-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2019.3251
        SUSE-SU-2019:2223-1 Security update for podman, slirp4netns
                         and libcontainers-common
                              28 August 2019

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           podman
                   slirp4netns
                   libcontainers-common
Publisher:         SUSE
Operating System:  SUSE
Impact/Access:     Denial of Service        -- Existing Account
                   Access Confidential Data -- Existing Account
Resolution:        Patch/Upgrade
CVE Names:         CVE-2019-10152 CVE-2019-6778 CVE-2018-15664

Reference:         ESB-2019.2830
                   ESB-2019.0496

Original Bulletin: 
   https://www.suse.com/support/update/announcement/2019/suse-su-20192223-1.html

- --------------------------BEGIN INCLUDED TEXT--------------------

SUSE Security Update: Security update for podman, slirp4netns
and libcontainers-common

______________________________________________________________________________

Announcement ID:   SUSE-SU-2019:2223-1
Rating:            moderate
References:        #1096726 #1123156 #1123387 #1135460 #1136974 #1137860
                   #1143386
Cross-References:  CVE-2018-15664 CVE-2019-10152 CVE-2019-6778
Affected Products:
                   SUSE Linux Enterprise Module for Containers 15-SP1
                   SUSE Linux Enterprise Module for Basesystem 15-SP1
______________________________________________________________________________


An update that solves three vulnerabilities and has four fixes is now
available.

Description:

This is a version update for podman to version 1.4.4 (bsc#1143386).
Additional changes by SUSE on top:

  o Remove fuse-overlayfs because it's (currently) an unsatisfied dependency on
    SLE (bsc#1143386)
  o Update libpod.conf to use correct infra_command
  o Update libpod.conf to use better versioned pause container
  o Update libpod.conf to use official kubic pause container
  o Update libpod.conf to match latest features set: detach_keys, lock_type,
    runtime_supports_json
  o Add podman-remote varlink client


Version update podman to v1.4.4:

  o Features


- - Podman now has greatly improved support for containers using multiple OCI
runtimes. Containers now remember if they were created with a different runtime
using --runtime and will always use that runtime - The cached and delegated
options for volume mounts are now allowed for Docker compatability (#3340) -
The podman diff command now supports the --latest flag

  o Bugfixes


- - Fixed a bug where rootless Podman would attempt to use the entire root
configuration if no rootless configuration was present for the user, breaking
rootless Podman for new installations - Fixed a bug where rootless Podman's
pause process would block SIGTERM, preventing graceful system shutdown and
hanging until the system's init send SIGKILL - Fixed a bug where running Podman
as root with sudo -E would not work after running rootless Podman at least once
- - Fixed a bug where options for tmpfs volumes added with the --tmpfs flag were
being ignored - Fixed a bug where images with no layers could not properly be
displayed and removed by Podman - Fixed a bug where locks were not properly
freed on failure to create a container or pod - Fixed a bug where podman cp on
a single file would create a directory at the target and place the file in it
(#3384) - Fixed a bug where podman inspect --format '{{.Mounts}}' would print a
hexadecimal address instead of a container's mounts - Fixed a bug where
rootless Podman would not add an entry to container's /etc/hosts files for
their own hostname (#3405) - Fixed a bug where podman ps --sync would segfault
(#3411) - Fixed a bug where podman generate kube would produce an invalid ports
configuration (#3408)

  o Misc


- - Updated containers/storage to v1.12.13 - Podman now performs much better on
systems with heavy I/O load - The --cgroup-manager flag to podman now shows the
correct default setting in help if the default was overridden by libpod.conf -
For backwards compatability, setting --log-driver=json-file in podman run is
now supported as an alias for --log-driver=k8s-file. This is considered
deprecated, and json-file will be moved to a new implementation in the future
([#3363](https://github.com/containers/libpo\ d/issues/3363)) - Podman's
default libpod.conf file now allows the crun OCI runtime to be used if it is
installed
Update podman to v1.4.2:

