A flaw was found in buildah where containers were incorrectly started with non-empty default permissions. A bug was found in Moby (Docker Engine) where containers were incorrectly started with non-empty inheritable Linux process capabilities, enabling an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs. This has the potential to impact confidentiality and integrity.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade podman-testsUpgrade python-podman-apiUpgrade podman-gvproxyUpgrade buildah-testsUpgrade container-selinuxUpgrade slirp4netnsUpgrade libslirpUpgrade udicaUpgrade python3-criuUpgrade cockpit-podmanUpgrade buildahUpgrade aardvark-dnsUpgrade toolbox-testsUpgrade critUpgrade podman-dockerUpgrade fuse-overlayfsUpgrade criu-libsUpgrade skopeo-testsUpgrade conmonUpgrade podman-pluginsUpgrade oci-seccomp-bpf-hookUpgrade runcUpgrade criu-develUpgrade podman-catatonitUpgrade podmanUpgrade criuUpgrade python3-podmanUpgrade containernetworking-pluginsUpgrade toolboxUpgrade libslirp-develUpgrade crunUpgrade skopeoUpgrade containers-commonUpgrade podman-remoteUpgrade netavark | May 4, 2022 | Apr 4, 2022 |
| Alpine Linux | — | Upgrade buildah | Oct 1, 2024 | Apr 4, 2022 |
| Centos_linux | — | Upgrade buildah-testsUpgrade libslirp-develUpgrade podman-remote-debuginfoUpgrade criu-libsUpgrade libslirp-debuginfoUpgrade toolbox-debuginfoUpgrade runcUpgrade podman-debugsourceUpgrade containernetworking-pluginsUpgrade criu-debuginfoUpgrade fuse-overlayfs-debugsourceUpgrade toolbox-debugsourceUpgrade container-selinuxUpgrade udicaUpgrade podman-catatonitUpgrade buildah-tests-debuginfoUpgrade podman-remoteUpgrade runc-debugsourceUpgrade python3-criuUpgrade buildahUpgrade podman-plugins-debuginfoUpgrade buildah-debuginfoUpgrade libslirp-debugsourceUpgrade oci-seccomp-bpf-hookUpgrade podman-gvproxy-debuginfoUpgrade containers-commonUpgrade skopeoUpgrade criu-debugsourceUpgrade podmanUpgrade critUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade criu-libs-debuginfoUpgrade criuUpgrade aardvark-dnsUpgrade crun-debugsourceUpgrade podman-debuginfoUpgrade runc-debuginfoUpgrade slirp4netns-debuginfoUpgrade fuse-overlayfs-debuginfoUpgrade python3-podmanUpgrade podman-gvproxyUpgrade containernetworking-plugins-debuginfoUpgrade podman-dockerUpgrade slirp4netns-debugsourceUpgrade skopeo-testsUpgrade crun-debuginfoUpgrade conmonUpgrade toolbox-testsUpgrade podman-testsUpgrade netavarkUpgrade toolboxUpgrade libslirpUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade criu-develUpgrade skopeo-debugsourceUpgrade skopeo-debuginfoUpgrade fuse-overlayfsUpgrade cockpit-podmanUpgrade conmon-debugsourceUpgrade buildah-debugsourceUpgrade containernetworking-plugins-debugsourceUpgrade conmon-debuginfoUpgrade python-podman-apiUpgrade podman-pluginsUpgrade slirp4netnsUpgrade crunUpgrade podman-catatonit-debuginfo | Apr 27, 2022 | Apr 4, 2022 |
| Debian | — | Upgrade golang-github-containers-buildah | Jul 30, 2024 | Apr 4, 2022 |
| Oracle_linux | — | Upgrade aardvark-dnsUpgrade libslirp-develUpgrade podman-dockerUpgrade podman-testsUpgrade python3-criuUpgrade python-podman-apiUpgrade buildahUpgrade libslirpUpgrade slirp4netnsUpgrade critUpgrade criu-libsUpgrade container-selinuxUpgrade skopeo-testsUpgrade oci-seccomp-bpf-hookUpgrade podman-gvproxyUpgrade criu-develUpgrade cockpit-podmanUpgrade buildah-testsUpgrade podman-pluginsUpgrade podman-catatonitUpgrade runcUpgrade udicaUpgrade skopeoUpgrade criuUpgrade python3-podmanUpgrade podmanUpgrade conmonUpgrade podman-remoteUpgrade containers-commonUpgrade netavarkUpgrade fuse-overlayfsUpgrade containernetworking-pluginsUpgrade crun | Apr 29, 2022 | Mar 30, 2022 |
