Stay Secure with the Latest Linux Advisories

security advisorymoderateFedora

Fedora 33 Advisory: CVE-2021-20206 Moderate Threat on Buildah

bump podman to v3.0.1, Security fix for CVE-2021-20206 ---- Resolves: #1919391, #1926796 - Security fix for CVE-2021-20206 ---- Autobuilt v1.19.3 ---- Autobuilt v1.19.2 ---- Autobuilt v1.19.1 ---- Autobuilt v1.19.0 ---- harden cgo based golang binaries ---- Autobuilt v0.9.1. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2021-fb466fb623 2021-02-26 01:07:35.018897 --------------------------------------------------------------------------------Name : buildah Product : Fedora 33 Version : 1.19.6 Release : 2.fc33 URL : https://buildah.io Summary : A command line tool used for creating OCI Images Description : The buildah package provides a command line tool which can be used to * create a working container from scratch or * create a working container from an image as a starting point * mount/umount a working container's root file system for manipulation * save container's root file system layer to create a new image * delete a working container or an image --------------------------------------------------------------------------------Update Information: bump podman to v3.0.1, Security fix for CVE-2021-20206 ---- Resolves: #1919391, #1926796 - Security fix for CVE-2021-20206 ---- Autobuilt v1.19.3 ---- Autobuilt v1.19.2 ---- Autobuilt v1.19.1 ---- Autobuilt v1.19.0 ----harden cgo based golang binaries ---- Autobuilt v0.9.1 --------------------------------------------------------------------------------ChangeLog: * Mon Feb 22 2021 Lokesh Mandvekar - 1.19.6-2 - bump timeout for buildah gating tests - Suggested by Ed Santiago * Fri Feb 19 2021 Dan Walsh - 1.19.6-1 - Fix gating test and bum to 1.19.6 * Fri Feb 12 2021 Lokesh Mandvekar - 1.19.4-3 - adjust buildtags for centos * Thu Feb 11 2021 Lokesh Mandvekar - 1.19.4-2 - bump for centos * Tue Feb 9 2021 Lokesh Mandvekar - 1.19.4-1 - Resolves: #1919391, #1926796 - Security fix for CVE-2021-20206 - bumpto v1.19.4 - adjust dependencies * Fri Jan 29 2021 RH Container Bot - 1.19.3-1 - autobuilt v1.19.3 * Fri Jan 15 2021 RH Container Bot - 1.19.2-1 - autobuilt v1.19.2 * Thu Jan 14 2021 RH Container Bot - 1.19.1-1 - autobuilt v1.19.1 * Sat Jan 9 2021 RH Container Bot - 1.19.0-1 - autobuilt v1.19.0 * Mon Dec 7 2020 Lokesh Mandvekar - 1.18.0-3 - bump release tag for centos OBS * Mon Dec 7 2020 Lokesh Mandvekar - 1.18.0-2 - harden cgo based go binaries - Reported-by: Wade Mealing --------------------------------------------------------------------------------References: [ 1 ] Bug #1919391 - CVE-2021-20206 containernetworking-cni: Arbitrary path injection via type field in CNI configuration https://bugzilla.redhat.com/show_bug.cgi?id=1919391 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2021-fb466fb623' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list -- This email address is being protected from spambots. You need JavaScript enabled to view it. To unsubscribe send an email to This email address is being protected from spambots. You need JavaScript enabled to view it. Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedoraproject.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it./ Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure . Discover the Fedora 33 Buildah update for CVE-2021-20206 to prevent arbitrary path injectionissues.. Fedora Buildah Security, Podman Upgrade, CNI Configuration. . LinuxSecurity.com Team

Feb 25, 2021 Fedora