  o Fixed a bug where Podman could not run containers using an older version of
    Systemd as init
  o Updated vendored Buildah to v1.9.0 to resolve a critical bug with
    Dockerfile RUN instructions
  o The error message for running podman kill on containers that are not
    running has been improved
  o Podman remote client can now log to a file if syslog is not available
  o The podman exec command now sets its error code differently based on
    whether the container does not exist, and the command in the container does
    not exist
  o The podman inspect command on containers now outputs Mounts JSON that
    matches that of docker inspect, only including user-specified volumes and
    differentiating bind mounts and named volumes
  o The podman inspect command now reports the path to a container's OCI spec
    with the OCIConfigPath key (only included when the container is initialized
    or running)
  o The podman run --mount command now supports the bind-nonrecursive option
    for bind mounts
  o Fixed a bug where podman play kube would fail to create containers due to
    an unspecified log driver
  o Fixed a bug where Podman would fail to build with musl libc
  o Fixed a bug where rootless Podman using slirp4netns networking in an
    environment with no nameservers on the host other than localhost would
    result in nonfunctional networking
  o Fixed a bug where podman import would not properly set environment
    variables, discarding their values and retaining only keys
  o Fixed a bug where Podman would fail to run when built with Apparmor support
    but run on systems without the Apparmor kernel module loaded
  o Remote Podman will now default the username it uses to log in to remote
    systems to the username of the current user
  o Podman now uses JSON logging with OCI runtimes that support it, allowing
    for better error reporting
  o Updated vendored containers/image to v2.0
  o Update conmon to v0.3.0
  o Support OOM Monitor under cgroup V2
  o Add config binary and make target for configuring conmon with a go library
    for importing values


Updated podman to version 1.4.0 (bsc#1137860) and (bsc#1135460)

  o Podman checkpoint and podman restore commands can now be used to migrate
    containers between Podman installations on different systems.
  o The podman cp now supports pause flag.
  o The remote client now supports a configuration file for pre-configuring
    connections to remote Podman installations
  o CVE-2019-10152: Fixed an iproper dereference of symlinks of the the podman
    cp command which introduced in version 1.1.0 (bsc#1136974).
  o Fixed a bug where podman commit could improperly set environment variables
    that contained = characters
  o Fixed a bug where rootless podman would sometimes fail to start containers
    with forwarded ports
  o Fixed a bug where podman version on the remote client could segfault
  o Fixed a bug where podman container runlabel would use /proc/self/exe
    instead of the path of the Podman command when printing the command being
    executed
  o Fixed a bug where filtering images by label did not work
  o Fixed a bug where specifying a bing mount or tmpfs mount over an image
    volume would cause a container to be unable to start
  o Fixed a bug where podman generate kube did not work with containers with
    named volumes
  o Fixed a bug where rootless podman would receive permission denied errors
    accessing conmon.pid
  o Fixed a bug where podman cp with a folder specified as target would replace
    the folder, as opposed to copying into it
  o Fixed a bug where rootless Podman commands could double-unlock a lock,
    causing a crash
  o Fixed a bug where podman incorrectly set tmpcopyup on /dev/ mounts, causing
    errors when using the Kata containers runtime
  o Fixed a bug where podman exec would fail on older kernels
  o Podman commit command is now usable with the Podman remote client
  o Signature-policy flag has been deprecated
  o Updated vendored containers/storage and containers/image libraries with
    numerous bugfixes
  o Updated vendored Buildah to v1.8.3
  o Podman now requires Conmon v0.2.0
  o The podman cp command is now aliased as podman container cp
  o Rootless podman will now default init_path using root Podman's
    configuration files (/etc/containers/libpod.conf and /usr/share/containers/
    libpod.conf) if not overridden in the rootless configuration
  o Added fuse-overlayfs dependency to support overlay based rootless image
    manipulations
  o The podman cp command can now read input redirected to STDIN, and output to
    STDOUT instead of a file, using - instead of an argument.
  o The podman remote client now displays version information from both the
    client and server in podman version
  o The podman unshare command has been added, allowing easy entry into the
    user namespace set up by rootless Podman (allowing the removal of files
    created by rootless podman, among other things)
  o Fixed a bug where Podman containers with the --rm flag were removing
    created volumes when they were automatically removed
  o Fixed a bug where container and pod locks were incorrectly marked as
    released after a system reboot, causing errors on container and pod removal
  o Fixed a bug where Podman pods could not be removed if any container in the
    pod encountered an error during removal
  o Fixed a bug where Podman pods run with the cgroupfs CGroup driver would
    encounter a race condition during removal, potentially failing to remove
    the pod CGroup
  o Fixed a bug where the podman container checkpoint and podman container
    restore commands were not visible in the remote client
  o Fixed a bug where podman remote ps --ns would not print the container's
    namespaces
  o Fixed a bug where removing stopped containers with healthchecks could cause
    an error
  o Fixed a bug where the default libpod.conf file was causing parsing errors
  o Fixed a bug where pod locks were not being freed when pods were removed,
    potentially leading to lock exhaustion
  o Fixed a bug where 'podman run' with SD_NOTIFY set could, on short-running
    containers, create an inconsistent state rendering the container unusable
  o The remote Podman client now uses the Varlink bridge to establish remote
    connections by default
  o Fixed an issue with apparmor_parser (bsc#1123387)


