Red Hat Security Advisory

RHSA-2022:7469

container-tools:4.0 security and bug fix update

Released 2022-11-08 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.0.1-35.module+el8.7.0+16520+2db5507d.aarch64::container-tools:4.0, aardvark-dns-2:1.0.1-35.module+el8.7.0+16520+2db5507d.ppc64le::container-tools:4.0, aardvark-dns-2:1.0.1-35.module+el8.7.0+16520+2db5507d.s390x::container-tools:4.0 +47

Fixes 3 records

TI-2022-10313 CVE-2022-27191 · GHSA-8c26-wmh5-6g9v

The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go…

MEDIUM 40

The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03963 Published 2022-03-18 Partial fix · 0.0.0-20220314234659-1baeb1ce4c0b CWE-327

TI-2022-01574 CVE-2022-1708 · GHSA-fcm2-6c3h-pg6j

Uncontrolled resource consumption in CRI-O

LOW 39

A vulnerability was found in CRI-O that causes memory or disk space exhaustion on the node for anyone with access to the Kube API.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03165 Published 2022-06-07 Partial fix · 1.24.1, 1.23.3 +1 CWE-400

TI-2022-11706 CVE-2022-29162 · GHSA-f3fp-gc8g-vw66

Incorrect Default Permissions in runc

LOW 34

runc is a CLI tool for spawning and running containers on Linux according to the OCI specification.

CVSS 3.1HIGH 7.8 Local Low privileges No interaction EPSS 0.0039 Published 2022-05-17 Partial fix · 1.1.2 CWE-276