- Issued:
- 2019-12-17
- Updated:
- 2019-12-17
RHSA-2019:4269 - Important: container-tools:rhel8 security and bug fix update
Synopsis
Important: container-tools:rhel8 security and bug fix update
Type/Severity
Security Advisory Important
Topic
An update for the container-tools:rhel8 module is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Description
The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.
Security Fix(es):
-
HTTP/2: flood using PING frames results in unbounded memory growth (CVE-2019-9512)
-
HTTP/2: flood using HEADERS frames results in unbounded memory growth (CVE-2019-9514)
-
runc: AppArmor/SELinux bypass with malicious image that specifies a volume at /proc (CVE-2019-16884)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Bug Fix(es):
-
avc: podman run --security-opt label=type:svirt_qemu_net_t (BZ#1764318)
-
backport json-file logging support to 1.4.2 (BZ#1770176)
-
Selinux won't allow SCTP inter pod communication (BZ#1774382)
Solution
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
Affected Products
| Product | Version | Arch |
|---|---|---|
| Red Hat Enterprise Linux for x86_64 | 8 | x86_64 |
| Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions | 8.8 | x86_64 |
| Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions | 8.6 | x86_64 |
| Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions | 8.4 | x86_64 |
| Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions | 8.2 | x86_64 |
| Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions | 8.1 | x86_64 |
| Red Hat Enterprise Linux for x86_64 - Extended Update Support | 8.8 | x86_64 |
| Red Hat Enterprise Linux for x86_64 - Extended Update Support | 8.6 | x86_64 |
| Red Hat Enterprise Linux for x86_64 - Extended Update Support | 8.4 | x86_64 |
| Red Hat Enterprise Linux for x86_64 - Extended Update Support | 8.2 | x86_64 |
| Red Hat Enterprise Linux for x86_64 - Extended Update Support | 8.1 | x86_64 |
| Red Hat Enterprise Linux for x86_64 - Extended Update Support Extension | 8.8 | x86_64 |
| Red Hat Enterprise Linux for x86_64 - Extended Update Support Extension | 8.6 | x86_64 |
| Red Hat Enterprise Linux for x86_64 - Extended Update Support Extension | 8.4 | x86_64 |
| Red Hat Enterprise Linux for x86_64 - Extended Life Cycle | 8.10 | x86_64 |
| Red Hat Enterprise Linux for Power, little endian | 8 | ppc64le |
| Red Hat Enterprise Linux for Power, little endian - Extended Update Support | 8.8 | ppc64le |
| Red Hat Enterprise Linux for Power, little endian - Extended Update Support | 8.6 | ppc64le |
| Red Hat Enterprise Linux for Power, little endian - Extended Update Support | 8.4 | ppc64le |
| Red Hat Enterprise Linux for Power, little endian - Extended Update Support | 8.2 | ppc64le |
