Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2019.0580
Important: Container Development Kit 3.7.0-1 security update
26 February 2019
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Container Development Kit 3.7.0-1
Publisher: Red Hat
Operating System: Red Hat
Impact/Access: Root Compromise -- Existing Account
Resolution: Patch/Upgrade
CVE Names: CVE-2019-5736
Reference: ESB-2019.0466
ESB-2019.0458
ESB-2019.0428
Original Bulletin:
https://access.redhat.com/errata/RHSA-2019:0401
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Important: Container Development Kit 3.7.0-1 security update
Advisory ID: RHSA-2019:0401-01
Product: Container Development Kit
Advisory URL: https://access.redhat.com/errata/RHSA-2019:0401
Issue date: 2019-02-25
CVE Names: CVE-2019-5736
=====================================================================
1. Summary:
Red Hat Container Development Kit 3.7.0-1 update is now available.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
2. Description:
Red Hat Container Development Kit is a platform for developing
containerized applications; a set of tools that enables developers to
quickly and easily set up an environment for developing and testing
containerized applications on the Red Hat Enterprise Linux platform.
This update, Container Development Kit 3.7.0-1, includes an updated Red Hat
Enterprise Linux ISO that contains fixes for the following security issues.
Security Fix(es):
* runc: Execution of malicious containers allows for container escape and
access to host filesystem (CVE-2019-5736)
For more details about the security issue(s), including the impact, a CVSS
score, and other related information, refer to the CVE page(s) listed in
the References section.
3. Solution:
The References section of this erratum contains a link to download CDK
3.7.0-1 (you must log in to download the update).
Instructions are provided in the Red Hat Container Development Kit Getting
Started Guide linked in the References section.
4. Bugs fixed (https://bugzilla.redhat.com/):
1664908 - CVE-2019-5736 runc: Execution of malicious containers allows for container escape and access to host filesystem
5. References:
https://access.redhat.com/security/cve/CVE-2019-5736
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/downloads/content/293/
https://access.redhat.com/documentation/en-us/red_hat_container_development_kit/3.7/html-single/getting_started_guide/
6. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2019 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBXHRwa9zjgjWX9erEAQjZBxAAgFaGvcLn/sxbnGbekEvL3KKcNWdQGV8f
R8Pq/p31CyGjo6yJRI7LpKR+kZCJQUexw1YljuZlCLLXmKL3OycYNvysFhWBtrMm
K7Vn/VkE5eA3GAhYKzf4YzUEM39AfWN/RMr/zgdKyuED78vDo93pBmPmw4+cFPRn
hhilHLovbl1TemngSPj3V+psxeh25j6wOGPMfXAkNk+guTVPja/Z8pxY/peNfg8o
R2fzB1w6mPttaFK1FYIMDtjedlVE7yKCoG2Z+wHKXGTulbQ2B7ZoVjnR/38fM68o
5hAnA3c0SXl/Pa8qaV0oGPQrbG+uPt8Txt4V51UAVl8dBJEPJ+o6qwvy1ky1zh+L
wphaCaXQ45UlbEhtS5ulHOJToKG/oMtTLal7/YKt3RklIouuF4Afk3MPTYZD3QRE
dIqsS+9V3AnVjfyrIaXAEJMm7Dm3WMVze9JE1vE+kdRFprlL0FvXMu1yayFvHzdk
SBFqgOgi1Bb3nhk+44ITZym+KWW0eD7RBj4z4zcqQz0QNrI1axgpCZmMTotlOWyk
bQqCE5Q4O10emh60luRrY+v1Z5OXABzqqIKop1/2dJEuH1dIw9NSgGJ3+K5sx9Vp
/nuSRXh0eYu3hbdi8QitI+hxiM1R7+rGxe2bn45eKDWYGTHT0If56pboPsBEo/pv
4w/msquBn0k=
=9kwz
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBXHSZO2aOgq3Tt24GAQhWhg/8CENxpTARjV8SkoqL0P+oEbNSNIQHSwDy
U1yAaEhq8Wf5CoZwpIbH7gHKN4XKAMbB9ElInBMV4eN3ZOypYL2rcCc7z0Ym3vFO
X0xdUFkJTpNYQ89s7JAt5MnVhabr/0bZTkR1mo+NVuiSvb0BOP0JaIQjb3mzaLlq
RxMtseM95VJxrpip7Z6zJy8Q+dcfI95iNiRl0x/8A0JeD/f6Zc9Cks1m0o/I96Fe
xk89tVFziJCT9DS0bbzc8Jv8G1cjKqG0YyDJ9/8PsmuuSPIU2vx3SE53xmh/TshY
TpxGcdwv9QTW05MIFtaqQY9Lh1ZqaJAS4O9CFFebVhBgFLCY8bxoqmetwGSNWDQY
wkMHK7+BeY1UISrWbeNzxEVh1L6p/1zP5VGPqjjuz6lnorKkFktEQw3OnDZilh+x
9MAXgLgdn6KYh2huKyqCgo5Vm2dAs8UYdDjvW/7b+SL3ynQ4npD3HtdsC1MSv+nn
fNVWfV0BcdeTELS3mw+6zibsMw9yvI06oSTPpN3kCJa/07pX4wZ9kBdtqOxZw3LX
ilMbjhcWHLhqdIdIS9QHL9l361MyfnsGTeZVFB13wgk9VNmhYmuJp4sjYwARBELC
RNSb0f79tsoXcll8sQN2sJQB1UxriAvnFIhUz6/Yd6jIaVykaXeNa7VWn1/SoPTO
lb28gX+KUbM=
=FAht
-----END PGP SIGNATURE-----