  o Update to libpod v1.4.0 (bsc#1137860):
  o The podman checkpoint and podman restore commands can now be used to
    migrate containers between Podman installations on different systems
  o The podman cp command now supports a pause flag to pause containers while
    copying into them
  o The remote client now supports a configuration file for pre-configuring
    connections to remote Podman installations
  o Fixed CVE-2019-10152 - The podman cp command improperly dereferenced
    symlinks in host context
  o Fixed a bug where podman commit could improperly set environment variables
    that contained = characters
  o Fixed a bug where rootless Podman would sometimes fail to start containers
    with forwarded ports
  o Fixed a bug where podman version on the remote client could segfault
  o Fixed a bug where podman container runlabel would use /proc/self/exe
    instead of the path of the Podman command when printing the command being
    executed
  o Fixed a bug where filtering images by label did not work
  o Fixed a bug where specifying a bing mount or tmpfs mount over an image
    volume would cause a container to be unable to start
  o Fixed a bug where podman generate kube did not work with containers with
    named volumes
  o Fixed a bug where rootless Podman would receive permission denied errors
    accessing conmon.pid
  o Fixed a bug where podman cp with a folder specified as target would replace
    the folder, as opposed to copying into it
  o Fixed a bug where rootless Podman commands could double-unlock a lock,
    causing a crash
  o Fixed a bug where Podman incorrectly set tmpcopyup on /dev/ mounts, causing
    errors when using the Kata containers runtime
  o Fixed a bug where podman exec would fail on older kernels
  o The podman commit command is now usable with the Podman remote client
  o The --signature-policy flag (used with several image-related commands) has
    been deprecated
  o The podman unshare command now defines two environment variables in the
    spawned shell: CONTAINERS_RUNROOT and CONTAINERS_GRAPHROOT, pointing to
    temporary and permanent storage for rootless containers
  o Updated vendored containers/storage and containers/image libraries with
    numerous bugfixes
  o Updated vendored Buildah to v1.8.3
  o Podman now requires Conmon v0.2.0
  o The podman cp command is now aliased as podman container cp
  o Rootless Podman will now default init_path using root Podman's
    configuration files (/etc/containers/libpod.conf and /usr/share/containers/
    libpod.conf) if not overridden in the rootless configuration


  o Update to image v1.5.1
  o Vendor in latest containers/storage
  o docker/docker_client: Drop redundant Domain(ref.ref) call
  o pkg/blobinfocache: Split implementations into subpackages
  o copy: progress bar: show messages on completion
  o docs: rename manpages to *.5.command
  o add container-certs.d.md manpage
  o pkg/docker/config: Bring auth tests from docker/docker_client_test
  o Don't allocate a sync.Mutex separately


Update to storage v1.12.10:

  o Add function to parse out mount options from graphdriver
  o Merge the disparate parts of all of the Unix-like lockfiles
  o Fix unix-but-not-Linux compilation
  o Return XDG_RUNTIME_DIR as RootlessRuntimeDir if set
  o Cherry-pick moby/moby #39292 for CVE-2018-15664 fixes
  o lockfile: add RecursiveLock() API
  o Update generated files
  o Fix crash on tesing of aufs code
  o Let consumers know when Layers and Images came from read-only stores
  o chown: do not change owner for the mountpoint
  o locks: correctly mark updates to the layers list
  o CreateContainer: don't worry about mapping layers unless necessary
  o docs: fix manpage for containers-storage.conf
  o docs: sort configuration options alphabetically
  o docs: document OSTree file deduplication
  o Add missing options to man page for containers-storage
  o overlay: use the layer idmapping if present
  o vfs: prefer layer custom idmappings
  o layers: propagate down the idmapping settings
  o Recreate symlink when not found
  o docs: fix manpage for configuration file
  o docs: add special handling for manpages in sect 5
  o overlay: fix single-lower test
  o Recreate symlink when not found
  o overlay: propagate errors from mountProgram
  o utils: root in a userns uses global conf file
  o Fix handling of additional stores
  o Correctly check permissions on rootless directory
  o Fix possible integer overflow on 32bit builds
  o Evaluate device path for lvm
  o lockfile test: make concurrent RW test determinisitc
  o lockfile test: make concurrent read tests deterministic
  o drivers.DirCopy: fix filemode detection
  o storage: move the logic to detect rootless into utils.go
  o Don't set (struct flock).l_pid
  o Improve documentation of getLockfile
  o Rename getLockFile to createLockerForPath, and document it
  o Add FILES section to containers-storage.5 man page
  o add digest locks
  o drivers/copy: add a non-cgo fallback


slirp4netns was updated to 0.3.0:

  o CVE-2019-6778: Fixed a heap buffer overflow in tcp_emu() (bsc#1123156)


