exploit the possibilities

Red Hat Security Advisory 2020-1227-01

Red Hat Security Advisory 2020-1227-01
Posted Apr 1, 2020
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2020-1227-01 - The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.

tags | advisory
systems | linux, redhat
advisories | CVE-2019-18466, CVE-2020-1702
MD5 | c8b347dca9d6d40dbe98fca6cde553a8

Red Hat Security Advisory 2020-1227-01

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

====================================================================
Red Hat Security Advisory

Synopsis: Moderate: podman security, bug fix, and enhancement update
Advisory ID: RHSA-2020:1227-01
Product: Red Hat Enterprise Linux Extras
Advisory URL: https://access.redhat.com/errata/RHSA-2020:1227
Issue date: 2020-03-31
CVE Names: CVE-2019-18466 CVE-2020-1702
====================================================================
1. Summary:

An update for podman is now available for Red Hat Enterprise Linux 7
Extras.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux 7 Extras - noarch, ppc64le, s390x, x86_64

3. Description:

The podman tool manages pods, container images, and containers. It is part
of the libpod library, which is for applications that use container pods.
Container pods is a concept in Kubernetes.

Security Fix(es):

* podman: resolving symlink in host filesystem leads to unexpected results
of copy operation (CVE-2019-18466)

* containers/image: Container images read entire image manifest into memory
(CVE-2020-1702)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

Bug Fix(es):

* [extras-rhel-7] conmon binary stripped but debuginfo not generated
(BZ#1650395)

* Cannot run systemd-container with SCL service due to RHSA-2019:2091 fix
(BZ#1758509)

* Podman does not enforce registries.block in the registries.conf file
(BZ#1787666)

* podman and podman-manpages needs merging (BZ#1788549)

* podman should be linked against gpgme-pthread (BZ#1793083)

* podman cannot support load tarball which the name with colon but docker
can support this (BZ#1797599)

* podman (1.6.4) rhel 8.1 no route to host from inside container
[extras-rhel-7.8/podman] (BZ#1806895)

* Podman can't reuse a container name, even if the container that was using
it is no longer around [extras-rhel-7.8/podman] (BZ#1807437)

* podman exec does not reads from stdin [extras-rhel-7.8/podman]
(BZ#1807586)

* [FJ8.2 Bug]: [REG]The "--group-add" option of "podman create" doesn't
function. [extras-rhel-7.8/podman] (BZ#1808702)

Enhancement(s):

* [RFE] sctp support for podman (BZ#1664218)

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1650395 - [extras-rhel-7] conmon binary stripped but debuginfo not generated
1744588 - CVE-2019-18466 podman: resolving symlink in host filesystem leads to unexpected results of copy operation
1758509 - Cannot run systemd-container with SCL service due to RHSA-2019:2091 fix
1788549 - podman and podman-manpages needs merging
1792796 - CVE-2020-1702 containers/image: Container images read entire image manifest into memory
1797599 - podman cannot support load tarball which the name with colon but docker can support this
1806895 - podman (1.6.4) rhel 8.1 no route to host from inside container [extras-rhel-7.8/podman]
1807437 - Podman can't reuse a container name, even if the container that was using it is no longer around [extras-rhel-7.8/podman]
1807586 - podman exec does not reads from stdin [extras-rhel-7.8/podman]
1808702 - [FJ8.2 Bug]: [REG]The "--group-add" option of "podman create" doesn't function. [extras-rhel-7.8/podman]

6. Package List:

Red Hat Enterprise Linux 7 Extras:

Source:
podman-1.6.4-16.el7_8.src.rpm

noarch:
podman-docker-1.6.4-16.el7_8.noarch.rpm

ppc64le:
podman-1.6.4-16.el7_8.ppc64le.rpm
podman-debuginfo-1.6.4-16.el7_8.ppc64le.rpm

s390x:
podman-1.6.4-16.el7_8.s390x.rpm
podman-debuginfo-1.6.4-16.el7_8.s390x.rpm

x86_64:
podman-1.6.4-16.el7_8.x86_64.rpm
podman-debuginfo-1.6.4-16.el7_8.x86_64.rpm

