Stay Secure with the Latest Linux Advisories

security advisorymoderatesecurity fix

Red Hat Enterprise Linux 7 Podman Update: RHSA-2020:5056-01 Moderate Update

An update for podman is now available for Red Hat Enterprise Linux 7 Extras. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: podman security and bug fix update Advisory ID: RHSA-2020:5056-01 Product: Red Hat Enterprise Linux Extras Advisory URL: https://access.redhat.com/errata/RHSA-2020:5056 Issue date: 2020-11-10 CVE Names: CVE-2020-14040 CVE-2020-14370 ==================================================================== 1. Summary: An update for podman is now available for Red Hat Enterprise Linux 7 Extras. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux 7 Extras - noarch, ppc64le, s390x, x86_64 3. Description: The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fix(es): * golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash (CVE-2020-14040) * podman: environment variables leak between containers when started via Varlink or Docker-compatible REST API (CVE-2020-14370) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * podman does not use $TMPDIR loading a tar file (BZ#1877699) 4. Solution: For details on how to apply this update, which includes thechanges described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1853652 - CVE-2020-14040 golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash 1874268 - CVE-2020-14370 podman: environment variables leak between containers when started via Varlink or Docker-compatible REST API 1877699 - podman does not use $TMPDIR loading a tar file. 6. Package List: Red Hat Enterprise Linux 7 Extras: Source: podman-1.6.4-26.el7_9.src.rpm noarch: podman-docker-1.6.4-26.el7_9.noarch.rpm ppc64le: podman-1.6.4-26.el7_9.ppc64le.rpm podman-debuginfo-1.6.4-26.el7_9.ppc64le.rpm s390x: podman-1.6.4-26.el7_9.s390x.rpm podman-debuginfo-1.6.4-26.el7_9.s390x.rpm x86_64: podman-1.6.4-26.el7_9.x86_64.rpm podman-debuginfo-1.6.4-26.el7_9.x86_64.rpm Red Hat Enterprise Linux 7 Extras: Source: podman-1.6.4-26.el7_9.src.rpm noarch: podman-docker-1.6.4-26.el7_9.noarch.rpm x86_64: podman-1.6.4-26.el7_9.x86_64.rpm podman-debuginfo-1.6.4-26.el7_9.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key 7. References: https://access.redhat.com/security/cve/CVE-2020-14040 https://access.redhat.com/security/cve/CVE-2020-14370 https://access.redhat.com/security/updates/classification#moderate 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2020 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPGv1 iQIVAwUBX6qb4tzjgjWX9erEAQjtQBAAl4L73GDuxD2cS9lthlmb+raa76xfbh41 q8W8cmcr+nNwbJi1xgMgCJMouFe053GxogJLN+XxQeQgmkS0832GcHulkDIsKNDW 7NfR/4bxfQlTIlEuVgbAnHSF+M/yWmFzdSsiDwfcMCkOObq8bhQBORxm6P/vDK9j 0UXB1FniJf2WN+0eWGyh/KOwyh2sE13+1QM3SrGasn+o7GBrgUZ7tvtv/VN+dYsV IC+Q4FFc61vKC48G8rVjEWDPCteFRRpX8d2R+E+xwnWpxeLL0H7I4I+Xi45ul9q1 qLHdvthkog3F9sBWvatej4CvSESB8c1qUUbPVqBSudBigcmJhgBjt/QnKa2KMjt9 7w4cSSKC36MzGIUL9VT4N+UmcPQh4ttHElFVxQPUfXdVaTCfeonGUquiV8P6Rgot 0LAtLNqk7yUXnDVtkCXCmqlIhyosjBLWVNUKcTrJHJ7KFmPG+hYt2HvoYJ6tBmnF Rh5HtPTxt2GpNHrOjfHHciuQU98IcVZtDNttsV6CUaBviRwW+bY1k5SzxCTMshuL QTU6H2sRROrDCcm7+45xV04DKsUj/3ht6RT+obUduzGGm8f4/kLBKpRB1xvt7xe9 6g+SriQdRpz4A7wsSqQjQlhen8q5uzcTdlLjQjGgspJwr+AI34jDiS6gTs1BY8I/ PAXkpmF6eR0=gMv+ -----END PGP SIGNATURE----- -- RHSA-announce mailing list This email address is being protected from spambots. You need JavaScript enabled to view it. . The recent Podman update for Red Hat Enterprise Linux improves stability and addresses vulnerabilities, ensuring security and optimal performance for containers. Podman, Red Hat, Enterprise, Linux, Update. . LinuxSecurity.com Team

Nov 10, 2020 Red Hat