| Redhat_linux | — | Upgrade podman-dockerUpgrade buildah-testsUpgrade python-podman-apiUpgrade podman-gvproxyUpgrade criu-libs-debuginfoUpgrade slirp4netns-debuginfoUpgrade containernetworking-plugins-debuginfoUpgrade container-selinuxUpgrade slirp4netnsUpgrade toolbox-testsUpgrade aardvark-dnsUpgrade podman-debugsourceUpgrade fuse-overlayfs-debugsourceUpgrade buildahUpgrade udicaUpgrade cockpit-podmanUpgrade podman-debuginfoUpgrade runc-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade runcUpgrade crun-debuginfoUpgrade runc-debugsourceUpgrade libslirp-debugsourceUpgrade conmon-debuginfoUpgrade podman-remoteUpgrade criu-debugsourceUpgrade skopeo-debuginfoUpgrade podman-plugins-debuginfoUpgrade buildah-debuginfoUpgrade criu-libsUpgrade python3-criuUpgrade critUpgrade libslirp-debuginfoUpgrade toolbox-debuginfoUpgrade skopeo-debugsourceUpgrade buildah-debugsourceUpgrade fuse-overlayfs-debuginfoUpgrade netavarkUpgrade conmon-debugsourceUpgrade podman-pluginsUpgrade criuUpgrade podman-catatonit-debuginfoUpgrade podman-remote-debuginfoUpgrade skopeo-testsUpgrade containers-commonUpgrade crunUpgrade podman-testsUpgrade podman-catatonitUpgrade toolboxUpgrade fuse-overlayfsUpgrade toolbox-debugsourceUpgrade oci-seccomp-bpf-hookUpgrade slirp4netns-debugsourceNo solution existsUpgrade podmanUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade conmonUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade criu-debuginfoUpgrade python3-podmanUpgrade buildah-tests-debuginfoUpgrade containernetworking-pluginsUpgrade containernetworking-plugins-debugsourceUpgrade crun-debugsourceUpgrade libslirp-develUpgrade libslirpUpgrade criu-develUpgrade skopeo | Apr 20, 2022 | Apr 4, 2022 |
| Rocky_linux | — | Upgrade containers-commonUpgrade libslirp-debuginfoUpgrade conmon-debugsourceUpgrade podmanUpgrade podman-catatonit-debuginfoUpgrade criu-debugsourceUpgrade podman-debuginfoUpgrade podman-gvproxy-debuginfoUpgrade containernetworking-pluginsUpgrade criu-libs-debuginfoUpgrade criu-libsUpgrade libslirp-develUpgrade podman-remoteUpgrade fuse-overlayfs-debugsourceUpgrade buildah-tests-debuginfoUpgrade buildah-debuginfoUpgrade skopeo-testsUpgrade crun-debugsourceUpgrade runc-debuginfoUpgrade oci-seccomp-bpf-hookUpgrade python3-criuUpgrade skopeoUpgrade critUpgrade podman-plugins-debuginfoUpgrade podman-remote-debuginfoUpgrade oci-seccomp-bpf-hook-debugsourceUpgrade criu-develUpgrade aardvark-dnsUpgrade runcUpgrade criu-debuginfoUpgrade runc-debugsourceUpgrade buildah-debugsourceUpgrade fuse-overlayfs-debuginfoUpgrade toolbox-debuginfoUpgrade buildahUpgrade skopeo-debuginfoUpgrade podman-pluginsUpgrade toolboxUpgrade podman-gvproxyUpgrade podman-debugsourceUpgrade crunUpgrade crun-debuginfoUpgrade slirp4netnsUpgrade buildah-testsUpgrade conmon-debuginfoUpgrade podman-catatonitUpgrade netavarkUpgrade fuse-overlayfsUpgrade toolbox-debugsourceUpgrade skopeo-debugsourceUpgrade containernetworking-plugins-debugsourceUpgrade conmonUpgrade criuUpgrade containernetworking-plugins-debuginfoUpgrade podman-testsUpgrade oci-seccomp-bpf-hook-debuginfoUpgrade slirp4netns-debugsourceUpgrade libslirp-debugsourceUpgrade slirp4netns-debuginfoUpgrade libslirpUpgrade toolbox-tests | Mar 5, 2024 | Apr 4, 2022 |
| Suse | — | Upgrade buildah | Oct 26, 2022 | Apr 4, 2022 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub