Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2022.5889
buildah security and bug fix update
16 November 2022
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: buildah
Publisher: Red Hat
Operating System: Red Hat
Resolution: Patch/Upgrade
CVE Names: CVE-2022-27191 CVE-2022-2990 CVE-2022-2989
CVE-2021-33198 CVE-2021-33197 CVE-2021-33195
CVE-2021-20291
Original Bulletin:
https://access.redhat.com/errata/RHSA-2022:8008
Comment: CVSS (Max): 7.5 CVE-2022-27191 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
CVSS Source: Red Hat
Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:NI:N/S:U/C:N/I:N/A:H
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Moderate: buildah security and bug fix update
Advisory ID: RHSA-2022:8008-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2022:8008
Issue date: 2022-11-15
CVE Names: CVE-2021-20291 CVE-2021-33195 CVE-2021-33197
CVE-2021-33198 CVE-2022-2989 CVE-2022-2990
CVE-2022-27191
=====================================================================
1. Summary:
An update for buildah is now available for Red Hat Enterprise Linux 9.
Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat Enterprise Linux AppStream (v. 9) - aarch64, ppc64le, s390x, x86_64
3. Description:
The buildah package provides a tool for facilitating building OCI container
images. Among other things, buildah enables you to: Create a working
container, either from scratch or using an image as a starting point;
Create an image, either from a working container or using the instructions
in a Dockerfile; Build both Docker and OCI images.
Security Fix(es):
* containers/storage: DoS via malicious image (CVE-2021-20291)
* golang: net: lookup functions may return invalid host names
(CVE-2021-33195)
* golang: net/http/httputil: ReverseProxy forwards connection headers if
first one is empty (CVE-2021-33197)
* golang: math/big.Rat: may cause a panic or an unrecoverable fatal error
if passed inputs with very large exponents (CVE-2021-33198)
* golang: crash in a golang.org/x/crypto/ssh server (CVE-2022-27191)
* podman: possible information disclosure and modification (CVE-2022-2989)
* buildah: possible information disclosure and modification (CVE-2022-2990)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat
Enterprise Linux 9.1 Release Notes linked from the References section.
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
5. Bugs fixed (https://bugzilla.redhat.com/):
1939485 - CVE-2021-20291 containers/storage: DoS via malicious image
1989564 - CVE-2021-33195 golang: net: lookup functions may return invalid host names
1989570 - CVE-2021-33197 golang: net/http/httputil: ReverseProxy forwards connection headers if first one is empty
1989575 - CVE-2021-33198 golang: math/big.Rat: may cause a panic or an unrecoverable fatal error if passed inputs with very large exponents
2064702 - CVE-2022-27191 golang: crash in a golang.org/x/crypto/ssh server
2081835 - networking is broken when building containers due to missing container networking package dependencies
2121445 - CVE-2022-2989 podman: possible information disclosure and modification
