Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 433
Alerts This Week
Warning Icon 1 433

openSUSE: 2019:2021-1 Important: Containerd and Docker Security Fixes

opensuse
Calendar Grey August 29, 2019
Dist Opensuse Esm H88
This improvement addresses critical bugs in Kubernetes and OpenShift, rectifying vulnerabilities and enhancing package releases.
An update that solves four vulnerabilities and has three fixes is now available.

Description

This update for containerd, docker, docker-runc,

golang-github-docker-libnetwork fixes the following issues:

Docker:

- CVE-2019-14271: Fixed a code injection if the nsswitch facility

dynamically loaded a library inside a chroot (bsc#1143409).

- CVE-2019-13509: Fixed an information leak in the debug log (bsc#1142160).

- Update to version 19.03.1-ce, see changelog at

/usr/share/doc/packages/docker/CHANGELOG.md (bsc#1142413, bsc#1139649).

runc:

- Use %config(noreplace) for /etc/docker/daemon.json (bsc#1138920).

- Update to runc 425e105d5a03, which is required by Docker (bsc#1139649).

containerd:

- CVE-2019-5736: Fixed a container breakout vulnerability (bsc#1121967).

- Update to containerd v1.2.6, which is required by docker (bsc#1139649).

golang-github-docker-libnetwork:

- Update to version git.fc5a7d91d54cc98f64fc28f9e288b46a0bee756c, which is

required by docker (bsc#1142413, bsc#1139649).

This update was imported...

Read the Full Advisory

Topics%20covered

Topics Covered

security advisory information leak important code injection openSUSE container breakout docker fix

Patch

Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods

like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 15.1:

zypper in -t patch openSUSE-2019-2021=1

- openSUSE Leap 15.0:

zypper in -t patch openSUSE-2019-2021=1

Package List

- openSUSE Leap 15.1 (x86_64):

containerd-1.2.6-lp151.2.6.1

containerd-ctr-1.2.6-lp151.2.6.1

docker-19.03.1_ce-lp151.2.12.1

docker-debuginfo-19.03.1_ce-lp151.2.12.1

docker-libnetwork-0.7.0.1+gitr2800_fc5a7d91d54c-lp151.2.6.1

docker-libnetwork-debuginfo-0.7.0.1+gitr2800_fc5a7d91d54c-lp151.2.6.1

docker-runc-1.0.0rc8+gitr3826_425e105d5a03-lp151.3.6.1

docker-runc-debuginfo-1.0.0rc8+gitr3826_425e105d5a03-lp151.3.6.1

docker-test-19.03.1_ce-lp151.2.12.1

docker-test-debuginfo-19.03.1_ce-lp151.2.12.1

golang-github-docker-libnetwork-0.7.0.1+gitr2800_fc5a7d91d54c-lp151.2.6.1

- openSUSE Leap 15.1 (noarch):

docker-bash-completion-19.03.1_ce-lp151.2.12.1

docker-zsh-completion-19.03.1_ce-lp151.2.12.1

- openSUSE Leap 15.0 (x86_64):

containerd-1.2.6-lp150.4.17.1

containerd-ctr-1.2.6-lp150.4.17.1

docker-19.03.1_ce-lp150.5.27.1

docker-debuginfo-19.03.1_ce-lp150.5.27.1

docker-libnetwork-0.7.0.1+gitr2800_fc5a7d91d54c-lp150.3.18.1

docker-libnetwork-debuginfo-0.7.0.1+gitr2800_fc5a7d91d54c-lp150.3.18.1

docker-runc-1.0.0rc8+gitr382...

Read the Full Advisory

References

https://www.suse.com/security/cve/CVE-2018-10892.html

https://www.suse.com/security/cve/CVE-2019-13509.html

https://www.suse.com/security/cve/CVE-2019-14271.html

https://www.suse.com/security/cve/CVE-2019-5736.html

https://bugzilla.suse.com/1100331

https://bugzilla.suse.com/1121967

https://bugzilla.suse.com/1138920

https://bugzilla.suse.com/1139649

https://bugzilla.suse.com/1142160

https://bugzilla.suse.com/1142413

https://bugzilla.suse.com/1143409

--

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: openSUSE-SU-2019:2021-1
Rating: important
Affected Products: openSUSE Leap 15.1 openSUSE Leap 15.0 le.

Topics%20covered

Topics Covered

security advisory information leak important code injection openSUSE container breakout docker fix

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.