2061390

[2:1-29]

  • update unqualified registries list
  • Related: #2061390

[2:1-28]

  • update aardvark-dns and netavark to 1.0.3
  • update vendored components
  • Related: #2061390

[2:1-27]

  • add man page sources too
  • Related: #2061390

[2:1-26]

  • add missing man pages from Fedora
  • Related: #2061390

[2:1-25]

  • allow consuming aardvark-dns and netavark from upstream branch
  • Related: #2061390

[2:1-24]

  • update to netavark and aardvark-dns 1.0.2
  • update vendored components
  • Related: #2061390

[2:1-23]

  • update to netavark and aardvark-dns 1.0.1
  • Related: #2001445

[2:1-22]

  • build rust packages with RUSTFLAGS set to make ExecShield happy
  • Related: #2001445

[2:1-21]

  • do not specify infra_image in containers.conf
  • needed to resolve gating test failures
  • Related: #2001445

[2:1-20]

  • update to netavark-1.0.0 and aardvark-dns-1.0.0
  • Related: #2001445

[2:1-19]

  • package aarvark-dns and netavark as part of the containers-common
  • Related: #2001445

[2:1-18]

  • update shortnames and vendored components
  • Related: #2001445

[2:1-17]

  • containers.conf should contain network_backend = 'cni' in RHEL8.6
  • Related: #2001445

[2:1-16]

  • update vendored components and configuration files
  • Related: #2001445

[2:1-15]

  • sync vendored components
  • Related: #2001445

[2:1-14]

  • sync vendored components
  • Related: #2001445

[2:1-13]

  • update shortnames from Pyxis
  • Related: #2001445

[2:1-12]

  • do not allow broken content from Pyxis to land in shortnames.conf
  • Related: #2001445

[2:1-11]

  • sync vendored components
  • update shortnames from Pyxis
  • Related: #2001445

[2:1-10]

  • use log_driver = 'journald' and events_logger = 'journald' for RHEL9
  • Related: #2001445

[2:1-9]

  • consume seccomp.json from the oldest vendored version of c/common, not main branch
  • Related: #2001445

[2:1-8]

  • update vendored components
  • Related: #2001445

[2:1-7]

  • make log_driver = 'k8s-file' default in containers.conf
  • Related: #2001445

[2:1-6]

  • sync vendored components
  • Related: #2001445

[2:1-5]

  • update to the new vendored components
  • Related: #2001445

[2:1-4]

  • update to the new vendored components
  • Related: #2001445

[2:1-3]

  • update to the new vendored components
  • Related: #2001445

[2:1-2]

  • synchronize config files for RHEL-8.5
  • Related: #1934415

[2:1-1]

  • initial import
  • Related: #1934415

container-selinux criu crun fuse-overlayfs libslirp netavark oci-seccomp-bpf-hook podman [4.9.4-23.0.1]

  • Fixes issue of container created in cgroupv2 not start in cgroupv1 [Orabug: 36136813]
  • Fixes container memory limit not set after host is rebooted with cgroupv2 [Orabug: 36136802]
  • Fixes issue of podman execvp error while using podmansh [Orabug: 36756665]

[4:4.9.4-23]

