- Issued:
- 2022-04-19
- Updated:
- 2022-04-19
RHSA-2022:1407 - Moderate: container-tools:2.0 security and bug fix update
Synopsis
Moderate: container-tools:2.0 security and bug fix update
Type/Severity
Security Advisory Moderate
Topic
An update for the container-tools:2.0 module is now available for Red Hat Enterprise Linux 8.4 Extended Update Support.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Description
The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.
Security Fix(es):
-
podman: Default inheritable capabilities for linux container should be empty (CVE-2022-27649)
-
buildah: Default inheritable capabilities for linux container should be empty (CVE-2022-27651)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Bug Fix(es):
- [8.2 EUS backport] podman cpu stats bug (BZ#2062400)
Solution
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
Affected Products
| Product | Version | Arch |
|---|---|---|
| Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions | 8.4 | x86_64 |
| Red Hat Enterprise Linux for x86_64 - Extended Update Support | 8.4 | x86_64 |
| Red Hat Enterprise Linux for x86_64 - Extended Update Support Extension | 8.4 | x86_64 |
| Red Hat Enterprise Linux for Power, little endian - Extended Update Support | 8.4 | ppc64le |
| Red Hat Enterprise Linux for IBM z Systems - Extended Update Support | 8.4 | s390x |
| Red Hat Enterprise Linux for ARM 64 - Extended Update Support | 8.4 | aarch64 |
| Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions | 8.4 | ppc64le |
| Red Hat Enterprise Linux Server - TUS | 8.4 | x86_64 |
| Red Hat Enterprise Linux Server - AUS | 8.4 | x86_64 |
Updated Packages
- buildah-tests-1.11.6-9.module+el8.4.0+14792+f44be4c2.x86_64.rpm
- slirp4netns-debuginfo-0.4.2-3.git21fdece.module+el8.4.0+14792+f44be4c2.x86_64.rpm
- slirp4netns-debugsource-0.4.2-3.git21fdece.module+el8.4.0+14792+f44be4c2.x86_64.rpm
- udica-0.2.1-2.module+el8.4.0+14792+f44be4c2.src.rpm
- podman-1.6.4-28.module+el8.4.0+14792+f44be4c2.src.rpm
- skopeo-debugsource-0.1.41-4.module+el8.4.0+14792+f44be4c2.x86_64.rpm
- containernetworking-plugins-0.8.3-4.module+el8.4.0+14792+f44be4c2.src.rpm
- containernetworking-plugins-debugsource-0.8.3-4.module+el8.4.0+14792+f44be4c2.x86_64.rpm
- runc-1.0.0-65.rc10.module+el8.4.0+14792+f44be4c2.src.rpm
- buildah-debuginfo-1.11.6-9.module+el8.4.0+14792+f44be4c2.x86_64.rpm
- udica-0.2.1-2.module+el8.4.0+14792+f44be4c2.noarch.rpm
- criu-3.12-9.module+el8.4.0+14792+f44be4c2.src.rpm
- criu-3.12-9.module+el8.4.0+14792+f44be4c2.x86_64.rpm
