Alerts This Week
Warning Icon 1 727
Alerts This Week
Warning Icon 1 727

openSUSE Leap 15.1: 2020:0398-1 Moderate: CNI, Conmon, Podman Issues

opensuse
Calendar Grey March 28, 2020
Dist Opensuse Esm H88
openSUSE Security Patch for cni, cni-plugins, conmon, along with podman, addressing a serious security vulnerability.
An update that solves one vulnerability and has two fixes is now available.

Description

This update for cni, cni-plugins, conmon, fuse-overlayfs, podman fixes the

following issues:

podman was updated to 1.8.0:

- CVE-2019-18466: Fixed a bug where podman cp would improperly copy files

on the host when copying a symlink in the container that included a glob

operator (#3829 bsc#1155217)

- The name of the cni-bridge in the default config changed from "cni0" to

"podman-cni0" with podman-1.6.0. Add a %trigger to rename the bridge in

the system to the new default if it exists. The trigger is only excuted

when updating podman-cni-config from something older than 1.6.0. This is

mainly needed for SLE where we're updating from 1.4.4 to 1.8.0

(bsc#1160460).

Update podman to v1.8.0 (bsc#1160460):

* Features

- The podman system service command has been added, providing a preview

of Podman's new Docker-compatible API. This API is still very new, and

not yet ready for production use, but is available for...

Read the Full Advisory

Patch

Patch Instructions:

To install this openSUSE Security Update use the SUSE recommended installation methods

like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- openSUSE Leap 15.1:

zypper in -t patch openSUSE-2020-398=1

Package List

- openSUSE Leap 15.1 (x86_64):

cni-0.7.1-lp151.2.3.1

cni-plugins-0.8.4-lp151.2.3.1

conmon-2.0.10-lp151.2.1

conmon-debuginfo-2.0.10-lp151.2.1

fuse-overlayfs-0.7.6-lp151.5.1

fuse-overlayfs-debuginfo-0.7.6-lp151.5.1

fuse-overlayfs-debugsource-0.7.6-lp151.5.1

podman-1.8.0-lp151.3.9.1

- openSUSE Leap 15.1 (noarch):

podman-cni-config-1.8.0-lp151.3.9.1

References

https://www.suse.com/security/cve/CVE-2019-18466.html

https://bugzilla.suse.com/1155217

https://bugzilla.suse.com/1160460

https://bugzilla.suse.com/1164390

--

Announcement ID: openSUSE-SU-2020:0398-1
Rating: moderate
Affected Products: openSUSE Leap 15.1 le.

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here