—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256

=====================================================================
Red Hat Security Advisory

Synopsis: Moderate: podman security, bug fix, and enhancement update
Advisory ID: RHSA-2020:1227-01
Product: Red Hat Enterprise Linux Extras
Advisory URL: https://access.redhat.com/errata/RHSA-2020:1227
Issue date: 2020-03-31
CVE Names: CVE-2019-18466 CVE-2020-1702
=====================================================================

1. Summary:

An update for podman is now available for Red Hat Enterprise Linux 7
Extras.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux 7 Extras – noarch, ppc64le, s390x, x86_64

3. Description:

The podman tool manages pods, container images, and containers. It is part
of the libpod library, which is for applications that use container pods.
Container pods is a concept in Kubernetes.

Security Fix(es):

* podman: resolving symlink in host filesystem leads to unexpected results
of copy operation (CVE-2019-18466)

* containers/image: Container images read entire image manifest into memory
(CVE-2020-1702)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

Bug Fix(es):

* [extras-rhel-7] conmon binary stripped but debuginfo not generated
(BZ#1650395)

* Cannot run systemd-container with SCL service due to RHSA-2019:2091 fix
(BZ#1758509)

* Podman does not enforce registries.block in the registries.conf file
(BZ#1787666)

* podman and podman-manpages needs merging (BZ#1788549)

* podman should be linked against gpgme-pthread (BZ#1793083)

* podman cannot support load tarball which the name with colon but docker
can support this (BZ#1797599)

* podman (1.6.4) rhel 8.1 no route to host from inside container
[extras-rhel-7.8/podman] (BZ#1806895)

* Podman can’t reuse a container name, even if the container that was using
it is no longer around [extras-rhel-7.8/podman] (BZ#1807437)

* podman exec does not reads from stdin [extras-rhel-7.8/podman]
(BZ#1807586)

* [FJ8.2 Bug]: [REG]The “–group-add” option of “podman create” doesn’t
function. [extras-rhel-7.8/podman] (BZ#1808702)

Enhancement(s):

* [RFE] sctp support for podman (BZ#1664218)

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1650395 – [extras-rhel-7] conmon binary stripped but debuginfo not generated
1744588 – CVE-2019-18466 podman: resolving symlink in host filesystem leads to unexpected results of copy operation
1758509 – Cannot run systemd-container with SCL service due to RHSA-2019:2091 fix
1788549 – podman and podman-manpages needs merging
1792796 – CVE-2020-1702 containers/image: Container images read entire image manifest into memory
1797599 – podman cannot support load tarball which the name with colon but docker can support this
1806895 – podman (1.6.4) rhel 8.1 no route to host from inside container [extras-rhel-7.8/podman]
1807437 – Podman can’t reuse a container name, even if the container that was using it is no longer around [extras-rhel-7.8/podman]
1807586 – podman exec does not reads from stdin [extras-rhel-7.8/podman]
1808702 – [FJ8.2 Bug]: [REG]The “–group-add” option of “podman create” doesn’t function. [extras-rhel-7.8/podman]

6. Package List:

Red Hat Enterprise Linux 7 Extras:

Source:
podman-1.6.4-16.el7_8.src.rpm

noarch:
podman-docker-1.6.4-16.el7_8.noarch.rpm

ppc64le:
podman-1.6.4-16.el7_8.ppc64le.rpm
podman-debuginfo-1.6.4-16.el7_8.ppc64le.rpm

s390x:
podman-1.6.4-16.el7_8.s390x.rpm
podman-debuginfo-1.6.4-16.el7_8.s390x.rpm

x86_64:
podman-1.6.4-16.el7_8.x86_64.rpm
podman-debuginfo-1.6.4-16.el7_8.x86_64.rpm

Red Hat Enterprise Linux 7 Extras:

Source:
podman-1.6.4-16.el7_8.src.rpm

noarch:
podman-docker-1.6.4-16.el7_8.noarch.rpm

x86_64:
podman-1.6.4-16.el7_8.x86_64.rpm
podman-debuginfo-1.6.4-16.el7_8.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2019-18466
https://access.redhat.com/security/cve/CVE-2020-1702
https://access.redhat.com/security/updates/classification/#moderate

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2020 Red Hat, Inc.
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1

iQIVAwUBXoPf99zjgjWX9erEAQjdHA/+Oqk+XcsMWVkfj+1ZbVYczkGcnWC01hDW
Emgu22gTuMtdwuDG9lHy0vLMPva64FzkWV0marDYkkCuCS2cUD/irzoA0X/m4/GZ
Yho4BQ+6fCWZ/3P0C+F+xCrz7FWFy/Ib4rV4KhyaKq9qjB6W9guXfRR3Pxe5oohX
6euia8BdVw6sdNLG9tCrhENYM/zb76zwWWuwVWBYYsCHh2b6v2P6zutIoKhon1hN
LQ2LIwFjfjFJxXuDDpTIt2Y4y7SkTGsJ/DGUyyHyCbKAf84+t3srN3q/B7DM2O8I
x4vZLmL6kiZ88dfHl3Z8y6SL7+8xUBHAfvllEqRm6DRXpPMVBSDnVHuf8AGBI/EY
2HOAMUqE2UKYXaX7ZbbnVRZGf7MlBjrdGJs28QOid0FgJB4y1qPdymSst35pWPHd
G0OXhj3WxeE4Pfb6gzRRowMGTipRIAMuGDCGJKL9hcg9gC9l/Yianf0mrg8SLzUC
QwkQDbY1goUDbW8eLv9peFiwBz755CwOLP9G6t8Vmj+zNiTRy5vuadSpLYOzkLK1
8tEbMS51rH+fWAq4Egmwsvu5XMcMcY/00NfgXMBIBrVFIcYN2yzXHdijEF9jqABz
bNgIaM15wHAOZxc5Qey1a5/CMlm449WXQYrn1I+P9LCU+ZOqHOOxM0+RtSqdlPYG
+ymH1Ihp5tE=
=8y7H
—–END PGP SIGNATURE—–

—
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce