Important: container-tools:rhel8 security, bug fix, and enhancement update
Summary
RLSA-2019:3403: Important: container-tools:rhel8 security, bug fix, and enhancement update. Affects oci-systemd-hook versions < 1:0.1.15-2.git2d0b8a3.module+el8.4.0+557+48ba8b2f. Fixed in 1:0.1.15-2.git2d0b8a3.module+el8.4.0+557+48ba8b2f. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.
Vulnerability Detail
This update addresses two security vulnerabilities:
-
CVE-2019-14378: A heap buffer overflow vulnerability in the slirp component of QEMU could allow an attacker to execute arbitrary code or cause a denial of service by sending specially crafted packets.
-
CVE-2019-10214: The containers/image library did not enforce TLS when sending username and password credentials to token servers, potentially leading to credential disclosure.
How To Fix
Minimum fixed version
1:0.1.15-2.git2d0b8a3.module+el8.4.0+557+48ba8b2f
This is the first release that contains the fix.
sudo dnf update oci-systemd-hookTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
This update addresses two important security vulnerabilities in the container-tools module. It is recommended to update the affected packages to the specified versions to mitigate the risks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for oci-systemd-hook →
FAQ
The container-tools module provides various tools for working with containers, including podman, buildah, skopeo, and runc.
CVE-2019-14378 is a heap buffer overflow vulnerability in the slirp component of QEMU. It could allow an attacker to execute arbitrary code or cause a denial of service.
CVE-2019-10214 is a vulnerability in the containers/image library. It allows an attacker to potentially disclose credentials by not enforcing TLS when sending username and password credentials to token servers.
To fix these vulnerabilities, update the affected packages to the recommended versions: oci-systemd-hook: 1:0.1.15-2.git2d0b8a3.module+el8.4.0+557+48ba8b2f, oci-umount: 2:2.3.4-2.git87f9237.module+el8.4.0+557+48ba8b2f.
No workaround has been provided for these vulnerabilities. It is recommended to update the affected packages.
References
Related vulnerabilities
Recent vulnerabilities recorded for oci-systemd-hook.