- fuse-overlayfs-0.7.8-1.module+el8.4.0+14792+f44be4c2.x86_64.rpm
- runc-debugsource-1.0.0-65.rc10.module+el8.4.0+14792+f44be4c2.x86_64.rpm
- skopeo-0.1.41-4.module+el8.4.0+14792+f44be4c2.x86_64.rpm
- skopeo-debuginfo-0.1.41-4.module+el8.4.0+14792+f44be4c2.x86_64.rpm
- podman-remote-1.6.4-28.module+el8.4.0+14792+f44be4c2.x86_64.rpm
- conmon-2.0.15-1.module+el8.4.0+14792+f44be4c2.src.rpm
- toolbox-0.0.7-1.module+el8.4.0+14792+f44be4c2.src.rpm
- criu-debuginfo-3.12-9.module+el8.4.0+14792+f44be4c2.x86_64.rpm
- fuse-overlayfs-debugsource-0.7.8-1.module+el8.4.0+14792+f44be4c2.x86_64.rpm
- skopeo-0.1.41-4.module+el8.4.0+14792+f44be4c2.src.rpm
- containernetworking-plugins-0.8.3-4.module+el8.4.0+14792+f44be4c2.x86_64.rpm
- crit-3.12-9.module+el8.4.0+14792+f44be4c2.x86_64.rpm
- podman-docker-1.6.4-28.module+el8.4.0+14792+f44be4c2.noarch.rpm
- podman-tests-1.6.4-28.module+el8.4.0+14792+f44be4c2.x86_64.rpm
- buildah-1.11.6-9.module+el8.4.0+14792+f44be4c2.x86_64.rpm
- fuse-overlayfs-debuginfo-0.7.8-1.module+el8.4.0+14792+f44be4c2.x86_64.rpm
- buildah-1.11.6-9.module+el8.4.0+14792+f44be4c2.src.rpm
- podman-debugsource-1.6.4-28.module+el8.4.0+14792+f44be4c2.x86_64.rpm
- cockpit-podman-11-1.module+el8.4.0+14792+f44be4c2.src.rpm
- buildah-tests-debuginfo-1.11.6-9.module+el8.4.0+14792+f44be4c2.x86_64.rpm
- conmon-2.0.15-1.module+el8.4.0+14792+f44be4c2.x86_64.rpm
- containernetworking-plugins-debuginfo-0.8.3-4.module+el8.4.0+14792+f44be4c2.x86_64.rpm
- runc-1.0.0-65.rc10.module+el8.4.0+14792+f44be4c2.x86_64.rpm
- fuse-overlayfs-0.7.8-1.module+el8.4.0+14792+f44be4c2.src.rpm
- slirp4netns-0.4.2-3.git21fdece.module+el8.4.0+14792+f44be4c2.src.rpm
- toolbox-0.0.7-1.module+el8.4.0+14792+f44be4c2.noarch.rpm
- podman-debuginfo-1.6.4-28.module+el8.4.0+14792+f44be4c2.x86_64.rpm
- podman-1.6.4-28.module+el8.4.0+14792+f44be4c2.x86_64.rpm
- slirp4netns-0.4.2-3.git21fdece.module+el8.4.0+14792+f44be4c2.x86_64.rpm
- python-podman-api-1.2.0-0.2.gitd0a45fe.module+el8.4.0+14792+f44be4c2.src.rpm
- python3-criu-3.12-9.module+el8.4.0+14792+f44be4c2.x86_64.rpm
- container-selinux-2.130.0-1.module+el8.4.0+14792+f44be4c2.noarch.rpm
- criu-debugsource-3.12-9.module+el8.4.0+14792+f44be4c2.x86_64.rpm
- podman-remote-debuginfo-1.6.4-28.module+el8.4.0+14792+f44be4c2.x86_64.rpm
- runc-debuginfo-1.0.0-65.rc10.module+el8.4.0+14792+f44be4c2.x86_64.rpm
- cockpit-podman-11-1.module+el8.4.0+14792+f44be4c2.noarch.rpm
- containers-common-0.1.41-4.module+el8.4.0+14792+f44be4c2.x86_64.rpm
- skopeo-tests-0.1.41-4.module+el8.4.0+14792+f44be4c2.x86_64.rpm
