Описание
Security update for podman
This update for podman fixes the following issues:
- CVE-2024-9675: Fixed cache arbitrary directory mount (bsc#1231499).
- CVE-2024-9407: Fixed improper Input Validation in bind-propagation Option of Dockerfile RUN --mount Instruction (bsc#1231208).
The following non-security bug was fixed:
- rootless ipv6 containers can't be started (bsc#1214612).
Список пакетов
Container suse/sle-micro/5.5:latest
Image SLES15-SP5-Manager-Proxy-5-0-BYOS
Image SLES15-SP5-Manager-Proxy-5-0-BYOS-Azure
Image SLES15-SP5-Manager-Proxy-5-0-BYOS-EC2
Image SLES15-SP5-Manager-Proxy-5-0-BYOS-GCE
Image SLES15-SP5-Manager-Server-5-0
Image SLES15-SP5-Manager-Server-5-0-Azure-llc
Image SLES15-SP5-Manager-Server-5-0-Azure-ltd
Image SLES15-SP5-Manager-Server-5-0-BYOS
Image SLES15-SP5-Manager-Server-5-0-BYOS-Azure
Image SLES15-SP5-Manager-Server-5-0-BYOS-EC2
Image SLES15-SP5-Manager-Server-5-0-BYOS-GCE
Image SLES15-SP5-Manager-Server-5-0-EC2-llc
Image SLES15-SP5-Manager-Server-5-0-EC2-ltd
Image SLES15-SP5-Micro-5-5
Image SLES15-SP5-Micro-5-5-Azure
Image SLES15-SP5-Micro-5-5-BYOS
Image SLES15-SP5-Micro-5-5-BYOS-Azure
Image SLES15-SP5-Micro-5-5-BYOS-EC2
Image SLES15-SP5-Micro-5-5-BYOS-GCE
Image SLES15-SP5-Micro-5-5-EC2
Image SLES15-SP5-Micro-5-5-GCE
SUSE Linux Enterprise Micro 5.5
SUSE Linux Enterprise Module for Containers 15 SP5
SUSE Linux Enterprise Module for Containers 15 SP6
openSUSE Leap 15.5
openSUSE Leap 15.6
openSUSE Leap Micro 5.5
Ссылки
- Link for SUSE-SU-2024:3741-1
- E-Mail link for SUSE-SU-2024:3741-1
- SUSE Security Ratings
- SUSE Bug 1214612
- SUSE Bug 1231208
- SUSE Bug 1231499
- SUSE CVE CVE-2024-9407 page
- SUSE CVE CVE-2024-9675 page
Описание
A vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exploited to mount sensitive directories from the host into a container during the build process and, in some cases, modify the contents of those mounted files. Even if SELinux is used, this vulnerability can bypass its protection by allowing the source directory to be relabeled to give the container access to host files.
Затронутые продукты
Ссылки
- CVE-2024-9407
- SUSE Bug 1231208
Описание
A vulnerability was found in Buildah. Cache mounts do not properly validate that user-specified paths for the cache are within our cache directory, allowing a `RUN` instruction in a Container file to mount an arbitrary directory from the host (read/write) into the container as long as those files can be accessed by the user running Buildah.
Затронутые продукты
Ссылки
- CVE-2024-9675
- SUSE Bug 1231499