| Red Hat Enterprise Linux for Power, little endian - Extended Update Support | 8.1 | ppc64le |
| Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle | 8.10 | ppc64le |
| Red Hat Enterprise Linux for IBM z Systems | 8 | s390x |
| Red Hat Enterprise Linux for IBM z Systems - Extended Update Support | 8.8 | s390x |
| Red Hat Enterprise Linux for IBM z Systems - Extended Update Support | 8.6 | s390x |
| Red Hat Enterprise Linux for IBM z Systems - Extended Update Support | 8.4 | s390x |
| Red Hat Enterprise Linux for IBM z Systems - Extended Update Support | 8.2 | s390x |
| Red Hat Enterprise Linux for IBM z Systems - Extended Update Support | 8.1 | s390x |
| Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle | 8.10 | s390x |
| Red Hat Enterprise Linux for ARM 64 | 8 | aarch64 |
| Red Hat Enterprise Linux for ARM 64 - Extended Update Support | 8.8 | aarch64 |
| Red Hat Enterprise Linux for ARM 64 - Extended Update Support | 8.6 | aarch64 |
| Red Hat Enterprise Linux for ARM 64 - Extended Update Support | 8.4 | aarch64 |
| Red Hat Enterprise Linux for ARM 64 - Extended Update Support | 8.2 | aarch64 |
| Red Hat Enterprise Linux for ARM 64 - Extended Update Support | 8.1 | aarch64 |
| Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle | 8.10 | aarch64 |
| Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions | 8.8 | ppc64le |
| Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions | 8.6 | ppc64le |
| Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions | 8.4 | ppc64le |
| Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions | 8.2 | ppc64le |
| Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions | 8.1 | ppc64le |
| Red Hat Enterprise Linux Server - TUS | 8.8 | x86_64 |
| Red Hat Enterprise Linux Server - TUS | 8.6 | x86_64 |
| Red Hat Enterprise Linux Server - TUS | 8.4 | x86_64 |
| Red Hat Enterprise Linux Server - TUS | 8.2 | x86_64 |
| Red Hat Enterprise Linux Server - AUS | 8.6 | x86_64 |
| Red Hat Enterprise Linux Server - AUS | 8.4 | x86_64 |
| Red Hat Enterprise Linux Server - AUS | 8.2 | x86_64 |
Updated Packages
- fuse-overlayfs-0.4.1-1.module+el8.1.0+4081+b29780af.x86_64.rpm
- fuse-overlayfs-0.4.1-1.module+el8.1.0+4081+b29780af.src.rpm
- buildah-tests-debuginfo-1.9.0-5.module+el8.1.0+4240+893c1ab8.x86_64.rpm
- skopeo-debugsource-0.1.37-6.module+el8.1.0+4876+e678a192.x86_64.rpm
- skopeo-debuginfo-0.1.37-6.module+el8.1.0+4876+e678a192.x86_64.rpm
- buildah-1.9.0-5.module+el8.1.0+4240+893c1ab8.src.rpm
- oci-umount-2.3.4-2.git87f9237.module+el8.1.0+4081+b29780af.src.rpm
- slirp4netns-0.3.0-4.module+el8.1.0+4306+1d917805.src.rpm
- podman-manpages-1.4.2-6.module+el8.1.0+4830+f49150d7.noarch.rpm
- oci-umount-debuginfo-2.3.4-2.git87f9237.module+el8.1.0+4081+b29780af.x86_64.rpm
- podman-1.4.2-6.module+el8.1.0+4830+f49150d7.x86_64.rpm
