Important: container-tools:rhel8 security and bug fix update
Summary
ALSA-2019:4269: Important: container-tools:rhel8 security and bug fix update. Affects oci-systemd-hook across 3 version ranges.
< 1:0.1.15-2.git2d0b8a3.module_el8.5.0+119+9a9ec082
< 1:0.1.15-2.git2d0b8a3.module_el8.4.0+2496+12421f43
< 1:0.1.15-2.git2d0b8a3.module_el8.3.0+2044+12421f43
Fixed in 1:0.1.15-2.git2d0b8a3.module_el8.5.0+119+9a9ec082, 1:0.1.15-2.git2d0b8a3.module_el8.4.0+2496+12421f43 or 1:0.1.15-2.git2d0b8a3.module_el8.3.0+2044+12421f43, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The container-tools module contains tools for working with containers, including podman, buildah, skopeo, and runc. These tools are commonly used in containerized environments to manage and interact with containers. The package in question, container-tools:rhel8, is specifically designed for Red Hat Enterprise Linux 8.
Vulnerability Detail
This security update addresses several vulnerabilities in the container-tools package:
-
CVE-2019-9512: This vulnerability involves a flood attack using PING frames in the HTTP/2 protocol, which can result in unbounded memory growth.
-
CVE-2019-9514: Another vulnerability in the HTTP/2 protocol, this time involving a flood attack using HEADERS frames, leading to unbounded memory growth.
-
CVE-2019-16884: This vulnerability affects the runc tool and allows an attacker to bypass AppArmor/SELinux protections by using a malicious image that specifies a volume at /proc. This can lead to unauthorized access or privilege escalation.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
sudo dnf update oci-systemd-hook-
< 1:0.1.15-2.git2d0b8a3.module_el8.3.0+2044+12421f431:0.1.15-2.git2d0b8a3.module_el8.3.0+2044+12421f43 -
< 1:0.1.15-2.git2d0b8a3.module_el8.4.0+2496+12421f431:0.1.15-2.git2d0b8a3.module_el8.4.0+2496+12421f43 -
< 1:0.1.15-2.git2d0b8a3.module_el8.5.0+119+9a9ec0821:0.1.15-2.git2d0b8a3.module_el8.5.0+119+9a9ec082
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Conclusion
In conclusion, it is important to update the container-tools package to address the identified vulnerabilities. This will help ensure the security and integrity of containerized environments. If you need further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for oci-systemd-hook →
FAQ
The vulnerabilities can lead to unbounded memory growth and potential unauthorized access or privilege escalation.
There are currently no known exploits for these vulnerabilities.
No specific workaround has been provided. It is recommended to update to the latest version of the container-tools package.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) and it will provide real-time alerts for open-source vulnerabilities.
You can find more information about these vulnerabilities, including their impact and CVSS scores, in the provided CVE links in the 'related' section below.
Related vulnerabilities
Recent vulnerabilities recorded for oci-systemd-hook.
