Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2024:3754-1

Опубликовано: 24 окт. 2024
Источник: suse-cvrf

Описание

Security update for buildah

This update for buildah fixes the following issues:

  • CVE-2024-9676: Fixed symlink traversal vulnerability in the containers/storage library that could cause Denial of Service (DoS) (bsc#1231698)

Список пакетов

SUSE Linux Enterprise Module for Containers 15 SP5
buildah-1.35.4-150500.3.19.1
SUSE Linux Enterprise Module for Containers 15 SP6
buildah-1.35.4-150500.3.19.1
openSUSE Leap 15.5
buildah-1.35.4-150500.3.19.1
openSUSE Leap 15.6
buildah-1.35.4-150500.3.19.1

Ссылки

Описание

A vulnerability was found in Podman, Buildah, and CRI-O. A symlink traversal vulnerability in the containers/storage library can cause Podman, Buildah, and CRI-O to hang and result in a denial of service via OOM kill when running a malicious image using an automatically assigned user namespace (`--userns=auto` in Podman and Buildah). The containers/storage library will read /etc/passwd inside the container, but does not properly validate if that file is a symlink, which can be used to cause the library to read an arbitrary file on the host.

Затронутые продукты
SUSE Linux Enterprise Module for Containers 15 SP5:buildah-1.35.4-150500.3.19.1
SUSE Linux Enterprise Module for Containers 15 SP6:buildah-1.35.4-150500.3.19.1
openSUSE Leap 15.5:buildah-1.35.4-150500.3.19.1
openSUSE Leap 15.6:buildah-1.35.4-150500.3.19.1
Ссылки