- container-selinux-2.130.0-1.module+el8.4.0+14792+f44be4c2.src.rpm
- python-podman-api-1.2.0-0.2.gitd0a45fe.module+el8.4.0+14792+f44be4c2.noarch.rpm
- buildah-debugsource-1.11.6-9.module+el8.4.0+14792+f44be4c2.x86_64.rpm
- criu-debugsource-3.12-9.module+el8.4.0+14792+f44be4c2.ppc64le.rpm
- conmon-2.0.15-1.module+el8.4.0+14792+f44be4c2.ppc64le.rpm
- containers-common-0.1.41-4.module+el8.4.0+14792+f44be4c2.ppc64le.rpm
- fuse-overlayfs-0.7.8-1.module+el8.4.0+14792+f44be4c2.ppc64le.rpm
- buildah-1.11.6-9.module+el8.4.0+14792+f44be4c2.ppc64le.rpm
- buildah-debuginfo-1.11.6-9.module+el8.4.0+14792+f44be4c2.ppc64le.rpm
- buildah-tests-1.11.6-9.module+el8.4.0+14792+f44be4c2.ppc64le.rpm
- criu-3.12-9.module+el8.4.0+14792+f44be4c2.ppc64le.rpm
- podman-remote-1.6.4-28.module+el8.4.0+14792+f44be4c2.ppc64le.rpm
- crit-3.12-9.module+el8.4.0+14792+f44be4c2.ppc64le.rpm
- podman-debuginfo-1.6.4-28.module+el8.4.0+14792+f44be4c2.ppc64le.rpm
- podman-remote-debuginfo-1.6.4-28.module+el8.4.0+14792+f44be4c2.ppc64le.rpm
- fuse-overlayfs-debugsource-0.7.8-1.module+el8.4.0+14792+f44be4c2.ppc64le.rpm
- runc-debuginfo-1.0.0-65.rc10.module+el8.4.0+14792+f44be4c2.ppc64le.rpm
- criu-debuginfo-3.12-9.module+el8.4.0+14792+f44be4c2.ppc64le.rpm
- skopeo-debuginfo-0.1.41-4.module+el8.4.0+14792+f44be4c2.ppc64le.rpm
- podman-tests-1.6.4-28.module+el8.4.0+14792+f44be4c2.ppc64le.rpm
- runc-1.0.0-65.rc10.module+el8.4.0+14792+f44be4c2.ppc64le.rpm
- skopeo-0.1.41-4.module+el8.4.0+14792+f44be4c2.ppc64le.rpm
- fuse-overlayfs-debuginfo-0.7.8-1.module+el8.4.0+14792+f44be4c2.ppc64le.rpm
- runc-debugsource-1.0.0-65.rc10.module+el8.4.0+14792+f44be4c2.ppc64le.rpm
- slirp4netns-0.4.2-3.git21fdece.module+el8.4.0+14792+f44be4c2.ppc64le.rpm
- podman-1.6.4-28.module+el8.4.0+14792+f44be4c2.ppc64le.rpm
- containernetworking-plugins-0.8.3-4.module+el8.4.0+14792+f44be4c2.ppc64le.rpm
- containernetworking-plugins-debugsource-0.8.3-4.module+el8.4.0+14792+f44be4c2.ppc64le.rpm
- buildah-tests-debuginfo-1.11.6-9.module+el8.4.0+14792+f44be4c2.ppc64le.rpm
- containernetworking-plugins-debuginfo-0.8.3-4.module+el8.4.0+14792+f44be4c2.ppc64le.rpm
- buildah-debugsource-1.11.6-9.module+el8.4.0+14792+f44be4c2.ppc64le.rpm
- podman-debugsource-1.6.4-28.module+el8.4.0+14792+f44be4c2.ppc64le.rpm
- slirp4netns-debuginfo-0.4.2-3.git21fdece.module+el8.4.0+14792+f44be4c2.ppc64le.rpm
- skopeo-debugsource-0.1.41-4.module+el8.4.0+14792+f44be4c2.ppc64le.rpm
- slirp4netns-debugsource-0.4.2-3.git21fdece.module+el8.4.0+14792+f44be4c2.ppc64le.rpm
- python3-criu-3.12-9.module+el8.4.0+14792+f44be4c2.ppc64le.rpm
