Описание
Security update for containerd, docker, docker-runc, golang-github-docker-libnetwork
This update for containerd, docker, docker-runc, golang-github-docker-libnetwork fixes the following issues:
Docker:
- CVE-2019-14271: Fixed a code injection if the nsswitch facility dynamically loaded a library inside a chroot (bsc#1143409).
- CVE-2019-13509: Fixed an information leak in the debug log (bsc#1142160).
- Update to version 19.03.1-ce, see changelog at /usr/share/doc/packages/docker/CHANGELOG.md (bsc#1142413).
golang-github-docker-libnetwork:
- Update to version git.fc5a7d91d54cc98f64fc28f9e288b46a0bee756c, which is required by docker (bsc#1142413).
Список пакетов
Image SLES12-SP5-Azure-Basic-On-Demand
Image SLES12-SP5-Azure-Standard-On-Demand
Image SLES12-SP5-EC2-ECS-On-Demand
Image SLES12-SP5-EC2-On-Demand
Image SLES12-SP5-GCE-On-Demand
SUSE Linux Enterprise Module for Containers 12
SUSE OpenStack Cloud 6-LTSS
Ссылки
- Link for SUSE-SU-2019:2119-1
- E-Mail link for SUSE-SU-2019:2119-1
- SUSE Security Ratings
- SUSE Bug 1100331
- SUSE Bug 1121967
- SUSE Bug 1142160
- SUSE Bug 1142413
- SUSE Bug 1143409
- SUSE CVE CVE-2018-10892 page
- SUSE CVE CVE-2019-13509 page
- SUSE CVE CVE-2019-14271 page
- SUSE CVE CVE-2019-5736 page
Описание
The default OCI linux spec in oci/defaults{_linux}.go in Docker/Moby from 1.11 to current does not block /proc/acpi pathnames. The flaw allows an attacker to modify host's hardware like enabling/disabling bluetooth or turning up/down keyboard brightness.
Затронутые продукты
Ссылки
- CVE-2018-10892
- SUSE Bug 1100331
- SUSE Bug 1100838
Описание
In Docker CE and EE before 18.09.8 (as well as Docker EE before 17.06.2-ee-23 and 18.x before 18.03.1-ee-10), Docker Engine in debug mode may sometimes add secrets to the debug log. This applies to a scenario where docker stack deploy is run to redeploy a stack that includes (non external) secrets. It potentially applies to other API users of the stack API if they resend the secret.
Затронутые продукты
Ссылки
- CVE-2019-13509
- SUSE Bug 1142160
Описание
In Docker 19.03.x before 19.03.1 linked against the GNU C Library (aka glibc), code injection can occur when the nsswitch facility dynamically loads a library inside a chroot that contains the contents of the container.
Затронутые продукты
Ссылки
- CVE-2019-14271
- SUSE Bug 1143409
Описание
runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a command as root within one of these types of containers: (1) a new container with an attacker-controlled image, or (2) an existing container, to which the attacker previously had write access, that can be attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/self/exe.
Затронутые продукты
Ссылки
- CVE-2019-5736
- SUSE Bug 1121967
- SUSE Bug 1122185
- SUSE Bug 1173421
- SUSE Bug 1218894