Red Hat Enterprise Linux 7 Extras:

Source:
podman-1.6.4-16.el7_8.src.rpm

noarch:
podman-docker-1.6.4-16.el7_8.noarch.rpm

x86_64:
podman-1.6.4-16.el7_8.x86_64.rpm
podman-debuginfo-1.6.4-16.el7_8.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2019-18466
https://access.redhat.com/security/cve/CVE-2020-1702
https://access.redhat.com/security/updates/classification/#moderate

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2020 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBXoPf99zjgjWX9erEAQjdHA/+Oqk+XcsMWVkfj+1ZbVYczkGcnWC01hDW
Emgu22gTuMtdwuDG9lHy0vLMPva64FzkWV0marDYkkCuCS2cUD/irzoA0X/m4/GZ
Yho4BQ+6fCWZ/3P0C+F+xCrz7FWFy/Ib4rV4KhyaKq9qjB6W9guXfRR3Pxe5oohX
6euia8BdVw6sdNLG9tCrhENYM/zb76zwWWuwVWBYYsCHh2b6v2P6zutIoKhon1hN
LQ2LIwFjfjFJxXuDDpTIt2Y4y7SkTGsJ/DGUyyHyCbKAf84+t3srN3q/B7DM2O8I
x4vZLmL6kiZ88dfHl3Z8y6SL7+8xUBHAfvllEqRm6DRXpPMVBSDnVHuf8AGBI/EY
2HOAMUqE2UKYXaX7ZbbnVRZGf7MlBjrdGJs28QOid0FgJB4y1qPdymSst35pWPHd
G0OXhj3WxeE4Pfb6gzRRowMGTipRIAMuGDCGJKL9hcg9gC9l/Yianf0mrg8SLzUC
QwkQDbY1goUDbW8eLv9peFiwBz755CwOLP9G6t8Vmj+zNiTRy5vuadSpLYOzkLK1
8tEbMS51rH+fWAq4Egmwsvu5XMcMcY/00NfgXMBIBrVFIcYN2yzXHdijEF9jqABz
bNgIaM15wHAOZxc5Qey1a5/CMlm449WXQYrn1I+P9LCU+ZOqHOOxM0+RtSqdlPYG
+ymH1Ihp5tE=8y7H
-----END PGP SIGNATURE-----

--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce
Login or Register to add favorites

File Archive:

September 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Sep 1st
    20 Files
  • 2
    Sep 2nd
    15 Files
  • 3
    Sep 3rd
    15 Files
  • 4
    Sep 4th
    4 Files
  • 5
    Sep 5th
    1 Files
  • 6
    Sep 6th
    1 Files
  • 7
    Sep 7th
    15 Files
  • 8
    Sep 8th
    27 Files
  • 9
    Sep 9th
    7 Files
  • 10
    Sep 10th
    16 Files
  • 11
    Sep 11th
    9 Files
  • 12
    Sep 12th
    0 Files
  • 13
    Sep 13th
    0 Files
  • 14
    Sep 14th
    25 Files
  • 15
    Sep 15th
    15 Files
  • 16
    Sep 16th
    15 Files
  • 17
    Sep 17th
    15 Files
  • 18
    Sep 18th
    12 Files
  • 19
    Sep 19th
    1 Files
  • 20
    Sep 20th
    1 Files
  • 21
    Sep 21st
    15 Files
  • 22
    Sep 22nd
    21 Files
  • 23
    Sep 23rd
    0 Files
  • 24
    Sep 24th
    0 Files
  • 25
    Sep 25th
    0 Files
  • 26
    Sep 26th
    0 Files
  • 27
    Sep 27th
    0 Files
  • 28
    Sep 28th
    0 Files
  • 29
    Sep 29th
    0 Files
  • 30
    Sep 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close