- python-podman-api-1.2.0-0.1.gitd0a45fe.module+el8.1.0+4081+b29780af.noarch.rpm
- oci-systemd-hook-debugsource-0.1.15-2.git2d0b8a3.module+el8.1.0+4081+b29780af.x86_64.rpm
- buildah-debugsource-1.9.0-5.module+el8.1.0+4240+893c1ab8.x86_64.rpm
- oci-systemd-hook-debuginfo-0.1.15-2.git2d0b8a3.module+el8.1.0+4081+b29780af.x86_64.rpm
- oci-umount-2.3.4-2.git87f9237.module+el8.1.0+4081+b29780af.x86_64.rpm
- toolbox-0.0.4-1.module+el8.1.0+4081+b29780af.x86_64.rpm
- containers-common-0.1.37-6.module+el8.1.0+4876+e678a192.x86_64.rpm
- buildah-debuginfo-1.9.0-5.module+el8.1.0+4240+893c1ab8.x86_64.rpm
- containernetworking-plugins-0.8.1-3.module+el8.1.0+4881+045289ee.src.rpm
- cockpit-podman-4-1.module+el8.1.0+4081+b29780af.noarch.rpm
- containernetworking-plugins-debugsource-0.8.1-3.module+el8.1.0+4881+045289ee.x86_64.rpm
- buildah-1.9.0-5.module+el8.1.0+4240+893c1ab8.x86_64.rpm
- containernetworking-plugins-0.8.1-3.module+el8.1.0+4881+045289ee.x86_64.rpm
- skopeo-tests-0.1.37-6.module+el8.1.0+4876+e678a192.x86_64.rpm
- buildah-tests-1.9.0-5.module+el8.1.0+4240+893c1ab8.x86_64.rpm
- runc-debugsource-1.0.0-61.rc8.module+el8.1.0+4873+4a24e241.x86_64.rpm
- containernetworking-plugins-debuginfo-0.8.1-3.module+el8.1.0+4881+045289ee.x86_64.rpm
- fuse-overlayfs-debuginfo-0.4.1-1.module+el8.1.0+4081+b29780af.x86_64.rpm
- podman-1.4.2-6.module+el8.1.0+4830+f49150d7.src.rpm
- skopeo-0.1.37-6.module+el8.1.0+4876+e678a192.x86_64.rpm
- podman-debugsource-1.4.2-6.module+el8.1.0+4830+f49150d7.x86_64.rpm
- slirp4netns-debugsource-0.3.0-4.module+el8.1.0+4306+1d917805.x86_64.rpm
- oci-systemd-hook-0.1.15-2.git2d0b8a3.module+el8.1.0+4081+b29780af.src.rpm
- container-selinux-2.123.0-2.module+el8.1.0+4900+9d7326b8.src.rpm
- slirp4netns-0.3.0-4.module+el8.1.0+4306+1d917805.x86_64.rpm
- runc-1.0.0-61.rc8.module+el8.1.0+4873+4a24e241.x86_64.rpm
- fuse-overlayfs-debugsource-0.4.1-1.module+el8.1.0+4081+b29780af.x86_64.rpm
- python-podman-api-1.2.0-0.1.gitd0a45fe.module+el8.1.0+4081+b29780af.src.rpm
- runc-debuginfo-1.0.0-61.rc8.module+el8.1.0+4873+4a24e241.x86_64.rpm
- cockpit-podman-4-1.module+el8.1.0+4081+b29780af.src.rpm
- oci-umount-debugsource-2.3.4-2.git87f9237.module+el8.1.0+4081+b29780af.x86_64.rpm
- podman-docker-1.4.2-6.module+el8.1.0+4830+f49150d7.noarch.rpm
- container-selinux-2.123.0-2.module+el8.1.0+4900+9d7326b8.noarch.rpm
- runc-1.0.0-61.rc8.module+el8.1.0+4873+4a24e241.src.rpm
- podman-remote-debuginfo-1.4.2-6.module+el8.1.0+4830+f49150d7.x86_64.rpm
- toolbox-0.0.4-1.module+el8.1.0+4081+b29780af.src.rpm
- skopeo-0.1.37-6.module+el8.1.0+4876+e678a192.src.rpm
- podman-debuginfo-1.4.2-6.module+el8.1.0+4830+f49150d7.x86_64.rpm
- oci-systemd-hook-0.1.15-2.git2d0b8a3.module+el8.1.0+4081+b29780af.x86_64.rpm
