Red Hat Security Advisory

RHSA-2020:1234

docker security and bug fix update

Released 2020-04-01 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux 7 Extras docker-2:1.13.1-161.git64e9980.el7_8, docker-client-2:1.13.1-161.git64e9980.el7_8, docker-common-2:1.13.1-161.git64e9980.el7_8 +5

Fixes 3 records

TI-2020-07179 CVE-2020-8945 · GHSA-m6wg-2mwg-4rfq

The proglottis Go wrapper before 0.1.1 for the GPGME library has a use-after-free, as…

MEDIUM 41

The proglottis Go wrapper before 0.1.1 for the GPGME library has a use-after-free, as demonstrated by use for container image pulls by Docker or CRI-O.

CVSS 3.1HIGH 7.5 Network No auth User interaction EPSS 0.05071 Published 2020-02-12 Partial fix · 0.1.1 CWE-416

TI-2019-12591 CVE-2019-16884 · GHSA-fgv8-vj5c-2ppq

runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows…

MEDIUM 40

runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a malicious Docker image…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.04409 Published 2019-09-25 Partial fix · 1.0.0-rc8.0.20190930145003-cad42f6e0932, 1.3.1-0.20190929122143-5215b1806f52 CWE-863

TI-2020-01649 CVE-2020-1702 · GHSA-f6vj-xx8j-fqmq

Uncontrolled resource consumption in containers/image

LOW 17

A malicious container image can consume an unbounded amount of memory when being pulled to a container runtime host, such as Red Hat Enterprise Linux using podman, or OpenShift Container Platform.

CVSS 3.1LOW 3.3 Local No auth User interaction EPSS 0.00688 Published 2021-05-27 Partial fix CWE-400