CVE-2020-1726

A flaw was discovered in Podman where it incorrectly allows containers when created to overwrite existing files in volumes, even if they are mounted as read-only. When a user runs a malicious container or a container based on a malicious image with an attached volume that is used for the first time, it is possible to trigger the flaw and overwrite files in the volume.This issue was introduced in version 1.6.0.

A flaw was discovered in Podman where it incorrectly allows containers when created to overwrite existing files in volumes, even if they are mounted as read-only. When a user runs a malicious container or a container based on a malicious image with an attached volume that is used for the first time, it is possible to trigger the flaw and overwrite files in the volume.This issue was introduced in version 1.6.0.

A flaw was discovered in Podman where it incorrectly allows containers when created to overwrite existing files in volumes, even if they are mounted as read-only. When a user runs a malicious container or a container based on a malicious image with an attached volume that is used for the first time, it is possible to trigger the flaw and overwrite files in the volume. This issue was introduced in version 1.6.0.

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

• runc: volume mount race condition with shared mounts leads to information leak/integrity manipulation (CVE-2019-19921)

• containers/image: Container images read entire image manifest into memory (CVE-2020-1702)

• podman: incorrectly allows existing files in volumes to be overwritten by a container when it is created (CVE-2020-1726)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.2 Release Notes linked from the References section.

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

• runc: volume mount race condition with shared mounts leads to information leak/integrity manipulation (CVE-2019-19921)

• containers/image: Container images read entire image manifest into memory (CVE-2020-1702)

• podman: incorrectly allows existing files in volumes to be overwritten by a container when it is created (CVE-2020-1726)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Podman has Files or Directories Accessible to External Parties in github.com/containers/libpod

This update for conmon, fuse-overlayfs, libcontainers-common, podman fixes the following issues:

podman was updated to v2.0.6 (bsc#1175821)

• install missing systemd units for the new Rest API (bsc#1175957) and a few man-pages that where missing before
• Drop varlink API related bits (in favor of the new API)
• fix install location for zsh completions

• Fixed a bug where running systemd in a container on a cgroups v1 system would fail.
• Fixed a bug where /etc/passwd could be re-created every time a container is restarted if the container's /etc/passwd did not contain an entry for the user the container was started as.
• Fixed a bug where containers without an /etc/passwd file specifying a non-root user would not start.
• Fixed a bug where the --remote flag would sometimes not make remote connections and would instead attempt to run Podman locally.

Update to v2.0.6:

• Features

  • Rootless Podman will now add an entry to /etc/passwd for the user who ran Podman if run with --userns=keep-id.
  • The podman system connection command has been reworked to support multiple connections, and reenabled for use!
  • Podman now has a new global flag, --connection, to specify a connection to a remote Podman API instance.

• Changes

  • Podman's automatic systemd integration (activated by the --systemd=true flag, set by default) will now activate for containers using /usr/local/sbin/init as their command, instead of just /usr/sbin/init and /sbin/init (and any path ending in systemd).
  • Seccomp profiles specified by the --security-opt seccomp=... flag to podman create and podman run will now be honored even if the container was created using --privileged.