- podman-remote-1.4.2-6.module+el8.1.0+4830+f49150d7.x86_64.rpm
- podman-tests-1.4.2-6.module+el8.1.0+4830+f49150d7.x86_64.rpm
- slirp4netns-debuginfo-0.3.0-4.module+el8.1.0+4306+1d917805.x86_64.rpm
- podman-tests-1.4.2-6.module+el8.1.0+4830+f49150d7.s390x.rpm
- runc-debugsource-1.0.0-61.rc8.module+el8.1.0+4873+4a24e241.s390x.rpm
- oci-systemd-hook-debugsource-0.1.15-2.git2d0b8a3.module+el8.1.0+4081+b29780af.s390x.rpm
- podman-remote-1.4.2-6.module+el8.1.0+4830+f49150d7.s390x.rpm
- oci-systemd-hook-0.1.15-2.git2d0b8a3.module+el8.1.0+4081+b29780af.s390x.rpm
- fuse-overlayfs-0.4.1-1.module+el8.1.0+4081+b29780af.s390x.rpm
- podman-debuginfo-1.4.2-6.module+el8.1.0+4830+f49150d7.s390x.rpm
- buildah-debuginfo-1.9.0-5.module+el8.1.0+4240+893c1ab8.s390x.rpm
- containernetworking-plugins-debuginfo-0.8.1-3.module+el8.1.0+4881+045289ee.s390x.rpm
- slirp4netns-0.3.0-4.module+el8.1.0+4306+1d917805.s390x.rpm
- fuse-overlayfs-debuginfo-0.4.1-1.module+el8.1.0+4081+b29780af.s390x.rpm
- buildah-debugsource-1.9.0-5.module+el8.1.0+4240+893c1ab8.s390x.rpm
- podman-1.4.2-6.module+el8.1.0+4830+f49150d7.s390x.rpm
- buildah-tests-debuginfo-1.9.0-5.module+el8.1.0+4240+893c1ab8.s390x.rpm
- skopeo-debugsource-0.1.37-6.module+el8.1.0+4876+e678a192.s390x.rpm
- skopeo-debuginfo-0.1.37-6.module+el8.1.0+4876+e678a192.s390x.rpm
- containernetworking-plugins-debugsource-0.8.1-3.module+el8.1.0+4881+045289ee.s390x.rpm
- fuse-overlayfs-debugsource-0.4.1-1.module+el8.1.0+4081+b29780af.s390x.rpm
- buildah-tests-1.9.0-5.module+el8.1.0+4240+893c1ab8.s390x.rpm
- skopeo-0.1.37-6.module+el8.1.0+4876+e678a192.s390x.rpm
- skopeo-tests-0.1.37-6.module+el8.1.0+4876+e678a192.s390x.rpm
- oci-systemd-hook-debuginfo-0.1.15-2.git2d0b8a3.module+el8.1.0+4081+b29780af.s390x.rpm
- slirp4netns-debuginfo-0.3.0-4.module+el8.1.0+4306+1d917805.s390x.rpm
- oci-umount-debugsource-2.3.4-2.git87f9237.module+el8.1.0+4081+b29780af.s390x.rpm
- containernetworking-plugins-0.8.1-3.module+el8.1.0+4881+045289ee.s390x.rpm
- toolbox-0.0.4-1.module+el8.1.0+4081+b29780af.s390x.rpm
- podman-debugsource-1.4.2-6.module+el8.1.0+4830+f49150d7.s390x.rpm
- podman-remote-debuginfo-1.4.2-6.module+el8.1.0+4830+f49150d7.s390x.rpm
- oci-umount-debuginfo-2.3.4-2.git87f9237.module+el8.1.0+4081+b29780af.s390x.rpm
- slirp4netns-debugsource-0.3.0-4.module+el8.1.0+4306+1d917805.s390x.rpm
- containers-common-0.1.37-6.module+el8.1.0+4876+e678a192.s390x.rpm
- buildah-1.9.0-5.module+el8.1.0+4240+893c1ab8.s390x.rpm
- runc-debuginfo-1.0.0-61.rc8.module+el8.1.0+4873+4a24e241.s390x.rpm
- oci-umount-2.3.4-2.git87f9237.module+el8.1.0+4081+b29780af.s390x.rpm
- runc-1.0.0-61.rc8.module+el8.1.0+4873+4a24e241.s390x.rpm
- fuse-overlayfs-debuginfo-0.4.1-1.module+el8.1.0+4081+b29780af.ppc64le.rpm