This update also includes:

  o fuse3 and fuse-overlayfs to support rootless containers.

Patch Instructions:

To install this SUSE Security Update use the SUSE recommended installation
methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

  o SUSE Linux Enterprise Module for Containers 15-SP1:
    zypper in -t patch SUSE-SLE-Module-Containers-15-SP1-2019-2223=1
  o SUSE Linux Enterprise Module for Basesystem 15-SP1:
    zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP1-2019-2223=1

Package List:

  o SUSE Linux Enterprise Module for Containers 15-SP1 (aarch64 ppc64le s390x
    x86_64):
       fuse-overlayfs-0.4.1-3.3.8
       fuse-overlayfs-debuginfo-0.4.1-3.3.8
       fuse-overlayfs-debugsource-0.4.1-3.3.8
       fuse3-3.6.1-3.3.8
       fuse3-debuginfo-3.6.1-3.3.8
       fuse3-debugsource-3.6.1-3.3.8
       libfuse3-3-3.6.1-3.3.8
       libfuse3-3-debuginfo-3.6.1-3.3.8
       podman-1.4.4-4.8.1
       slirp4netns-0.3.0-3.3.3
       slirp4netns-debuginfo-0.3.0-3.3.3
       slirp4netns-debugsource-0.3.0-3.3.3
  o SUSE Linux Enterprise Module for Containers 15-SP1 (noarch):
       podman-cni-config-1.4.4-4.8.1
  o SUSE Linux Enterprise Module for Basesystem 15-SP1 (noarch):
       libcontainers-common-20190401-3.3.5


References:

  o https://www.suse.com/security/cve/CVE-2018-15664.html
  o https://www.suse.com/security/cve/CVE-2019-10152.html
  o https://www.suse.com/security/cve/CVE-2019-6778.html
  o https://bugzilla.suse.com/1096726
  o https://bugzilla.suse.com/1123156
  o https://bugzilla.suse.com/1123387
  o https://bugzilla.suse.com/1135460
  o https://bugzilla.suse.com/1136974
  o https://bugzilla.suse.com/1137860
  o https://bugzilla.suse.com/1143386

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBXWYGKmaOgq3Tt24GAQhKJw/+IqTNToashhNDG+e29lFzQNxP08ocZPub
Bs36jgL+c3/4aUvICAsUYcY53lEIhkiYCNw6cfVOAdzZe6jWec4cMAwgxIVsRhew
PFGKqAc/iE/hKk//w7Qu/zXhfjmFSolhggo1dubYX4ul2IrmBS1bifNleViZQ+NW
7+cbHougqrQrBOzzQoWujmbXTcUMfNwAnkNvwHg3VgeXn2tl10492k/00beZIKBW
6sMTzsFdBLIgTGggVOXur5dbCWY4+WVtdRferOlNIqAOtYVGPfqTksjS2ydlwPs6
Jru8vWWVr/Tr9A0F52K3nL2DcSPqIo2aJybAXdlAMi/gg91q0Hn+ZbCXiHo9YYzw
26/4JS/axzXPAktvcQtMw2YS5rIbprkbR6KN1ZbyZKgVbVG9xXnGiodY4tdH2mtp
hZNevmUIqleZUIMhcEv3T+dFU0x8DJuChdV7CFSmy6U78xVUz45aNDznqHr8QNQd
Myb1SFjYB5W2jWG7nggGzA/sA6m89Uju/haQTukBGs4tVzqZvmz24fUjQbiKki6D
VdaBEbP8G6cGvF62qR5jcS7LYE2wTYAEGHiwkDYt/6+XMNGk3rMotzVLwWqz7+4R
Ypw3Dh9Omj8n07e3hrJ5cFm0D/UQmeizMHuK/4RpREdAvjCaWJTqMyFfTMyaoqJz
YE5BsrQvwMc=
=3+gd
-----END PGP SIGNATURE-----