Red Hat Security Advisory

RHSA-2024:2077

container-tools:rhel8 security and bug fix update

Released 2024-04-29 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream EUS (v.8.8) aardvark-dns-2:1.5.0-2.module+el8.8.0+21741+dd5be1e7.aarch64::container-tools:rhel8, aardvark-dns-2:1.5.0-2.module+el8.8.0+21741+dd5be1e7.ppc64le::container-tools:rhel8, aardvark-dns-2:1.5.0-2.module+el8.8.0+21741+dd5be1e7.s390x::container-tools:rhel8 +47

Fixes 3 records

TI-2024-01631 CVE-2024-1753 · GHSA-874v-pj72-92f3

Buildah: buildah: container escape via improper bind mount validation

HIGH 72

A flaw was found in Buildah (and subsequently Podman Build) which allows containers to mount arbitrary locations on the host filesystem into build containers.

CVSS 3.1HIGH 8.6 Local No auth User interaction EPSS 0.00457 Published 2024-03-18 Partial fix · 8090020240413110917.d7b6f4b7, 8090020240417184044.e7857ab1 +17 CWE-59

TI-2022-13882 CVE-2022-32149 · GHSA-69ch-w2m2-3vjp

Denial of service via crafted Accept-Language header in golang.org/x/text/language

MEDIUM 43

An attacker may cause a denial of service by crafting an Accept-Language header which ParseAcceptLanguage will take significant time to parse.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01841 Published 2022-10-14 Partial fix · 0.3.8 CWE-772

TI-2022-03769 CVE-2022-4122 · GHSA-4crw-w8pw-2hmf

Link following in podman

LOW 32

A vulnerability was found in buildah.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00865 Published 2022-12-08 Partial fix · 4.5.0 CWE-59