Moderate: container-tools:3.0 security update
Summary
ALSA-2022:7529: Moderate: container-tools:3.0 security update. Affects buildah versions < 1.19.9-6.module_el8.7.0+3297+1eb250cf. Fixed in 1.19.9-6.module_el8.7.0+3297+1eb250cf. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.
Vulnerability Detail
The container-tools package is affected by multiple vulnerabilities:
- CVE-2022-1705: Improper sanitization of Transfer-Encoding header in golang net/http
- CVE-2022-1708: Memory exhaustion on the node when accessing the kube API in cri-o
- CVE-2022-1962: Stack exhaustion in all Parse* functions in golang go/parser
- CVE-2022-21698: Denial of service using InstrumentHandlerCounter in prometheus/client_golang
- CVE-2022-28131: Stack exhaustion in Decoder.Skip in golang encoding/xml
- CVE-2022-30630: Stack exhaustion in Glob in golang io/fs
- CVE-2022-30631: Stack exhaustion in Reader.Read in golang compress/gzip
- CVE-2022-30632: Stack exhaustion in Glob in golang path/filepath
- CVE-2022-30633: Stack exhaustion in Unmarshal in golang encoding/xml
- CVE-2022-32148: NewSingleHostReverseProxy - omit X-Forwarded-For not working in golang net/http/httputil
These vulnerabilities have varying impacts and can lead to issues such as improper sanitization, memory exhaustion, denial of service, and stack exhaustion.
How To Fix
Minimum fixed version
1.19.9-6.module_el8.7.0+3297+1eb250cf
This is the first release that contains the fix.
sudo dnf update buildahTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The container-tools package is affected by multiple vulnerabilities that can have varying impacts. It is recommended to update the package to the latest version to mitigate these vulnerabilities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for buildah →
FAQ
The container-tools package provides tools for working with containers, including podman, buildah, skopeo, and runc.
These vulnerabilities can lead to issues such as improper sanitization, memory exhaustion, denial of service, and stack exhaustion.
To fix these vulnerabilities, update the container-tools package to version 3.0.1-13.module_el8.7.0+3297+1eb250cf or later.
No, there are no mentioned workarounds for these vulnerabilities.
You can find more information about these vulnerabilities in the CVE pages listed in the References section.
Related vulnerabilities
Recent vulnerabilities recorded for buildah.