- slirp4netns-0.3.0-4.module+el8.1.0+4306+1d917805.ppc64le.rpm
- oci-umount-debugsource-2.3.4-2.git87f9237.module+el8.1.0+4081+b29780af.ppc64le.rpm
- toolbox-0.0.4-1.module+el8.1.0+4081+b29780af.ppc64le.rpm
- containernetworking-plugins-0.8.1-3.module+el8.1.0+4881+045289ee.ppc64le.rpm
- buildah-1.9.0-5.module+el8.1.0+4240+893c1ab8.ppc64le.rpm
- runc-debugsource-1.0.0-61.rc8.module+el8.1.0+4873+4a24e241.ppc64le.rpm
- fuse-overlayfs-0.4.1-1.module+el8.1.0+4081+b29780af.ppc64le.rpm
- slirp4netns-debuginfo-0.3.0-4.module+el8.1.0+4306+1d917805.ppc64le.rpm
- podman-remote-debuginfo-1.4.2-6.module+el8.1.0+4830+f49150d7.ppc64le.rpm
- podman-remote-1.4.2-6.module+el8.1.0+4830+f49150d7.ppc64le.rpm
- skopeo-debugsource-0.1.37-6.module+el8.1.0+4876+e678a192.ppc64le.rpm
- containernetworking-plugins-debugsource-0.8.1-3.module+el8.1.0+4881+045289ee.ppc64le.rpm
- oci-umount-debuginfo-2.3.4-2.git87f9237.module+el8.1.0+4081+b29780af.ppc64le.rpm
- podman-tests-1.4.2-6.module+el8.1.0+4830+f49150d7.ppc64le.rpm
- containernetworking-plugins-debuginfo-0.8.1-3.module+el8.1.0+4881+045289ee.ppc64le.rpm
- oci-umount-2.3.4-2.git87f9237.module+el8.1.0+4081+b29780af.ppc64le.rpm
- buildah-tests-debuginfo-1.9.0-5.module+el8.1.0+4240+893c1ab8.ppc64le.rpm
- buildah-tests-1.9.0-5.module+el8.1.0+4240+893c1ab8.ppc64le.rpm
- oci-systemd-hook-0.1.15-2.git2d0b8a3.module+el8.1.0+4081+b29780af.ppc64le.rpm
- fuse-overlayfs-debugsource-0.4.1-1.module+el8.1.0+4081+b29780af.ppc64le.rpm
- containers-common-0.1.37-6.module+el8.1.0+4876+e678a192.ppc64le.rpm
- buildah-debugsource-1.9.0-5.module+el8.1.0+4240+893c1ab8.ppc64le.rpm
- skopeo-debuginfo-0.1.37-6.module+el8.1.0+4876+e678a192.ppc64le.rpm
- podman-debugsource-1.4.2-6.module+el8.1.0+4830+f49150d7.ppc64le.rpm
- skopeo-0.1.37-6.module+el8.1.0+4876+e678a192.ppc64le.rpm
- podman-1.4.2-6.module+el8.1.0+4830+f49150d7.ppc64le.rpm
- podman-debuginfo-1.4.2-6.module+el8.1.0+4830+f49150d7.ppc64le.rpm
- runc-1.0.0-61.rc8.module+el8.1.0+4873+4a24e241.ppc64le.rpm
- slirp4netns-debugsource-0.3.0-4.module+el8.1.0+4306+1d917805.ppc64le.rpm
- skopeo-tests-0.1.37-6.module+el8.1.0+4876+e678a192.ppc64le.rpm
- oci-systemd-hook-debugsource-0.1.15-2.git2d0b8a3.module+el8.1.0+4081+b29780af.ppc64le.rpm
- runc-debuginfo-1.0.0-61.rc8.module+el8.1.0+4873+4a24e241.ppc64le.rpm
- oci-systemd-hook-debuginfo-0.1.15-2.git2d0b8a3.module+el8.1.0+4081+b29780af.ppc64le.rpm
- buildah-debuginfo-1.9.0-5.module+el8.1.0+4240+893c1ab8.ppc64le.rpm
- runc-debugsource-1.0.0-61.rc8.module+el8.1.0+4873+4a24e241.aarch64.rpm
- containers-common-0.1.37-6.module+el8.1.0+4876+e678a192.aarch64.rpm
- oci-umount-debugsource-2.3.4-2.git87f9237.module+el8.1.0+4081+b29780af.aarch64.rpm
- slirp4netns-0.3.0-4.module+el8.1.0+4306+1d917805.aarch64.rpm
