Red Hat Security Advisory

RHSA-2022:7457

container-tools:rhel8 security, bug fix, and enhancement update

Released 2022-11-08 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.1.0-4.module+el8.7.0+16772+33343656.aarch64::container-tools:rhel8, aardvark-dns-2:1.1.0-4.module+el8.7.0+16772+33343656.ppc64le::container-tools:rhel8, aardvark-dns-2:1.1.0-4.module+el8.7.0+16772+33343656.s390x::container-tools:rhel8 +47

Fixes 6 records

TI-2022-10313 CVE-2022-27191 · GHSA-8c26-wmh5-6g9v

The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go…

MEDIUM 40

The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03963 Published 2022-03-18 Partial fix · 0.0.0-20220314234659-1baeb1ce4c0b CWE-327

TI-2022-01574 CVE-2022-1708 · GHSA-fcm2-6c3h-pg6j

Uncontrolled resource consumption in CRI-O

LOW 39

A vulnerability was found in CRI-O that causes memory or disk space exhaustion on the node for anyone with access to the Kube API.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03165 Published 2022-06-07 Partial fix · 1.24.1, 1.23.3 +1 CWE-400

TI-2022-11706 CVE-2022-29162 · GHSA-f3fp-gc8g-vw66

Incorrect Default Permissions in runc

LOW 34

runc is a CLI tool for spawning and running containers on Linux according to the OCI specification.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.0039 Published 2022-05-17 Partial fix · 1.1.2 CWE-276

TI-2021-14632 CVE-2021-36221 · GHSA-6qcx-qr4g-4fx9

Go before 1.15.15 and 1.16.x before 1.16.7 has a race condition that can lead to a…

LOW 32

Go before 1.15.15 and 1.16.x before 1.16.7 has a race condition that can lead to a net/http/httputil ReverseProxy panic upon an ErrAbortHandler abort.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.03114 Published 2021-08-08 Partial fix CWE-362

TI-2022-02761 CVE-2022-2990 · GHSA-fjm8-m7m6-2fjp

Incorrect authorization in buildah

LOW 31

An incorrect handling of the supplementary groups in the Buildah container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected containe…

CVSS 3.1HIGH 7.1 Local Low privileges No interaction EPSS 0.00353 Published 2022-09-13 Partial fix · 1.27.1 CWE-842

TI-2021-18029 CVE-2021-41190 · GHSA-mc8v-mgrf-8f4m

Clarify Content-Type handling in OCI spec

LOW 27

The OCI Distribution Spec project defines an API protocol to facilitate and standardize the distribution of content.

CVSS 3.1MEDIUM 5.0 Network Low privileges No interaction EPSS 0.02223 Published 2021-11-17 Partial fix · 1.0.1 CWE-843