RedHat: RHSA-2022-8008:01 Moderate: buildah security and bug fix up...
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Moderate: buildah security and bug fix update
Advisory ID:       RHSA-2022:8008-01
Product:           Red Hat Enterprise Linux
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:8008
Issue date:        2022-11-15
CVE Names:         CVE-2021-20291 CVE-2021-33195 CVE-2021-33197 
                   CVE-2021-33198 CVE-2022-2989 CVE-2022-2990 
                   CVE-2022-27191 
=====================================================================

1. Summary:

An update for buildah is now available for Red Hat Enterprise Linux 9.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AppStream (v. 9) - aarch64, ppc64le, s390x, x86_64

3. Description:

The buildah package provides a tool for facilitating building OCI container
images. Among other things, buildah enables you to: Create a working
container, either from scratch or using an image as a starting point;
Create an image, either from a working container or using the instructions
in a Dockerfile; Build both Docker and OCI images.

Security Fix(es):

* containers/storage: DoS via malicious image (CVE-2021-20291)

* golang: net: lookup functions may return invalid host names
(CVE-2021-33195)

* golang: net/http/httputil: ReverseProxy forwards connection headers if
first one is empty (CVE-2021-33197)

* golang: math/big.Rat: may cause a panic or an unrecoverable fatal error
if passed inputs with very large exponents (CVE-2021-33198)

* golang: crash in a golang.org/x/crypto/ssh server (CVE-2022-27191)

* podman: possible information disclosure and modification (CVE-2022-2989)

* buildah: possible information disclosure and modification (CVE-2022-2990)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat
Enterprise Linux 9.1 Release Notes linked from the References section.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1939485 - CVE-2021-20291 containers/storage: DoS via malicious image
1989564 - CVE-2021-33195 golang: net: lookup functions may return invalid host names
1989570 - CVE-2021-33197 golang: net/http/httputil: ReverseProxy forwards connection headers if first one is empty
1989575 - CVE-2021-33198 golang: math/big.Rat: may cause a panic or an unrecoverable fatal error if passed inputs with very large exponents
2064702 - CVE-2022-27191 golang: crash in a golang.org/x/crypto/ssh server
2081835 - networking is broken when building containers due to missing container networking package dependencies
2121445 - CVE-2022-2989 podman: possible information disclosure and modification
2121453 - CVE-2022-2990 buildah: possible information disclosure and modification

6. Package List:

Red Hat Enterprise Linux AppStream (v. 9):

Source:
buildah-1.27.0-2.el9.src.rpm

aarch64:
buildah-1.27.0-2.el9.aarch64.rpm
buildah-debuginfo-1.27.0-2.el9.aarch64.rpm
buildah-debugsource-1.27.0-2.el9.aarch64.rpm
buildah-tests-1.27.0-2.el9.aarch64.rpm
buildah-tests-debuginfo-1.27.0-2.el9.aarch64.rpm

ppc64le:
buildah-1.27.0-2.el9.ppc64le.rpm
buildah-debuginfo-1.27.0-2.el9.ppc64le.rpm
buildah-debugsource-1.27.0-2.el9.ppc64le.rpm
buildah-tests-1.27.0-2.el9.ppc64le.rpm
buildah-tests-debuginfo-1.27.0-2.el9.ppc64le.rpm

s390x:
buildah-1.27.0-2.el9.s390x.rpm
buildah-debuginfo-1.27.0-2.el9.s390x.rpm
buildah-debugsource-1.27.0-2.el9.s390x.rpm
buildah-tests-1.27.0-2.el9.s390x.rpm
buildah-tests-debuginfo-1.27.0-2.el9.s390x.rpm

x86_64:
buildah-1.27.0-2.el9.x86_64.rpm
buildah-debuginfo-1.27.0-2.el9.x86_64.rpm
buildah-debugsource-1.27.0-2.el9.x86_64.rpm
buildah-tests-1.27.0-2.el9.x86_64.rpm
buildah-tests-debuginfo-1.27.0-2.el9.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2021-20291
https://access.redhat.com/security/cve/CVE-2021-33195
https://access.redhat.com/security/cve/CVE-2021-33197
https://access.redhat.com/security/cve/CVE-2021-33198
https://access.redhat.com/security/cve/CVE-2022-2989
https://access.redhat.com/security/cve/CVE-2022-2990
https://access.redhat.com/security/cve/CVE-2022-27191
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.1_release_notes/index