python-podman runc skopeo slirp4netns udica

Обновленные пакеты

Oracle Linux 8

Oracle Linux aarch64

Module container-tools:ol8 is enabled

aardvark-dns

1.10.1-2.module+el8.10.0+90672+4d6d1825

buildah

1.33.12-2.module+el8.10.0+90672+4d6d1825

buildah-tests

1.33.12-2.module+el8.10.0+90672+4d6d1825

cockpit-podman

84.1-1.module+el8.10.0+90672+4d6d1825

conmon

2.1.10-1.module+el8.10.0+90672+4d6d1825

container-selinux

2.229.0-2.module+el8.10.0+90672+4d6d1825

containernetworking-plugins

1.4.0-6.module+el8.10.0+90672+4d6d1825

containers-common

1-82.0.1.module+el8.10.0+90672+4d6d1825

crit

3.18-5.module+el8.10.0+90672+4d6d1825

criu

3.18-5.module+el8.10.0+90672+4d6d1825

criu-devel

3.18-5.module+el8.10.0+90672+4d6d1825

criu-libs

3.18-5.module+el8.10.0+90672+4d6d1825

crun

1.14.3-2.module+el8.10.0+90672+4d6d1825

fuse-overlayfs

1.13-1.module+el8.10.0+90672+4d6d1825

libslirp

4.4.0-2.module+el8.10.0+90672+4d6d1825

libslirp-devel

4.4.0-2.module+el8.10.0+90672+4d6d1825

netavark

1.10.3-1.module+el8.10.0+90672+4d6d1825

oci-seccomp-bpf-hook

1.2.10-1.module+el8.10.0+90672+4d6d1825

podman

4.9.4-23.0.1.module+el8.10.0+90672+4d6d1825

podman-catatonit

4.9.4-23.0.1.module+el8.10.0+90672+4d6d1825

podman-docker

4.9.4-23.0.1.module+el8.10.0+90672+4d6d1825

podman-gvproxy

4.9.4-23.0.1.module+el8.10.0+90672+4d6d1825

podman-plugins

4.9.4-23.0.1.module+el8.10.0+90672+4d6d1825

podman-remote

4.9.4-23.0.1.module+el8.10.0+90672+4d6d1825

podman-tests

4.9.4-23.0.1.module+el8.10.0+90672+4d6d1825

python3-criu

3.18-5.module+el8.10.0+90672+4d6d1825

python3-podman

4.9.0-3.module+el8.10.0+90672+4d6d1825

runc

1.1.12-6.module+el8.10.0+90672+4d6d1825

skopeo

1.14.5-4.module+el8.10.0+90672+4d6d1825

skopeo-tests

1.14.5-4.module+el8.10.0+90672+4d6d1825

slirp4netns

1.2.3-1.module+el8.10.0+90672+4d6d1825

udica

0.2.6-21.module+el8.10.0+90672+4d6d1825

Oracle Linux x86_64

Module container-tools:ol8 is enabled

aardvark-dns

1.10.1-2.module+el8.10.0+90672+4d6d1825

buildah

1.33.12-2.module+el8.10.0+90672+4d6d1825

buildah-tests

1.33.12-2.module+el8.10.0+90672+4d6d1825

cockpit-podman

84.1-1.module+el8.10.0+90672+4d6d1825

conmon

2.1.10-1.module+el8.10.0+90672+4d6d1825

container-selinux

2.229.0-2.module+el8.10.0+90672+4d6d1825

containernetworking-plugins

1.4.0-6.module+el8.10.0+90672+4d6d1825

containers-common

1-82.0.1.module+el8.10.0+90672+4d6d1825

crit

3.18-5.module+el8.10.0+90672+4d6d1825

criu

3.18-5.module+el8.10.0+90672+4d6d1825

criu-devel

3.18-5.module+el8.10.0+90672+4d6d1825

criu-libs

3.18-5.module+el8.10.0+90672+4d6d1825

crun

1.14.3-2.module+el8.10.0+90672+4d6d1825

fuse-overlayfs

1.13-1.module+el8.10.0+90672+4d6d1825

libslirp

4.4.0-2.module+el8.10.0+90672+4d6d1825

libslirp-devel

4.4.0-2.module+el8.10.0+90672+4d6d1825

netavark

1.10.3-1.module+el8.10.0+90672+4d6d1825

oci-seccomp-bpf-hook

1.2.10-1.module+el8.10.0+90672+4d6d1825

podman

4.9.4-23.0.1.module+el8.10.0+90672+4d6d1825

podman-catatonit

4.9.4-23.0.1.module+el8.10.0+90672+4d6d1825

podman-docker

4.9.4-23.0.1.module+el8.10.0+90672+4d6d1825

podman-gvproxy

4.9.4-23.0.1.module+el8.10.0+90672+4d6d1825

podman-plugins

4.9.4-23.0.1.module+el8.10.0+90672+4d6d1825

podman-remote

4.9.4-23.0.1.module+el8.10.0+90672+4d6d1825

podman-tests

4.9.4-23.0.1.module+el8.10.0+90672+4d6d1825

python3-criu

3.18-5.module+el8.10.0+90672+4d6d1825

python3-podman

4.9.0-3.module+el8.10.0+90672+4d6d1825

runc

1.1.12-6.module+el8.10.0+90672+4d6d1825

skopeo

1.14.5-4.module+el8.10.0+90672+4d6d1825

skopeo-tests

1.14.5-4.module+el8.10.0+90672+4d6d1825

slirp4netns

1.2.3-1.module+el8.10.0+90672+4d6d1825

udica

0.2.6-21.module+el8.10.0+90672+4d6d1825

Связанные CVE

Связанные уязвимости

CVSS3: 8.1
ubuntu
4 месяца назад

There's a vulnerability in podman where an attacker may use the kube play command to overwrite host files when the kube file container a Secrete or a ConfigMap volume mount and such volume contains a symbolic link to a host file path. In a successful attack, the attacker can only control the target file to be overwritten but not the content to be written into the file. Binary-Affected: podman Upstream-version-introduced: v4.0.0 Upstream-version-fixed: v5.6.1

CVSS3: 8.1
redhat
4 месяца назад

There's a vulnerability in podman where an attacker may use the kube play command to overwrite host files when the kube file container a Secrete or a ConfigMap volume mount and such volume contains a symbolic link to a host file path. In a successful attack, the attacker can only control the target file to be overwritten but not the content to be written into the file. Binary-Affected: podman Upstream-version-introduced: v4.0.0 Upstream-version-fixed: v5.6.1

CVSS3: 8.1
nvd
4 месяца назад

There's a vulnerability in podman where an attacker may use the kube play command to overwrite host files when the kube file container a Secrete or a ConfigMap volume mount and such volume contains a symbolic link to a host file path. In a successful attack, the attacker can only control the target file to be overwritten but not the content to be written into the file. Binary-Affected: podman Upstream-version-introduced: v4.0.0 Upstream-version-fixed: v5.6.1

msrc
3 месяца назад

Podman: podman kube play command may overwrite host files

CVSS3: 8.1
debian
4 месяца назад

There's a vulnerability in podman where an attacker may use the kube p ...