- buildah-debuginfo-1.9.0-5.module+el8.1.0+4240+893c1ab8.aarch64.rpm
- slirp4netns-debuginfo-0.3.0-4.module+el8.1.0+4306+1d917805.aarch64.rpm
- podman-tests-1.4.2-6.module+el8.1.0+4830+f49150d7.aarch64.rpm
- buildah-tests-1.9.0-5.module+el8.1.0+4240+893c1ab8.aarch64.rpm
- buildah-1.9.0-5.module+el8.1.0+4240+893c1ab8.aarch64.rpm
- podman-remote-1.4.2-6.module+el8.1.0+4830+f49150d7.aarch64.rpm
- containernetworking-plugins-debuginfo-0.8.1-3.module+el8.1.0+4881+045289ee.aarch64.rpm
- buildah-debugsource-1.9.0-5.module+el8.1.0+4240+893c1ab8.aarch64.rpm
- fuse-overlayfs-0.4.1-1.module+el8.1.0+4081+b29780af.aarch64.rpm
- buildah-tests-debuginfo-1.9.0-5.module+el8.1.0+4240+893c1ab8.aarch64.rpm
- skopeo-tests-0.1.37-6.module+el8.1.0+4876+e678a192.aarch64.rpm
- oci-systemd-hook-0.1.15-2.git2d0b8a3.module+el8.1.0+4081+b29780af.aarch64.rpm
- containernetworking-plugins-debugsource-0.8.1-3.module+el8.1.0+4881+045289ee.aarch64.rpm
- podman-debugsource-1.4.2-6.module+el8.1.0+4830+f49150d7.aarch64.rpm
- oci-umount-debuginfo-2.3.4-2.git87f9237.module+el8.1.0+4081+b29780af.aarch64.rpm
- containernetworking-plugins-0.8.1-3.module+el8.1.0+4881+045289ee.aarch64.rpm
- oci-systemd-hook-debuginfo-0.1.15-2.git2d0b8a3.module+el8.1.0+4081+b29780af.aarch64.rpm
- skopeo-0.1.37-6.module+el8.1.0+4876+e678a192.aarch64.rpm
- oci-umount-2.3.4-2.git87f9237.module+el8.1.0+4081+b29780af.aarch64.rpm
- podman-debuginfo-1.4.2-6.module+el8.1.0+4830+f49150d7.aarch64.rpm
- podman-remote-debuginfo-1.4.2-6.module+el8.1.0+4830+f49150d7.aarch64.rpm
- fuse-overlayfs-debuginfo-0.4.1-1.module+el8.1.0+4081+b29780af.aarch64.rpm
- slirp4netns-debugsource-0.3.0-4.module+el8.1.0+4306+1d917805.aarch64.rpm
- podman-1.4.2-6.module+el8.1.0+4830+f49150d7.aarch64.rpm
- skopeo-debugsource-0.1.37-6.module+el8.1.0+4876+e678a192.aarch64.rpm
- toolbox-0.0.4-1.module+el8.1.0+4081+b29780af.aarch64.rpm
- fuse-overlayfs-debugsource-0.4.1-1.module+el8.1.0+4081+b29780af.aarch64.rpm
- oci-systemd-hook-debugsource-0.1.15-2.git2d0b8a3.module+el8.1.0+4081+b29780af.aarch64.rpm
- runc-debuginfo-1.0.0-61.rc8.module+el8.1.0+4873+4a24e241.aarch64.rpm
- skopeo-debuginfo-0.1.37-6.module+el8.1.0+4876+e678a192.aarch64.rpm
- runc-1.0.0-61.rc8.module+el8.1.0+4873+4a24e241.aarch64.rpm
Fixes
- This content is not included.BZ - 1735645
- This content is not included.BZ - 1735744
- This content is not included.BZ - 1757214
- This content is not included.BZ - 1764318
- This content is not included.BZ - 1770176
- This content is not included.BZ - 1774382
CVEs
References
Additional information
- The Red Hat security contact is This content is not included.secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.
- Offline Security Data data is available for integration with other systems. See Offline Security Data API to get started.