Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 573
Alerts This Week
Warning Icon 1 573

SUSE: 2021:0435-1 Important: Docker Privilege Escalation Fixes

suse
Calendar Grey February 11, 2021
Dist Suse Esm H88
SUSE releases critical patch to resolve several vulnerabilities found in containerd and Docker, coupled with significant improvements.
An update that solves three vulnerabilities, contains one feature and has 5 fixes is now available

Summary

This update for containerd, docker, docker-runc, golang-github-docker-libnetwork fixes the following issues: Security issues fixed: - CVE-2020-15257: Fixed a privilege escalation in containerd (bsc#1178969). - CVE-2021-21284: potential privilege escalation when the root user in the remapped namespace has access to the host filesystem (bsc#1181732) - CVE-2021-21285: pulling a malformed Docker image manifest crashes the dockerd daemon (bsc#1181730) Non-security issues fixed: - Update Docker to 19.03.15-ce. See upstream changelog in the packaged /usr/share/doc/packages/docker/CHANGELOG.md. This update includes fixes for bsc#1181732 (CVE-2021-21284) and bsc#1181730 (CVE-2021-21285). - Only apply the boo#1178801 libnetwork patch to handle firewalld on

Topics%20covered

Topics Covered

security advisory update privilege escalation fixes SUSE docker containerd

References

#1174075 #1176708 #1178801 #1178969 #1180243

#1180401 #1181730 #1181732 SLE-16460

Cross- CVE-2020-15257 CVE-2021-21284 CVE-2021-21285

CVSS scores:

CVE-2020-15257 (NVD) : 5.2 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

CVE-2020-15257 (SUSE): 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVE-2021-21284 (NVD) : 6.8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

CVE-2021-21284 (SUSE): 2.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:N

CVE-2021-21285 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

CVE-2021-21285 (SUSE): 5 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

Affected Products:

SUSE Manager Server 4.0

SUSE Manager Retail Branch Server 4.0

SUSE Manager Proxy 4.0

SUSE Linux Enterprise Server for SAP 15-SP1

SUSE Linux Ente...

Read the Full Advisory

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2021:0435-1
Rating: important

Topics%20covered

Topics Covered

security advisory update privilege escalation fixes SUSE docker containerd

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.