Login
Newsletter
Werbung

Sicherheit: Mehrere Probleme in buildah
Aktuelle Meldungen Distributionen
Name: Mehrere Probleme in buildah
ID: SUSE-SU-2018:4218-1
Distribution: SUSE
Plattformen: SUSE CaaS Platform 3.0
Datum: Fr, 21. Dezember 2018, 18:27
Referenzen: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16875
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16873
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16874
Applikationen: Buildah

Originalnachricht

   SUSE Security Update: Security update for buildah, caasp-cli, caasp-dex,
cni-plugins, container-feeder, containerd-kubic, cri-o, cri-tools, docker-kubic, docker-runc-kubic, etcd, flannel, golang-github-docker-libnetwork-kubic, helm, kubernetes, kubernetes-dns, libcontainers-storage, podman, runc, skopeo, umoci
______________________________________________________________________________

Announcement ID: SUSE-SU-2018:4218-1
Rating: important
References: #1118897 #1118898 #1118899
Cross-References: CVE-2018-16873 CVE-2018-16874 CVE-2018-16875

Affected Products:
SUSE CaaS Platform 3.0
______________________________________________________________________________

An update that fixes three vulnerabilities is now available.

Description:


This update for buildah, caasp-cli, caasp-dex, cni-plugins,
container-feeder, containerd-kubic, cri-o, cri-tools, docker-kubic,
docker-runc-kubic, etcd, flannel, golang-github-docker-libnetwork-kubic,
helm, kubernetes, kubernetes-dns, libcontainers-storage, podman, runc,
skopeo, umoci fixes the following issues:

- Require golang = 1.10 to fix:
* bsc#1118897 CVE-2018-16873 go#29230 cmd/go: remote command execution
during "go get -u"
* bsc#1118898 CVE-2018-16874 go#29231 cmd/go: directory traversal in
"go
get" via curly braces in import paths
* bsc#1118899 CVE-2018-16875 go#29233 crypto/x509: CPU denial of service


Patch Instructions:

To install this SUSE Security Update use the SUSE recommended installation
methods
like YaST online_update or "zypper patch".

Alternatively you can run the command listed for your product:

- SUSE CaaS Platform 3.0:

To install this update, use the SUSE CaaS Platform Velum dashboard.
It will inform you if it detects new updates and let you then trigger
updating of the complete cluster in a controlled way.



Package List:

- SUSE CaaS Platform 3.0 (x86_64):

caasp-cli-3.0.0+20180515.git_r38_7843d12-3.3.1
cni-plugins-0.6.0-4.3.1
container-feeder-3.0.0+20181105.git_r90_c54fd18-3.9.1
containerd-kubic-0.2.9+gitr706_06b9cb351610-5.3.1
containerd-kubic-debuginfo-0.2.9+gitr706_06b9cb351610-5.3.1
containerd-kubic-debugsource-0.2.9+gitr706_06b9cb351610-5.3.1
cri-o-1.10.6-4.11.1
cri-tools-1.0.0beta2-3.6.1
docker-kubic-17.09.1_ce-7.3.1
docker-kubic-debuginfo-17.09.1_ce-7.3.1
docker-kubic-debugsource-17.09.1_ce-7.3.1
docker-libnetwork-kubic-0.7.0.1+gitr2066_7b2b1feb1de4-3.3.1
docker-libnetwork-kubic-debuginfo-0.7.0.1+gitr2066_7b2b1feb1de4-3.3.1
docker-runc-kubic-1.0.0rc4+gitr3338_3f2f8b84a77f-5.3.1
docker-runc-kubic-debuginfo-1.0.0rc4+gitr3338_3f2f8b84a77f-5.3.1
docker-runc-kubic-debugsource-1.0.0rc4+gitr3338_3f2f8b84a77f-5.3.1
etcd-3.3.1-3.3.1
etcdctl-3.3.1-3.3.1

golang-github-docker-libnetwork-kubic-debugsource-0.7.0.1+gitr2066_7b2b1feb1de4-3.3.1
helm-2.8.2-3.3.1
kubernetes-client-1.10.11-4.11.1
kubernetes-common-1.10.11-4.11.1
kubernetes-kubelet-1.10.11-4.11.1
kubernetes-master-1.10.11-4.11.1
kubernetes-node-1.10.11-4.11.1
libcontainers-storage-0+git26204-3.3.1
podman-0.8.5-3.6.1
runc-1.0.0~rc5-3.3.1
runc-debuginfo-1.0.0~rc5-3.3.1
runc-debugsource-1.0.0~rc5-3.3.1


References:

https://www.suse.com/security/cve/CVE-2018-16873.html
https://www.suse.com/security/cve/CVE-2018-16874.html
https://www.suse.com/security/cve/CVE-2018-16875.html
https://bugzilla.suse.com/1118897
https://bugzilla.suse.com/1118898
https://bugzilla.suse.com/1118899

_______________________________________________
sle-security-updates mailing list
sle-security-updates@lists.suse.com
http://lists.suse.com/mailman/listinfo/sle-security-updates
Pro-Linux
Pro-Linux @Facebook
Neue Nachrichten
Werbung