Important: container-tools:1.0 security update
Summary
ALSA-2019:4273: Important: container-tools:1.0 security update. Affects containernetworking-plugins across 3 version ranges.
< 0.7.4-4.git9ebe139.module_el8.3.0+2044+12421f43
< 0.7.4-4.git9ebe139.module_el8.4.0+2496+12421f43
< 0.7.4-4.git9ebe139.module_el8.5.0+119+9a9ec082
Fixed in 0.7.4-4.git9ebe139.module_el8.3.0+2044+12421f43, 0.7.4-4.git9ebe139.module_el8.4.0+2496+12421f43 or 0.7.4-4.git9ebe139.module_el8.5.0+119+9a9ec082, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.
Vulnerability Detail
The container-tools package is vulnerable to two security issues in the HTTP/2 protocol. The first vulnerability, identified as CVE-2019-9512, allows an attacker to flood the system with PING frames, resulting in unbounded memory growth. The second vulnerability, identified as CVE-2019-9514, enables an attacker to flood the system with HEADERS frames, also leading to unbounded memory growth. These vulnerabilities can be exploited to exhaust system resources and potentially cause denial-of-service (DoS) conditions.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
sudo dnf update containernetworking-plugins-
< 0.7.4-4.git9ebe139.module_el8.3.0+2044+12421f430.7.4-4.git9ebe139.module_el8.3.0+2044+12421f43 -
< 0.7.4-4.git9ebe139.module_el8.4.0+2496+12421f430.7.4-4.git9ebe139.module_el8.4.0+2496+12421f43 -
< 0.7.4-4.git9ebe139.module_el8.5.0+119+9a9ec0820.7.4-4.git9ebe139.module_el8.5.0+119+9a9ec082
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Conclusion
The container-tools package is vulnerable to two HTTP/2 protocol vulnerabilities that can lead to unbounded memory growth and potential denial-of-service (DoS) conditions. It is crucial to update the package to version 1.0 or later to mitigate these vulnerabilities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for containernetworking-plugins →
FAQ
These vulnerabilities can be exploited to exhaust system resources and potentially cause denial-of-service (DoS) conditions.
Versions prior to 1.0 are affected by these vulnerabilities.
Updating to the latest version of the container-tools package is the recommended mitigation for these vulnerabilities.
There is no evidence of active exploitation of these vulnerabilities at the moment.
More information about these vulnerabilities can be found in the CVE pages: CVE-2019-9512 and CVE-2019-9514.
Related vulnerabilities
Recent vulnerabilities recorded for containernetworking-plugins.