8. Contact:

The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBY3PhO9zjgjWX9erEAQjSFg//TmQoiB4pxBXzwpB8PKdSXPda8mbc4fEY
tTxG4fDB5j/Xix/MkMajS+kWL6RmwLdnrR34cKzyQ7MPYAxbW0efssoChZ5fuFMO
CC8W8FBieAWSf+zJaaGDIUvEhUKL189Qeic175ilgkExNus3OycvtJnJdZa/uyjZ
0NPHe3oqRpt/jmRdrlBogQtzgDcj3440M0ER5wQcQyXa7DHF0aQKGFoC93D+QrAa
x3m7mK0vcAhIvOLYLhEXiGUKqqW9b+lYYgszMVi/gxdnIDXT+3in08sO1xzZrOAv
1sc4FJ+lBAYz23yFF8KeLRZOUOk/Js4mylN033nggmVPyU+uISXKkY9jtqJ2LBM2
bGQW+a0x4B/ef0Al4TYoDvieSCWGzlHBdFlylMXD0bPTx9j04z8/dqGSvn+rGRtH
whgq9782nXiRYt8itbTa/FL9IezrQz7/ryg1lVVQLxh2nhCaAa2NAEpky77Fupj9
mhRqYp0evBgoMTkMOkyskSp9YXjOZNLk/DB2n3oAnYgwOfOinz8fGy4KsL6D/pkt
5jLo8rvjbeTplnCwJrwUwpRb7MF3lua1oXCYCJf/3h7m/SCuVO0LRywNLdSF2BX7
r+LYttzHSYP/4E39Lpefq1trvt0qqnyJx8183KnTQA8M9yW4V3abEmrjXJUxQLfT
zXvxQ+zuUq0=
=rzwm
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
[email protected]
https://listman.redhat.com/mailman/listinfo/rhsa-announce

RedHat: RHSA-2022-8008:01 Moderate: buildah security and bug fix update

An update for buildah is now available for Red Hat Enterprise Linux 9

Summary

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images.
Security Fix(es):
* containers/storage: DoS via malicious image (CVE-2021-20291)
* golang: net: lookup functions may return invalid host names (CVE-2021-33195)
* golang: net/http/httputil: ReverseProxy forwards connection headers if first one is empty (CVE-2021-33197)
* golang: math/big.Rat: may cause a panic or an unrecoverable fatal error if passed inputs with very large exponents (CVE-2021-33198)
* golang: crash in a golang.org/x/crypto/ssh server (CVE-2022-27191)
* podman: possible information disclosure and modification (CVE-2022-2989)
* buildah: possible information disclosure and modification (CVE-2022-2990)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.1 Release Notes linked from the References section.

Solution

For details on how to apply this update, which includes the changesdescribed in this advisory, refer to:https://access.redhat.com/articles/11258

References

https://access.redhat.com/security/cve/CVE-2021-20291 https://access.redhat.com/security/cve/CVE-2021-33195 https://access.redhat.com/security/cve/CVE-2021-33197 https://access.redhat.com/security/cve/CVE-2021-33198 https://access.redhat.com/security/cve/CVE-2022-2989 https://access.redhat.com/security/cve/CVE-2022-2990 https://access.redhat.com/security/cve/CVE-2022-27191 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.1_release_notes/index

Package List

Red Hat Enterprise Linux AppStream (v. 9):
Source: buildah-1.27.0-2.el9.src.rpm
aarch64: buildah-1.27.0-2.el9.aarch64.rpm buildah-debuginfo-1.27.0-2.el9.aarch64.rpm buildah-debugsource-1.27.0-2.el9.aarch64.rpm buildah-tests-1.27.0-2.el9.aarch64.rpm buildah-tests-debuginfo-1.27.0-2.el9.aarch64.rpm
ppc64le: buildah-1.27.0-2.el9.ppc64le.rpm buildah-debuginfo-1.27.0-2.el9.ppc64le.rpm buildah-debugsource-1.27.0-2.el9.ppc64le.rpm buildah-tests-1.27.0-2.el9.ppc64le.rpm buildah-tests-debuginfo-1.27.0-2.el9.ppc64le.rpm
s390x: buildah-1.27.0-2.el9.s390x.rpm buildah-debuginfo-1.27.0-2.el9.s390x.rpm buildah-debugsource-1.27.0-2.el9.s390x.rpm buildah-tests-1.27.0-2.el9.s390x.rpm buildah-tests-debuginfo-1.27.0-2.el9.s390x.rpm
x86_64: buildah-1.27.0-2.el9.x86_64.rpm buildah-debuginfo-1.27.0-2.el9.x86_64.rpm buildah-debugsource-1.27.0-2.el9.x86_64.rpm buildah-tests-1.27.0-2.el9.x86_64.rpm buildah-tests-debuginfo-1.27.0-2.el9.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/

Severity
Advisory ID: RHSA-2022:8008-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2022:8008
Issued Date: : 2022-11-15
CVE Names: CVE-2021-20291 CVE-2021-33195 CVE-2021-33197 CVE-2021-33198 CVE-2022-2989 CVE-2022-2990 CVE-2022-27191

Topic

An update for buildah is now available for Red Hat Enterprise Linux 9.Red Hat Product Security has rated this update as having a security impactof Moderate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.

Relevant Releases Architectures

Red Hat Enterprise Linux AppStream (v. 9) - aarch64, ppc64le, s390x, x86_64

Bugs Fixed

1939485 - CVE-2021-20291 containers/storage: DoS via malicious image

1989564 - CVE-2021-33195 golang: net: lookup functions may return invalid host names

1989570 - CVE-2021-33197 golang: net/http/httputil: ReverseProxy forwards connection headers if first one is empty

1989575 - CVE-2021-33198 golang: math/big.Rat: may cause a panic or an unrecoverable fatal error if passed inputs with very large exponents

2064702 - CVE-2022-27191 golang: crash in a golang.org/x/crypto/ssh server

2081835 - networking is broken when building containers due to missing container networking package dependencies

2121445 - CVE-2022-2989 podman: possible information disclosure and modification

2121453 - CVE-2022-2990 buildah: possible information disclosure and modification

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.