Moderate: container-tools:rhel8 security, bug fix, and enhancement update
Summary
RLSA-2020:3053: Moderate: container-tools:rhel8 security, bug fix, and enhancement update. Affects python-podman-api across 3 version ranges.
< 0:1.2.0-0.2.gitd0a45fe.module+el8.5.0+770+e2f49861
< 0:1.2.0-0.2.gitd0a45fe.module+el8.4.0+559+c02fa3b2
< 0:1.2.0-0.2.gitd0a45fe.module+el8.5.0+708+6758137d
Fixed in 0:1.2.0-0.2.gitd0a45fe.module+el8.5.0+770+e2f49861, 0:1.2.0-0.2.gitd0a45fe.module+el8.4.0+559+c02fa3b2 or 0:1.2.0-0.2.gitd0a45fe.module+el8.5.0+708+6758137d, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The container-tools module contains tools for working with containers, including podman, buildah, skopeo, and runc. These tools are used for managing and building containers in the Rocky Linux 8 ecosystem.
Vulnerability Detail
The vulnerability identified in this update is CVE-2020-1983, which affects the slirp component of QEMU. It is a use-after-free vulnerability in the ip_reass() function in ip_input.c. This vulnerability could be exploited by an attacker to execute arbitrary code or cause a denial of service. The CVSS score for this vulnerability is 7.0, indicating a moderate severity.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
sudo dnf update python-podman-api-
< 0:1.2.0-0.2.gitd0a45fe.module+el8.4.0+559+c02fa3b20:1.2.0-0.2.gitd0a45fe.module+el8.4.0+559+c02fa3b2 -
< 0:1.2.0-0.2.gitd0a45fe.module+el8.5.0+708+6758137d0:1.2.0-0.2.gitd0a45fe.module+el8.5.0+708+6758137d -
< 0:1.2.0-0.2.gitd0a45fe.module+el8.5.0+770+e2f498610:1.2.0-0.2.gitd0a45fe.module+el8.5.0+770+e2f49861
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Conclusion
In conclusion, this update addresses a moderate severity vulnerability (CVE-2020-1983) in the container-tools module of Rocky Linux 8. It is recommended to update the affected packages to the fixed versions mentioned in the 'how_to_fix' section. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for python-podman-api →
FAQ
This vulnerability could allow an attacker to execute arbitrary code or cause a denial of service.
The CVSS score for this vulnerability is 7.0, indicating a moderate severity.
The affected packages include python-podman-api, runc, toolbox, and udica.
To fix this vulnerability, update the affected packages to the fixed versions mentioned in the 'how_to_fix' section.
No workaround has been mentioned for this vulnerability. It is recommended to update the affected packages.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-podman-api.