- skopeo-tests-0.1.41-4.module+el8.4.0+14792+f44be4c2.ppc64le.rpm
- python3-criu-3.12-9.module+el8.4.0+14792+f44be4c2.s390x.rpm
- skopeo-debugsource-0.1.41-4.module+el8.4.0+14792+f44be4c2.s390x.rpm
- podman-1.6.4-28.module+el8.4.0+14792+f44be4c2.s390x.rpm
- slirp4netns-debuginfo-0.4.2-3.git21fdece.module+el8.4.0+14792+f44be4c2.s390x.rpm
- runc-1.0.0-65.rc10.module+el8.4.0+14792+f44be4c2.s390x.rpm
- conmon-2.0.15-1.module+el8.4.0+14792+f44be4c2.s390x.rpm
- podman-remote-debuginfo-1.6.4-28.module+el8.4.0+14792+f44be4c2.s390x.rpm
- skopeo-debuginfo-0.1.41-4.module+el8.4.0+14792+f44be4c2.s390x.rpm
- fuse-overlayfs-debugsource-0.7.8-1.module+el8.4.0+14792+f44be4c2.s390x.rpm
- criu-3.12-9.module+el8.4.0+14792+f44be4c2.s390x.rpm
- podman-debuginfo-1.6.4-28.module+el8.4.0+14792+f44be4c2.s390x.rpm
- runc-debugsource-1.0.0-65.rc10.module+el8.4.0+14792+f44be4c2.s390x.rpm
- skopeo-tests-0.1.41-4.module+el8.4.0+14792+f44be4c2.s390x.rpm
- containernetworking-plugins-debuginfo-0.8.3-4.module+el8.4.0+14792+f44be4c2.s390x.rpm
- buildah-debugsource-1.11.6-9.module+el8.4.0+14792+f44be4c2.s390x.rpm
- runc-debuginfo-1.0.0-65.rc10.module+el8.4.0+14792+f44be4c2.s390x.rpm
- fuse-overlayfs-0.7.8-1.module+el8.4.0+14792+f44be4c2.s390x.rpm
- skopeo-0.1.41-4.module+el8.4.0+14792+f44be4c2.s390x.rpm
- buildah-tests-debuginfo-1.11.6-9.module+el8.4.0+14792+f44be4c2.s390x.rpm
- criu-debugsource-3.12-9.module+el8.4.0+14792+f44be4c2.s390x.rpm
- podman-remote-1.6.4-28.module+el8.4.0+14792+f44be4c2.s390x.rpm
- crit-3.12-9.module+el8.4.0+14792+f44be4c2.s390x.rpm
- containernetworking-plugins-debugsource-0.8.3-4.module+el8.4.0+14792+f44be4c2.s390x.rpm
- buildah-1.11.6-9.module+el8.4.0+14792+f44be4c2.s390x.rpm
- slirp4netns-debugsource-0.4.2-3.git21fdece.module+el8.4.0+14792+f44be4c2.s390x.rpm
- podman-debugsource-1.6.4-28.module+el8.4.0+14792+f44be4c2.s390x.rpm
- criu-debuginfo-3.12-9.module+el8.4.0+14792+f44be4c2.s390x.rpm
- buildah-tests-1.11.6-9.module+el8.4.0+14792+f44be4c2.s390x.rpm
- slirp4netns-0.4.2-3.git21fdece.module+el8.4.0+14792+f44be4c2.s390x.rpm
- fuse-overlayfs-debuginfo-0.7.8-1.module+el8.4.0+14792+f44be4c2.s390x.rpm
- buildah-debuginfo-1.11.6-9.module+el8.4.0+14792+f44be4c2.s390x.rpm
- containers-common-0.1.41-4.module+el8.4.0+14792+f44be4c2.s390x.rpm
- podman-tests-1.6.4-28.module+el8.4.0+14792+f44be4c2.s390x.rpm
- containernetworking-plugins-0.8.3-4.module+el8.4.0+14792+f44be4c2.s390x.rpm
- fuse-overlayfs-0.7.8-1.module+el8.4.0+14792+f44be4c2.aarch64.rpm
- buildah-tests-1.11.6-9.module+el8.4.0+14792+f44be4c2.aarch64.rpm
