drucken bookmarks versenden konfigurieren admin pdf Sicherheit: Mehrere Probleme in docker-runc, golang-github-docker-libnetwork, docker und containerd
Name: |
Mehrere Probleme in docker-runc, golang-github-docker-libnetwork, docker und containerd |
|
ID: |
SUSE-SU-2021:0445-1 |
|
Distribution: |
SUSE |
|
Plattformen: |
SUSE Linux Enterprise Module for Containers 12 |
|
Datum: |
Fr, 12. Februar 2021, 20:17 |
|
Referenzen: |
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21284
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21285
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15157 |
|
Applikationen: |
golang-github-docker-libnetwork, Docker, runc, containerd |
|
Originalnachricht |
SUSE Security Update: Security update for containerd, docker, docker-runc, golang-github-docker-libnetwork ______________________________________________________________________________
Announcement ID: SUSE-SU-2021:0445-1 Rating: important References: #1065609 #1153367 #1157330 #1158590 #1176708 #1177598 #1178801 #1180401 #1181730 #1181732 Cross-References: CVE-2020-15157 CVE-2021-21284 CVE-2021-21285 CVSS scores: CVE-2020-15157 (NVD) : 6.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N CVE-2020-15157 (SUSE): 6.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N CVE-2021-21284 (NVD) : 6.8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N CVE-2021-21284 (SUSE): 2.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:N CVE-2021-21285 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H CVE-2021-21285 (SUSE): 5 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
Affected Products: SUSE Linux Enterprise Module for Containers 12 ______________________________________________________________________________
An update that solves three vulnerabilities and has 7 fixes is now available.
Description:
This update for containerd, docker, docker-runc, golang-github-docker-libnetwork fixes the following issues:
Update Docker to 19.03.15-ce:
- CVE-2021-21284: potential privilege escalation when the root user in the remapped namespace has access to the host filesystem (bsc#1181732) - CVE-2021-21285: malformed Docker image manifest crashes the dockerd daemon (bsc#1181730) - CVE-2020-15157: containerd: credentials leaking during image pull (bsc#1177598)
Patch Instructions:
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- SUSE Linux Enterprise Module for Containers 12:
zypper in -t patch SUSE-SLE-Module-Containers-12-2021-445=1
Package List:
- SUSE Linux Enterprise Module for Containers 12 (ppc64le s390x x86_64):
containerd-1.3.9-16.35.1 docker-19.03.15_ce-98.60.2 docker-debuginfo-19.03.15_ce-98.60.2 docker-libnetwork-0.7.0.1+gitr2908_55e924b8a842-37.1 docker-libnetwork-debuginfo-0.7.0.1+gitr2908_55e924b8a842-37.1 docker-runc-1.0.0rc10+gitr3981_dc9208a3303f-1.52.1
References:
https://www.suse.com/security/cve/CVE-2020-15157.html https://www.suse.com/security/cve/CVE-2021-21284.html https://www.suse.com/security/cve/CVE-2021-21285.html https://bugzilla.suse.com/1065609 https://bugzilla.suse.com/1153367 https://bugzilla.suse.com/1157330 https://bugzilla.suse.com/1158590 https://bugzilla.suse.com/1176708 https://bugzilla.suse.com/1177598 https://bugzilla.suse.com/1178801 https://bugzilla.suse.com/1180401 https://bugzilla.suse.com/1181730 https://bugzilla.suse.com/1181732
|
|
|
|