Описание
Security update for podman
This update for podman fixes the following issues:
- CVE-2024-9676: Fixed symlink traversal vulnerability in the containers/storage library that could cause Denial of Service (DoS) (bsc#1231698)
Список пакетов
Container suse/sle-micro/5.5:latest
podman-4.9.5-150500.3.28.1
Image SLES15-SP5-Manager-Proxy-5-0-BYOS
podman-4.9.5-150500.3.28.1
Image SLES15-SP5-Manager-Proxy-5-0-BYOS-Azure
podman-4.9.5-150500.3.28.1
Image SLES15-SP5-Manager-Proxy-5-0-BYOS-EC2
podman-4.9.5-150500.3.28.1
Image SLES15-SP5-Manager-Proxy-5-0-BYOS-GCE
podman-4.9.5-150500.3.28.1
Image SLES15-SP5-Manager-Server-5-0
podman-4.9.5-150500.3.28.1
Image SLES15-SP5-Manager-Server-5-0-Azure-llc
podman-4.9.5-150500.3.28.1
Image SLES15-SP5-Manager-Server-5-0-Azure-ltd
podman-4.9.5-150500.3.28.1
Image SLES15-SP5-Manager-Server-5-0-BYOS
podman-4.9.5-150500.3.28.1
Image SLES15-SP5-Manager-Server-5-0-BYOS-Azure
podman-4.9.5-150500.3.28.1
Image SLES15-SP5-Manager-Server-5-0-BYOS-EC2
podman-4.9.5-150500.3.28.1
Image SLES15-SP5-Manager-Server-5-0-BYOS-GCE
podman-4.9.5-150500.3.28.1
Image SLES15-SP5-Manager-Server-5-0-EC2-llc
podman-4.9.5-150500.3.28.1
Image SLES15-SP5-Manager-Server-5-0-EC2-ltd
podman-4.9.5-150500.3.28.1
Image SLES15-SP5-Micro-5-5
podman-4.9.5-150500.3.28.1
Image SLES15-SP5-Micro-5-5-Azure
podman-4.9.5-150500.3.28.1
Image SLES15-SP5-Micro-5-5-BYOS
podman-4.9.5-150500.3.28.1
Image SLES15-SP5-Micro-5-5-BYOS-Azure
podman-4.9.5-150500.3.28.1
Image SLES15-SP5-Micro-5-5-BYOS-EC2
podman-4.9.5-150500.3.28.1
Image SLES15-SP5-Micro-5-5-BYOS-GCE
podman-4.9.5-150500.3.28.1
Image SLES15-SP5-Micro-5-5-EC2
podman-4.9.5-150500.3.28.1
Image SLES15-SP5-Micro-5-5-GCE
podman-4.9.5-150500.3.28.1
SUSE Linux Enterprise Micro 5.5
podman-4.9.5-150500.3.28.1
podman-docker-4.9.5-150500.3.28.1
podman-remote-4.9.5-150500.3.28.1
podmansh-4.9.5-150500.3.28.1
SUSE Linux Enterprise Module for Containers 15 SP5
podman-4.9.5-150500.3.28.1
podman-docker-4.9.5-150500.3.28.1
podman-remote-4.9.5-150500.3.28.1
podmansh-4.9.5-150500.3.28.1
SUSE Linux Enterprise Module for Containers 15 SP6
podman-4.9.5-150500.3.28.1
podman-docker-4.9.5-150500.3.28.1
podman-remote-4.9.5-150500.3.28.1
podmansh-4.9.5-150500.3.28.1
openSUSE Leap 15.5
podman-4.9.5-150500.3.28.1
podman-docker-4.9.5-150500.3.28.1
podman-remote-4.9.5-150500.3.28.1
podmansh-4.9.5-150500.3.28.1
openSUSE Leap 15.6
podman-4.9.5-150500.3.28.1
podman-docker-4.9.5-150500.3.28.1
podman-remote-4.9.5-150500.3.28.1
podmansh-4.9.5-150500.3.28.1
openSUSE Leap Micro 5.5
podman-4.9.5-150500.3.28.1
podman-docker-4.9.5-150500.3.28.1
podman-remote-4.9.5-150500.3.28.1
podmansh-4.9.5-150500.3.28.1
Ссылки
- Link for SUSE-SU-2024:3753-1
- E-Mail link for SUSE-SU-2024:3753-1
- SUSE Security Ratings
- SUSE Bug 1231698
- SUSE CVE CVE-2024-9676 page
Описание
A vulnerability was found in Podman, Buildah, and CRI-O. A symlink traversal vulnerability in the containers/storage library can cause Podman, Buildah, and CRI-O to hang and result in a denial of service via OOM kill when running a malicious image using an automatically assigned user namespace (`--userns=auto` in Podman and Buildah). The containers/storage library will read /etc/passwd inside the container, but does not properly validate if that file is a symlink, which can be used to cause the library to read an arbitrary file on the host.
Затронутые продукты
Container suse/sle-micro/5.5:latest:podman-4.9.5-150500.3.28.1
Image SLES15-SP5-Manager-Proxy-5-0-BYOS-Azure:podman-4.9.5-150500.3.28.1
Image SLES15-SP5-Manager-Proxy-5-0-BYOS-EC2:podman-4.9.5-150500.3.28.1
Image SLES15-SP5-Manager-Proxy-5-0-BYOS-GCE:podman-4.9.5-150500.3.28.1
Ссылки
- CVE-2024-9676
- SUSE Bug 1231698
- SUSE Bug 1231785