drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Zwei Probleme in podman
Name: |
Zwei Probleme in podman |
|
ID: |
RHSA-2020:5056-01 |
|
Distribution: |
Red Hat |
|
Plattformen: |
Red Hat Enterprise Linux Extras |
|
Datum: |
Di, 10. November 2020, 23:23 |
|
Referenzen: |
https://access.redhat.com/security/cve/CVE-2020-14040
https://access.redhat.com/security/cve/CVE-2020-14370 |
|
Applikationen: |
podman |
|
Originalnachricht |
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
===================================================================== Red Hat Security Advisory
Synopsis: Moderate: podman security and bug fix update Advisory ID: RHSA-2020:5056-01 Product: Red Hat Enterprise Linux Extras Advisory URL: https://access.redhat.com/errata/RHSA-2020:5056 Issue date: 2020-11-10 CVE Names: CVE-2020-14040 CVE-2020-14370 =====================================================================
1. Summary:
An update for podman is now available for Red Hat Enterprise Linux 7 Extras.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat Enterprise Linux 7 Extras - noarch, ppc64le, s390x, x86_64
3. Description:
The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.
Security Fix(es):
* golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash (CVE-2020-14040)
* podman: environment variables leak between containers when started via Varlink or Docker-compatible REST API (CVE-2020-14370)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Bug Fix(es):
* podman does not use $TMPDIR loading a tar file (BZ#1877699)
4. Solution:
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
5. Bugs fixed (https://bugzilla.redhat.com/):
1853652 - CVE-2020-14040 golang.org/x/text: possibility to trigger an infinite loop in encoding/unicode could lead to crash 1874268 - CVE-2020-14370 podman: environment variables leak between containers when started via Varlink or Docker-compatible REST API 1877699 - podman does not use $TMPDIR loading a tar file.
6. Package List:
Red Hat Enterprise Linux 7 Extras:
Source: podman-1.6.4-26.el7_9.src.rpm
noarch: podman-docker-1.6.4-26.el7_9.noarch.rpm
ppc64le: podman-1.6.4-26.el7_9.ppc64le.rpm podman-debuginfo-1.6.4-26.el7_9.ppc64le.rpm
s390x: podman-1.6.4-26.el7_9.s390x.rpm podman-debuginfo-1.6.4-26.el7_9.s390x.rpm
x86_64: podman-1.6.4-26.el7_9.x86_64.rpm podman-debuginfo-1.6.4-26.el7_9.x86_64.rpm
Red Hat Enterprise Linux 7 Extras:
Source: podman-1.6.4-26.el7_9.src.rpm
noarch: podman-docker-1.6.4-26.el7_9.noarch.rpm
x86_64: podman-1.6.4-26.el7_9.x86_64.rpm podman-debuginfo-1.6.4-26.el7_9.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2020-14040 https://access.redhat.com/security/cve/CVE-2020-14370 https://access.redhat.com/security/updates/classification/#moderate
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/
Copyright 2020 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1
iQIVAwUBX6qb4tzjgjWX9erEAQjtQBAAl4L73GDuxD2cS9lthlmb+raa76xfbh41 q8W8cmcr+nNwbJi1xgMgCJMouFe053GxogJLN+XxQeQgmkS0832GcHulkDIsKNDW 7NfR/4bxfQlTIlEuVgbAnHSF+M/yWmFzdSsiDwfcMCkOObq8bhQBORxm6P/vDK9j 0UXB1FniJf2WN+0eWGyh/KOwyh2sE13+1QM3SrGasn+o7GBrgUZ7tvtv/VN+dYsV IC+Q4FFc61vKC48G8rVjEWDPCteFRRpX8d2R+E+xwnWpxeLL0H7I4I+Xi45ul9q1 qLHdvthkog3F9sBWvatej4CvSESB8c1qUUbPVqBSudBigcmJhgBjt/QnKa2KMjt9 7w4cSSKC36MzGIUL9VT4N+UmcPQh4ttHElFVxQPUfXdVaTCfeonGUquiV8P6Rgot 0LAtLNqk7yUXnDVtkCXCmqlIhyosjBLWVNUKcTrJHJ7KFmPG+hYt2HvoYJ6tBmnF Rh5HtPTxt2GpNHrOjfHHciuQU98IcVZtDNttsV6CUaBviRwW+bY1k5SzxCTMshuL QTU6H2sRROrDCcm7+45xV04DKsUj/3ht6RT+obUduzGGm8f4/kLBKpRB1xvt7xe9 6g+SriQdRpz4A7wsSqQjQlhen8q5uzcTdlLjQjGgspJwr+AI34jDiS6gTs1BY8I/ PAXkpmF6eR0= =gMv+ -----END PGP SIGNATURE-----
-- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce
|
|
|
|