- podman-debuginfo-1.6.4-28.module+el8.4.0+14792+f44be4c2.aarch64.rpm
- runc-1.0.0-65.rc10.module+el8.4.0+14792+f44be4c2.aarch64.rpm
- skopeo-debuginfo-0.1.41-4.module+el8.4.0+14792+f44be4c2.aarch64.rpm
- buildah-tests-debuginfo-1.11.6-9.module+el8.4.0+14792+f44be4c2.aarch64.rpm
- slirp4netns-debuginfo-0.4.2-3.git21fdece.module+el8.4.0+14792+f44be4c2.aarch64.rpm
- buildah-debugsource-1.11.6-9.module+el8.4.0+14792+f44be4c2.aarch64.rpm
- skopeo-debugsource-0.1.41-4.module+el8.4.0+14792+f44be4c2.aarch64.rpm
- crit-3.12-9.module+el8.4.0+14792+f44be4c2.aarch64.rpm
- criu-3.12-9.module+el8.4.0+14792+f44be4c2.aarch64.rpm
- podman-1.6.4-28.module+el8.4.0+14792+f44be4c2.aarch64.rpm
- podman-tests-1.6.4-28.module+el8.4.0+14792+f44be4c2.aarch64.rpm
- skopeo-0.1.41-4.module+el8.4.0+14792+f44be4c2.aarch64.rpm
- slirp4netns-debugsource-0.4.2-3.git21fdece.module+el8.4.0+14792+f44be4c2.aarch64.rpm
- containers-common-0.1.41-4.module+el8.4.0+14792+f44be4c2.aarch64.rpm
- conmon-2.0.15-1.module+el8.4.0+14792+f44be4c2.aarch64.rpm
- python3-criu-3.12-9.module+el8.4.0+14792+f44be4c2.aarch64.rpm
- runc-debugsource-1.0.0-65.rc10.module+el8.4.0+14792+f44be4c2.aarch64.rpm
- runc-debuginfo-1.0.0-65.rc10.module+el8.4.0+14792+f44be4c2.aarch64.rpm
- slirp4netns-0.4.2-3.git21fdece.module+el8.4.0+14792+f44be4c2.aarch64.rpm
- criu-debugsource-3.12-9.module+el8.4.0+14792+f44be4c2.aarch64.rpm
- fuse-overlayfs-debugsource-0.7.8-1.module+el8.4.0+14792+f44be4c2.aarch64.rpm
- buildah-1.11.6-9.module+el8.4.0+14792+f44be4c2.aarch64.rpm
- containernetworking-plugins-0.8.3-4.module+el8.4.0+14792+f44be4c2.aarch64.rpm
- podman-debugsource-1.6.4-28.module+el8.4.0+14792+f44be4c2.aarch64.rpm
- criu-debuginfo-3.12-9.module+el8.4.0+14792+f44be4c2.aarch64.rpm
- containernetworking-plugins-debugsource-0.8.3-4.module+el8.4.0+14792+f44be4c2.aarch64.rpm
- containernetworking-plugins-debuginfo-0.8.3-4.module+el8.4.0+14792+f44be4c2.aarch64.rpm
- buildah-debuginfo-1.11.6-9.module+el8.4.0+14792+f44be4c2.aarch64.rpm
- fuse-overlayfs-debuginfo-0.7.8-1.module+el8.4.0+14792+f44be4c2.aarch64.rpm
- podman-remote-1.6.4-28.module+el8.4.0+14792+f44be4c2.aarch64.rpm
- podman-remote-debuginfo-1.6.4-28.module+el8.4.0+14792+f44be4c2.aarch64.rpm
- skopeo-tests-0.1.41-4.module+el8.4.0+14792+f44be4c2.aarch64.rpm
Fixes
CVEs
References
Additional information
- The Red Hat security contact is This content is not included.secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.
- Offline Security Data data is available for integration with other systems. See Offline Security Data API to get started.