• Bugfixes

  • Fixed a bug where the podman play kube would not honor the hostIP field for port forwarding (#5964).
  • Fixed a bug where the podman generate systemd command would panic on an invalid restart policy being specified (#7271).
  • Fixed a bug where the podman images command could take a very long time (several minutes) to complete when a large number of images were present.
  • Fixed a bug where the podman logs command with the --tail flag would not work properly when a large amount of output would be printed ((#7230)[https://github.com//issues/7230]).
  • Fixed a bug where the podman exec command with remote Podman would not return a non-zero exit code when the exec session failed to start (e.g. invoking a non-existent command) (#6893).
  • Fixed a bug where the podman load command with remote Podman would did not honor user-specified tags (#7124).
  • Fixed a bug where the podman system service command, when run as a non-root user by Systemd, did not properly handle the Podman pause process and would not restart properly as a result (#7180).
  • Fixed a bug where the --publish flag to podman create, podman run, and podman pod create did not properly handle a host IP of 0.0.0.0 (attempting to bind to literal 0.0.0.0, instead of all IPs on the system) (#7104).
  • Fixed a bug where the podman start --attach command would not print the container's exit code when the command exited due to the container exiting.
  • Fixed a bug where the podman rm command with remote Podman would not remove volumes, even if the --volumes flag was specified (#7128).
  • Fixed a bug where the podman run command with remote Podman and the --rm flag could exit before the container was fully removed.
  • Fixed a bug where the --pod new:... flag to podman run and podman create would create a pod that did not share any namespaces.
  • Fixed a bug where the --preserve-fds flag to podman run and podman exec could close the wrong file descriptors while trying to close user-provided descriptors after passing them into the container.
  • Fixed a bug where default environment variables ($PATH and $TERM) were not set in containers when not provided by the image.
  • Fixed a bug where pod infra containers were not properly unmounted after exiting.
  • Fixed a bug where networks…

This update for conmon, fuse-overlayfs, libcontainers-common, podman fixes the following issues:

podman was updated to v2.0.6 (bsc#1175821)

• install missing systemd units for the new Rest API (bsc#1175957) and a few man-pages that where missing before
• Drop varlink API related bits (in favor of the new API)
• fix install location for zsh completions

• Fixed a bug where running systemd in a container on a cgroups v1 system would fail.
• Fixed a bug where /etc/passwd could be re-created every time a container is restarted if the container's /etc/passwd did not contain an entry for the user the container was started as.
• Fixed a bug where containers without an /etc/passwd file specifying a non-root user would not start.
• Fixed a bug where the --remote flag would sometimes not make remote connections and would instead attempt to run Podman locally.

Update to v2.0.6:

• Features

  • Rootless Podman will now add an entry to /etc/passwd for the user who ran Podman if run with --userns=keep-id.
  • The podman system connection command has been reworked to support multiple connections, and reenabled for use!
  • Podman now has a new global flag, --connection, to specify a connection to a remote Podman API instance.

• Changes

  • Podman's automatic systemd integration (activated by the --systemd=true flag, set by default) will now activate for containers using /usr/local/sbin/init as their command, instead of just /usr/sbin/init and /sbin/init (and any path ending in systemd).
  • Seccomp profiles specified by the --security-opt seccomp=... flag to podman create and podman run will now be honored even if the container was created using --privileged.

• Bugfixes

  • Fixed a bug where the podman play kube would not honor the hostIP field for port forwarding (#5964).
  • Fixed a bug where the podman generate systemd command would panic on an invalid restart policy being specified (#7271).
  • Fixed a bug where the podman images command could take a very long time (several minutes) to complete when a large number of images were present.
  • Fixed a bug where the podman logs command with the --tail flag would not work properly when a large amount of output would be printed ((#7230)[https://github.com//issues/7230]).
  • Fixed a bug where the podman exec command with remote Podman would not return a non-zero exit code when the exec session failed to start (e.g. invoking a non-existent command) (#6893).
  • Fixed a bug where the podman load command with remote Podman would did not honor user-specified tags (#7124).
  • Fixed a bug where the podman system service command, when run as a non-root user by Systemd, did not properly handle the Podman pause process and would not restart properly as a result (#7180).
  • Fixed a bug where the --publish flag to podman create, podman run, and podman pod create did not properly handle a host IP of 0.0.0.0 (attempting to bind to literal 0.0.0.0, instead of all IPs on the system) (#7104).
  • Fixed a bug where the podman start --attach command would not print the container's exit code when the command exited due to the container exiting.
  • Fixed a bug where the podman rm command with remote Podman would not remove volumes, even if the --volumes flag was specified (#7128).
  • Fixed a bug where the podman run command with remote Podman and the --rm flag could exit before the container was fully removed.
  • Fixed a bug where the --pod new:... flag to podman run and podman create would create a pod that did not share any namespaces.
  • Fixed a bug where the --preserve-fds flag to podman run and podman exec could close the wrong file descriptors while trying to close user-provided descriptors after passing them into the container.
  • Fixed a bug where default environment variables ($PATH and $TERM) were not set in containers when not provided by the image.
  • Fixed a bug where pod infra containers were not properly unmounted after exiting.
  • Fixed a bug where networks…

