Описание
Security update for buildah
This update for buildah fixes the following issues:
-
CVE-2024-1753: Fixed an issue to prevent a full container escape at build time. (bsc#1221677)
-
Update to version 1.34.1 for compatibility with Docker 25.0 (which is not in SLES yet, but will eventually be) (bsc#1219563). See the corresponding release notes:
- https://github.com/containers/buildah/releases/tag/v1.34.1
- https://github.com/containers/buildah/releases/tag/v1.34.0
- https://github.com/containers/buildah/releases/tag/v1.33.0
- https://github.com/containers/buildah/releases/tag/v1.32.0
- https://github.com/containers/buildah/releases/tag/v1.31.0
- https://github.com/containers/buildah/releases/tag/v1.30.0
-
Require cni-plugins (bsc#1220568)
Список пакетов
SUSE Enterprise Storage 7.1
SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS
SUSE Linux Enterprise Server 15 SP3-LTSS
SUSE Linux Enterprise Server for SAP Applications 15 SP3
Ссылки
- Link for SUSE-SU-2024:1145-1
- E-Mail link for SUSE-SU-2024:1145-1
- SUSE Security Ratings
- SUSE Bug 1219563
- SUSE Bug 1220568
- SUSE Bug 1221677
- SUSE CVE CVE-2024-1753 page
Описание
A flaw was found in Buildah (and subsequently Podman Build) which allows containers to mount arbitrary locations on the host filesystem into build containers. A malicious Containerfile can use a dummy image with a symbolic link to the root filesystem as a mount source and cause the mount operation to mount the host root filesystem inside the RUN step. The commands inside the RUN step will then have read-write access to the host filesystem, allowing for full container escape at build time.
Затронутые продукты
Ссылки
- CVE-2024-1753
- SUSE Bug 1221677