Operating System:

[RedHat]

Published:

16 November 2022

Protect yourself against future threats.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2022.5880
                    skopeo security and bug fix update
                             16 November 2022

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           skopeo
Publisher:         Red Hat
Operating System:  Red Hat
Resolution:        Patch/Upgrade
CVE Names:         CVE-2021-33198 CVE-2021-20291 

Original Bulletin: 
   https://access.redhat.com/errata/RHSA-2022:7955

Comment: CVSS (Max):  7.5 CVE-2021-33198 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
         CVSS Source: Red Hat
         Calculator:  https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Moderate: skopeo security and bug fix update
Advisory ID:       RHSA-2022:7955-01
Product:           Red Hat Enterprise Linux
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:7955
Issue date:        2022-11-15
CVE Names:         CVE-2021-20291 CVE-2021-33198 
=====================================================================

1. Summary:

An update for skopeo is now available for Red Hat Enterprise Linux 9.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AppStream (v. 9) - aarch64, ppc64le, s390x, x86_64

3. Description:

The skopeo command lets you inspect images from container image registries,
get images and image layers, and use signatures to create and verify files.

Security Fix(es):

* containers/storage: DoS via malicious image (CVE-2021-20291)

* golang: math/big.Rat: may cause a panic or an unrecoverable fatal error
if passed inputs with very large exponents (CVE-2021-33198)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat
Enterprise Linux 9.1 Release Notes linked from the References section.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1939485 - CVE-2021-20291 containers/storage: DoS via malicious image
1988128 - Enable LTO build of skopeo for RHEL 9
1989575 - CVE-2021-33198 golang: math/big.Rat: may cause a panic or an unrecoverable fatal error if passed inputs with very large exponents

6. Package List:

Red Hat Enterprise Linux AppStream (v. 9):

Source:
skopeo-1.9.2-1.el9.src.rpm

aarch64:
skopeo-1.9.2-1.el9.aarch64.rpm
skopeo-debuginfo-1.9.2-1.el9.aarch64.rpm
skopeo-debugsource-1.9.2-1.el9.aarch64.rpm
skopeo-tests-1.9.2-1.el9.aarch64.rpm

ppc64le:
skopeo-1.9.2-1.el9.ppc64le.rpm
skopeo-debuginfo-1.9.2-1.el9.ppc64le.rpm
skopeo-debugsource-1.9.2-1.el9.ppc64le.rpm
skopeo-tests-1.9.2-1.el9.ppc64le.rpm

s390x:
skopeo-1.9.2-1.el9.s390x.rpm
skopeo-debuginfo-1.9.2-1.el9.s390x.rpm
skopeo-debugsource-1.9.2-1.el9.s390x.rpm
skopeo-tests-1.9.2-1.el9.s390x.rpm

x86_64:
skopeo-1.9.2-1.el9.x86_64.rpm
skopeo-debuginfo-1.9.2-1.el9.x86_64.rpm
skopeo-debugsource-1.9.2-1.el9.x86_64.rpm
skopeo-tests-1.9.2-1.el9.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2021-20291
https://access.redhat.com/security/cve/CVE-2021-33198
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.1_release_notes/index

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBY3PhR9zjgjWX9erEAQgx8w/8DtFfPWF06IeoNdA9Ks2qP1ZWdPmYSR+L
sYV7fXD2X25jesaINsMRlXFrPXG2kaKZRO+ZCa1+va2PLEgdRe19bSRPw6Q+xun2
jq7/yo/S94ONLTXctUDRwt7uKi8BTYfj26VOQvrmzKvDKp51KwFWOGYe+7QkBlaC
TUJpd9VNhW6SuR9cokvg+IMJ83Hm332/V8NsDx1AMx/Q0se4GMP9BKiR3CG83dv9
gLG0t6i/R/gWCtA2mjvjXzEtmVkLu9F19vW0LtasRBO1R1fU2prud51DlRgoRgsJ
to8uiurZx3unFqQPfZf8UFSGwLkKFzbMT/zVKfjM4HdfhRcTZy1EWaTHiJUvoe4/
wD2X8v88qbeJ08a20KtZb/8X2I1hjbvNAHV2PMSxVt04ToU5miOHwd1Wgax/nqXL
jPQSfTM1iiaB2Kq7/23G6JXhFcriK1/e8XKH7N02kIxAWa9LOmFJ0Z3uPuGS3YJ2
Aa+qDDfLdq3pfIaAbpJnDPFqm0scxaIx3fGw8TcmW1ra+GrnQx+4D89wTqlht4Se
PQU3pf93EU0BDNDctrqW0acr3guybu1qn6Juh/NMGAMS1wtz2mbdzGYEmuUA3Cd3
x+ojiCMUxYQI31kDhAn88Xq3I1nWtm7I/sDj8kddrrNf4pMbB2Jgzqd3cJ4/s6DS
UoStIDC36rc=
=tD9P
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: https://auscert.org.au/gpg-key/

iQIVAwUBY3QsCckNZI30y1K9AQifVBAAnJEnS5IuZST85UNV60EACC4FBgiIKU48
XrnhP3UzV7GfXHEQjaNjqc34+PjrmhwfqA8qJdw4C9r0mkn5uLXV+MokUNdVVa2q
XAihSg9lTBHMfdwv6ZiTNTn34q37JfIpvswaqDawvz+LsMz++ITLWJbwEB1fZiCo
CojLjYC3lPflo+XHHulMfelaZl7JZjWVvIUjvkWc1HcfkOwG4uFDovUhmyZvVCgY
Bl8GNthwieaivCQzzKLxDwEP/jOgCiQNSxMRShA/3/QySstiZjnb+KsQKfFrkSsX
jleNgkBCDxxjvtt5TMvlfPUIY1V8dnOh/HCdSXcCwGmIGNI5oys6wUiG5uajkntX
E1J/u++yhmTbt4Yy9wJ5Fkhe9BPDh7QXlsH8gmy6Yidy9oHLNSHzu1liRkTt+LAy
joBy4Lyu2SWKBRB7Ujt0lWXjQ/SLgW9nAKCUaIvUHiNJ4EDSYuAl1IVQ083VzMl2
5D/59A2LffY2DxiwubBCNE//U1YZbX3eJFtrRgbse0PV0l9Rh/zsgzlGR32IX86Y
HuEzpJchlRmHwBOCEiK3KUtxFXe8d51aghnreQayZVx2xkMmCrIQ8J5hO/3uw3Yq
dOAppEB5Rzad8wT1uvKUmUPb11PIKcbHNfEItRp3dlZNwvBXpdNRPetA1BBLiETH
4m+KtCulRo8=
=UnGg
-----END PGP SIGNATURE-----