These are all security issues fixed in the podman-3.3.1-2.1 package on the GA media of openSUSE Tumbleweed.

This update for conmon, fuse-overlayfs, libcontainers-common, podman fixes the following issues:

podman was updated to v2.0.6 (bsc#1175821)

• install missing systemd units for the new Rest API (bsc#1175957) and a few man-pages that where missing before
• Drop varlink API related bits (in favor of the new API)
• fix install location for zsh completions

• Fixed a bug where running systemd in a container on a cgroups v1 system would fail.
• Fixed a bug where /etc/passwd could be re-created every time a container is restarted if the container's /etc/passwd did not contain an entry for the user the container was started as.
• Fixed a bug where containers without an /etc/passwd file specifying a non-root user would not start.
• Fixed a bug where the --remote flag would sometimes not make remote connections and would instead attempt to run Podman locally.

Update to v2.0.6:

• Features

  • Rootless Podman will now add an entry to /etc/passwd for the user who ran Podman if run with --userns=keep-id.
  • The podman system connection command has been reworked to support multiple connections, and reenabled for use!
  • Podman now has a new global flag, --connection, to specify a connection to a remote Podman API instance.

• Changes

  • Podman's automatic systemd integration (activated by the --systemd=true flag, set by default) will now activate for containers using /usr/local/sbin/init as their command, instead of just /usr/sbin/init and /sbin/init (and any path ending in systemd).
  • Seccomp profiles specified by the --security-opt seccomp=... flag to podman create and podman run will now be honored even if the container was created using --privileged.

• Bugfixes

  • Fixed a bug where the podman play kube would not honor the hostIP field for port forwarding (#5964).
  • Fixed a bug where the podman generate systemd command would panic on an invalid restart policy being specified (#7271).
  • Fixed a bug where the podman images command could take a very long time (several minutes) to complete when a large number of images were present.
  • Fixed a bug where the podman logs command with the --tail flag would not work properly when a large amount of output would be printed ((#7230)[https://github.com//issues/7230]).
  • Fixed a bug where the podman exec command with remote Podman would not return a non-zero exit code when the exec session failed to start (e.g. invoking a non-existent command) (#6893).
  • Fixed a bug where the podman load command with remote Podman would did not honor user-specified tags (#7124).
  • Fixed a bug where the podman system service command, when run as a non-root user by Systemd, did not properly handle the Podman pause process and would not restart properly as a result (#7180).
  • Fixed a bug where the --publish flag to podman create, podman run, and podman pod create did not properly handle a host IP of 0.0.0.0 (attempting to bind to literal 0.0.0.0, instead of all IPs on the system) (#7104).
  • Fixed a bug where the podman start --attach command would not print the container's exit code when the command exited due to the container exiting.
  • Fixed a bug where the podman rm command with remote Podman would not remove volumes, even if the --volumes flag was specified (#7128).
  • Fixed a bug where the podman run command with remote Podman and the --rm flag could exit before the container was fully removed.
  • Fixed a bug where the --pod new:... flag to podman run and podman create would create a pod that did not share any namespaces.
  • Fixed a bug where the --preserve-fds flag to podman run and podman exec could close the wrong file descriptors while trying to close user-provided descriptors after passing them into the container.
  • Fixed a bug where default environment variables ($PATH and $TERM) were not set in containers when not provided by the image.
  • Fixed a bug where pod infra containers were not properly unmounted after exiting.
  • Fixed a bug where networks…