Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 519
Alerts This Week
Warning Icon 1 519

openSUSE Leap 42.3: 2018:0406-1 Important: Docker Data Loss & DoS

opensuse
Calendar Grey February 9, 2018
Dist Opensuse Esm H88
Urgent openSUSE Security Patch released for docker, docker-runc, and associated modules tackling significant vulnerabilities.
An update that solves two vulnerabilities and has 17 fixes is now available.

Description

This update for docker, docker-runc, containerd,

golang-github-docker-libnetwork fixes several issues.

These security issues were fixed:

- CVE-2017-16539: The DefaultLinuxSpec function in oci/defaults.go docker

did not block /proc/scsi pathnames, which allowed attackers to trigger

data loss (when certain older Linux kernels are used) by leveraging

Docker container access to write a "scsi remove-single-device" line to

/proc/scsi/scsi, aka SCSI MICDROP (bnc#1066801)

- CVE-2017-14992: Lack of content verification in docker allowed a remote

attacker to cause a Denial of Service via a crafted image layer payload,

aka gzip bombing. (bnc#1066210)

These non-security issues were fixed:

- bsc#1059011: The systemd service helper script used a timeout of 60

seconds to start the daemon, which is insufficient in cases where the

daemon takes longer to start. Instead, set the service type from

'simple' to 'notify' and remove the...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory DoS application update data loss openSUSE docker impactful

Patch

Patch Instructions:

To install this openSUSE Security Update use YaST online_update.

Alternatively you can run the command listed for your product:

- openSUSE Leap 42.3:

zypper in -t patch openSUSE-2018-152=1

To bring your system up-to-date, use "zypper patch".

Package List

- openSUSE Leap 42.3 (i586 x86_64):

containerd-0.2.9+gitr706_06b9cb351610-16.1

containerd-ctr-0.2.9+gitr706_06b9cb351610-16.1

containerd-ctr-debuginfo-0.2.9+gitr706_06b9cb351610-16.1

containerd-debuginfo-0.2.9+gitr706_06b9cb351610-16.1

containerd-debugsource-0.2.9+gitr706_06b9cb351610-16.1

docker-libnetwork-0.7.0.1+gitr2066_7b2b1feb1de4-5.1

docker-libnetwork-debuginfo-0.7.0.1+gitr2066_7b2b1feb1de4-5.1

docker-runc-1.0.0rc4+gitr3338_3f2f8b84a77f-2.1

docker-runc-debuginfo-1.0.0rc4+gitr3338_3f2f8b84a77f-2.1

docker-runc-debugsource-1.0.0rc4+gitr3338_3f2f8b84a77f-2.1

golang-github-docker-libnetwork-0.7.0.1+gitr2066_7b2b1feb1de4-5.1

golang-github-docker-libnetwork-debugsource-0.7.0.1+gitr2066_7b2b1feb1de4-5.1

- openSUSE Leap 42.3 (x86_64):

docker-17.09.1_ce-36.1

docker-debuginfo-17.09.1_ce-36.1

docker-debugsource-17.09.1_ce-36.1

docker-test-17.09.1_ce-36.1

docker-test-debuginfo-17.09.1_ce-36.1

- openSUSE Leap 42.3 (noarch):

containerd-test-0.2.9+gitr706_06b9cb351610-16.1

docker-bash-completion-17.09.1_ce-36.1

dock...

Read the Full Advisory

References

https://www.suse.com/security/cve/CVE-2017-14992.html

https://www.suse.com/security/cve/CVE-2017-16539.html

https://bugzilla.suse.com/1021227

https://bugzilla.suse.com/1029320

https://bugzilla.suse.com/1032287

https://bugzilla.suse.com/1045628

https://bugzilla.suse.com/1046024

https://bugzilla.suse.com/1048046

https://bugzilla.suse.com/1051429

https://bugzilla.suse.com/1053532

https://bugzilla.suse.com/1055676

https://bugzilla.suse.com/1057743

https://bugzilla.suse.com/1058173

https://bugzilla.suse.com/1059011

https://bugzilla.suse.com/1064926

https://bugzilla.suse.com/1065109

https://bugzilla.suse.com/1066210

https://bugzilla.suse.com/1066801

https://bugzilla.suse.com/1069468

https://bugzilla.suse.com/1069758

https://bugzilla.suse.com/1072798

--

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: openSUSE-SU-2018:0406-1
Rating: important
Affected Products: openSUSE Leap 42.3 le.

Topics%20covered

Topics Covered

security advisory DoS application update data loss openSUSE docker impactful

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.