Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2022:0770-1

Опубликовано: 09 мар. 2022
Источник: suse-cvrf

Описание

Security update for buildah

This update for buildah fixes the following issues:

buildah was updated to version 1.23.1:

Update to version 1.22.3:

  • Update dependencies
  • Post-branch commit
  • Accept repositories on login/logout

Update to version 1.22.0:

  • c/image, c/storage, c/common vendor before Podman 3.3 release
  • Proposed patch for 3399 (shadowutils)
  • Fix handling of --restore shadow-utils
  • runtime-flag (debug) test: handle old & new runc
  • Allow dst and destination for target in secret mounts
  • Multi-arch: Always push updated version-tagged img
  • imagebuildah.stageExecutor.prepare(): remove pseudonym check
  • refine dangling filter
  • Chown with environment variables not set should fail
  • Just restore protections of shadow-utils
  • Remove specific kernel version number requirement from install.md
  • Multi-arch image workflow: Make steps generic
  • chroot: fix environment value leakage to intermediate processes
  • Update nix pin with make nixpkgs
  • buildah source - create and manage source images
  • Update cirrus-cron notification GH workflow
  • Reuse code from containers/common/pkg/parse
  • Cirrus: Freshen VM images
  • Fix excludes exception begining with / or ./
  • Fix syntax for --manifest example
  • vendor containers/common@main
  • Cirrus: Drop dependence on fedora-minimal
  • Adjust conformance-test error-message regex
  • Workaround appearance of differing debug messages
  • Cirrus: Install docker from package cache
  • Switch rusagelogfile to use options.Out
  • Turn stdio back to blocking when command finishes
  • Add support for default network creation
  • Cirrus: Updates for master->main rename
  • Change references from master to main
  • Add --env and --workingdir flags to run command
  • [CI:DOCS] buildah bud: spelling --ignore-file requires parameter
  • [CI:DOCS] push/pull: clarify supported transports
  • Remove unused function arguments
  • Create mountOptions for mount command flags
  • Extract version command implementation to function
  • Add --json flags to mount and version commands
  • copier.Put(): set xattrs after ownership
  • buildah add/copy: spelling
  • buildah copy and buildah add should support .containerignore
  • Remove unused util.StartsWithValidTransport
  • Fix documentation of the --format option of buildah push
  • Don't use alltransports.ParseImageName with known transports
  • man pages: clarify rmi removes dangling parents
  • [CI:DOCS] Fix links to c/image master branch
  • imagebuildah: use the specified logger for logging preprocessing warnings
  • Fix copy into workdir for a single file
  • Fix docs links due to branch rename
  • Update nix pin with make nixpkgs
  • fix(docs): typo
  • Move to v1.22.0-dev
  • Fix handling of auth.json file while in a user namespace
  • Add rusage-logfile flag to optionally send rusage to a file
  • imagebuildah: redo step logging
  • Add volumes to make running buildah within a container easier
  • Add and use a 'copy' helper instead of podman load/save
  • Bump github.com/containers/common from 0.38.4 to 0.39.0
  • containerImageRef/containerImageSource: don't buffer uncompressed layers
  • containerImageRef(): squashed images have no parent images
  • Sync. workflow across skopeo, buildah, and podman
  • Bump github.com/containers/storage from 1.31.1 to 1.31.2
  • Bump github.com/opencontainers/runc from 1.0.0-rc94 to 1.0.0-rc95
  • Bump to v1.21.1-dev [NO TESTS NEEDED]

Список пакетов

openSUSE Leap 15.3
buildah-1.23.1-150300.8.3.1

Описание

The containers/image library used by the container tools Podman, Buildah, and Skopeo in Red Hat Enterprise Linux version 8 and CRI-O in OpenShift Container Platform, does not enforce TLS connections to the container registry authorization service. An attacker could use this vulnerability to launch a MiTM attack and steal login credentials or bearer tokens.


Затронутые продукты
openSUSE Leap 15.3:buildah-1.23.1-150300.8.3.1

Ссылки

Описание

A path traversal flaw was found in Buildah in versions before 1.14.5. This flaw allows an attacker to trick a user into building a malicious container image hosted on an HTTP(s) server and then write files to the user's system anywhere that the user has permissions.


Затронутые продукты
openSUSE Leap 15.3:buildah-1.23.1-150300.8.3.1

Ссылки

Описание

An improper limitation of path name flaw was found in containernetworking/cni in versions before 0.8.1. When specifying the plugin to load in the 'type' field in the network configuration, it is possible to use special elements such as "../" separators to reference binaries elsewhere on the system. This flaw allows an attacker to execute other existing binaries other than the cni plugins/types, such as 'reboot'. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.


Затронутые продукты
openSUSE Leap 15.3:buildah-1.23.1-150300.8.3.1

Ссылки