2121453 - CVE-2022-2990 buildah: possible information disclosure and modification
6. Package List:
Red Hat Enterprise Linux AppStream (v. 9):
Source:
buildah-1.27.0-2.el9.src.rpm
aarch64:
buildah-1.27.0-2.el9.aarch64.rpm
buildah-debuginfo-1.27.0-2.el9.aarch64.rpm
buildah-debugsource-1.27.0-2.el9.aarch64.rpm
buildah-tests-1.27.0-2.el9.aarch64.rpm
buildah-tests-debuginfo-1.27.0-2.el9.aarch64.rpm
ppc64le:
buildah-1.27.0-2.el9.ppc64le.rpm
buildah-debuginfo-1.27.0-2.el9.ppc64le.rpm
buildah-debugsource-1.27.0-2.el9.ppc64le.rpm
buildah-tests-1.27.0-2.el9.ppc64le.rpm
buildah-tests-debuginfo-1.27.0-2.el9.ppc64le.rpm
s390x:
buildah-1.27.0-2.el9.s390x.rpm
buildah-debuginfo-1.27.0-2.el9.s390x.rpm
buildah-debugsource-1.27.0-2.el9.s390x.rpm
buildah-tests-1.27.0-2.el9.s390x.rpm
buildah-tests-debuginfo-1.27.0-2.el9.s390x.rpm
x86_64:
buildah-1.27.0-2.el9.x86_64.rpm
buildah-debuginfo-1.27.0-2.el9.x86_64.rpm
buildah-debugsource-1.27.0-2.el9.x86_64.rpm
buildah-tests-1.27.0-2.el9.x86_64.rpm
buildah-tests-debuginfo-1.27.0-2.el9.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2021-20291
https://access.redhat.com/security/cve/CVE-2021-33195
https://access.redhat.com/security/cve/CVE-2021-33197
https://access.redhat.com/security/cve/CVE-2021-33198
https://access.redhat.com/security/cve/CVE-2022-2989
https://access.redhat.com/security/cve/CVE-2022-2990
https://access.redhat.com/security/cve/CVE-2022-27191
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.1_release_notes/index
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2022 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBY3PhO9zjgjWX9erEAQjSFg//TmQoiB4pxBXzwpB8PKdSXPda8mbc4fEY
tTxG4fDB5j/Xix/MkMajS+kWL6RmwLdnrR34cKzyQ7MPYAxbW0efssoChZ5fuFMO
CC8W8FBieAWSf+zJaaGDIUvEhUKL189Qeic175ilgkExNus3OycvtJnJdZa/uyjZ
0NPHe3oqRpt/jmRdrlBogQtzgDcj3440M0ER5wQcQyXa7DHF0aQKGFoC93D+QrAa
x3m7mK0vcAhIvOLYLhEXiGUKqqW9b+lYYgszMVi/gxdnIDXT+3in08sO1xzZrOAv
1sc4FJ+lBAYz23yFF8KeLRZOUOk/Js4mylN033nggmVPyU+uISXKkY9jtqJ2LBM2
bGQW+a0x4B/ef0Al4TYoDvieSCWGzlHBdFlylMXD0bPTx9j04z8/dqGSvn+rGRtH
whgq9782nXiRYt8itbTa/FL9IezrQz7/ryg1lVVQLxh2nhCaAa2NAEpky77Fupj9
mhRqYp0evBgoMTkMOkyskSp9YXjOZNLk/DB2n3oAnYgwOfOinz8fGy4KsL6D/pkt
5jLo8rvjbeTplnCwJrwUwpRb7MF3lua1oXCYCJf/3h7m/SCuVO0LRywNLdSF2BX7
r+LYttzHSYP/4E39Lpefq1trvt0qqnyJx8183KnTQA8M9yW4V3abEmrjXJUxQLfT
zXvxQ+zuUq0=
=rzwm
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: https://auscert.org.au/gpg-key/
iQIVAwUBY3Q0zckNZI30y1K9AQjXYw//fRhCdP4WQ+GKIj5vR05cdQU7carIwCEb
LB9jgv+pCF36gR6ZzC8Gz5PPTGY29odl28FAhZp/OVD7Q5U/2FEX714zTFXjrEis
1PMubKhRtsKeOUyzi57ipDhz6WwyK6daS0tOSDG7L1mBZZOiz11E9dCBPk+ZYXLE
/PgC7Ixxdw3XLUyyr+bBB4SwY2O9NKztYUjuvgSowd7haHMxr67PMYIsQ6fOjKH3
KjPNTTL8kdGDgmWHZ3cTe4s2kAQfhkwmSdXW6qHEjj9v6NZTDpxKI/tjUKiDP0X0
Xx+L5n2fV1QwD5KShviuXfYs9YqFqkVzoEG0Y5XpYiQ1pkf9ELWIwnymhi5YthsE
fBbAs06sNDxP8r+N4bBM7PQVXzJepolCVtVIua1/BpYWy3oB1oqMueInxeIuydmK
Izl3+YSJbxE6Xumb+ZfyjovUcXQnzgHC9bvsAEJULyCCyCxekDzlHnww5f2DqHnn
PXB2IOHGO83mIfCe4R7RFZe6QkVW4rkVgdFl9PgTQJKM4JOQZLaPMpW/JC0k4cR9
EFrV+gcHNDgaBr7YYI5ssmVdKRjQBDrBlDpdDmD6Ztvx4SSFiVgtfUwT4mbRnbZT
9QS7LAbaEBnrmw5VEy8jQFZYnXQokIo+DKRDFGx96V33lrqp1S1SkyVUx7NBYjBS
0osOODMU5M4=
=5Pmp
-----END PGP SIGNATURE-----