CVE-2021-20206

An improper limitation of path name flaw was found in containernetworking/cni in versions before 0.8.1. When specifying the plugin to load in the 'type' field in the network configuration, it is possible to use special elements such as "../" separators to reference binaries elsewhere on the system. This flaw allows an attacker to execute other existing binaries other than the cni plugins/types, such as 'reboot'. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

An improper limitation of path name flaw was found in containernetworking/cni in versions before 0.8.1. When specifying the plugin to load in the 'type' field in the network configuration, it is possible to use special elements such as "../" separators to reference binaries elsewhere on the system. This flaw allows an attacker to execute other existing binaries other than the cni plugins/types, such as 'reboot'. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

An improper limitation of path name flaw was found in containernetworking/cni in versions before 0.8.1. When specifying the plugin to load in the 'type' field in the network configuration, it is possible to use special elements such as "../" separators to reference binaries elsewhere on the system. This flaw allows an attacker to execute other existing binaries other than the cni plugins/types, such as 'reboot'. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

Specific Go Packages Affected

github.com/containernetworking/cni/pkg/invoke

An improper limitation of path name flaw was found in containernetworking/cni in versions before 0.8.1. When specifying the plugin to load in the 'type' field in the network configuration, it is possible to use special elements such as "../" separators to reference binaries elsewhere on the system. This flaw allows an attacker to execute other existing binaries other than the cni plugins/types, such as 'reboot'. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.

The FindInPath function is vulnerable to directory traversal attacks, potentially permitting attackers to execute arbitrary binaries.

This function does not sanitize its plugin parameter, so parameter names containing "../" or other such elements may reference arbitrary locations on the filesystem.

Information disclosure flaw was found in Buildah (CVE-2021-3602) podman allows forwarding hosts ports to vm from within vm (CVE-2021-4024) Allows use "../" separators in containernetworking/cni to reference binaries such as 'reboot' in network configuration (CVE-2021-20206) github.com/containers/storage ddos via crafted tar file (CVE-2021-20291) buildah improper checking of X.509 certificate (CVE-2021-34558) buildah improper Content-Type checking (CVE-2021-41190) podman privilege escalation (CVE-2022-1227) podman incorrect handling of the supplementary groups (CVE-2022-2989) buildah incorrect handling of the supplementary groups (CVE-2022-2990) skopeo/podman Denial of Service through unbounded cardinality, and potential memory exhaustion (CVE-2022-21698) buildah/podman AddHostKey denail of service (CVE-2022-27191) podman inheritable file capabilities (CVE-2022-27649) buildah inheritable file capabilities (CVE-2022-27651)

This update for buildah fixes the following issues:

buildah was updated to version 1.23.1:

Update to version 1.22.3:

• Update dependencies
• Post-branch commit
• Accept repositories on login/logout

Update to version 1.22.0:

• c/image, c/storage, c/common vendor before Podman 3.3 release
• Proposed patch for 3399 (shadowutils)
• Fix handling of --restore shadow-utils
• runtime-flag (debug) test: handle old & new runc
• Allow dst and destination for target in secret mounts
• Multi-arch: Always push updated version-tagged img
• imagebuildah.stageExecutor.prepare(): remove pseudonym check
• refine dangling filter
• Chown with environment variables not set should fail
• Just restore protections of shadow-utils
• Remove specific kernel version number requirement from install.md
• Multi-arch image workflow: Make steps generic
• chroot: fix environment value leakage to intermediate processes
• Update nix pin with make nixpkgs
• buildah source - create and manage source images
• Update cirrus-cron notification GH workflow
• Reuse code from containers/common/pkg/parse
• Cirrus: Freshen VM images
• Fix excludes exception begining with / or ./
• Fix syntax for --manifest example
• vendor containers/common@main
• Cirrus: Drop dependence on fedora-minimal
• Adjust conformance-test error-message regex
• Workaround appearance of differing debug messages
• Cirrus: Install docker from package cache
• Switch rusagelogfile to use options.Out
• Turn stdio back to blocking when command finishes
• Add support for default network creation
• Cirrus: Updates for master->main rename
• Change references from master to main
• Add --env and --workingdir flags to run command
• [CI:DOCS] buildah bud: spelling --ignore-file requires parameter
• [CI:DOCS] push/pull: clarify supported transports
• Remove unused function arguments
• Create mountOptions for mount command flags
• Extract version command implementation to function
• Add --json flags to mount and version commands
• copier.Put(): set xattrs after ownership
• buildah add/copy: spelling
• buildah copy and buildah add should support .containerignore
• Remove unused util.StartsWithValidTransport
• Fix documentation of the --format option of buildah push
• Don't use alltransports.ParseImageName with known transports
• man pages: clarify rmi removes dangling parents
• [CI:DOCS] Fix links to c/image master branch
• imagebuildah: use the specified logger for logging preprocessing warnings
• Fix copy into workdir for a single file
• Fix docs links due to branch rename
• Update nix pin with make nixpkgs
• fix(docs): typo
• Move to v1.22.0-dev
• Fix handling of auth.json file while in a user namespace
• Add rusage-logfile flag to optionally send rusage to a file
• imagebuildah: redo step logging
• Add volumes to make running buildah within a container easier
• Add and use a 'copy' helper instead of podman load/save
• Bump github.com/containers/common from 0.38.4 to 0.39.0
• containerImageRef/containerImageSource: don't buffer uncompressed layers
• containerImageRef(): squashed images have no parent images
• Sync. workflow across skopeo, buildah, and podman
• Bump github.com/containers/storage from 1.31.1 to 1.31.2
• Bump github.com/opencontainers/runc from 1.0.0-rc94 to 1.0.0-rc95
• Bump to v1.21.1-dev [NO TESTS NEEDED]

These are all security issues fixed in the buildah-1.23.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the podman-4.2.0-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the cni-1.0.1-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the cni-plugins-1.1.1-2.1 package on the GA media of openSUSE Tumbleweed.

This update for buildah fixes the following issues:

buildah was updated to version 1.23.1:

Update to version 1.22.3:

• Update dependencies
• Post-branch commit
• Accept repositories on login/logout

Update to version 1.22.0:

• c/image, c/storage, c/common vendor before Podman 3.3 release
• Proposed patch for 3399 (shadowutils)
• Fix handling of --restore shadow-utils
• runtime-flag (debug) test: handle old & new runc
• Allow dst and destination for target in secret mounts
• Multi-arch: Always push updated version-tagged img
• imagebuildah.stageExecutor.prepare(): remove pseudonym check
• refine dangling filter
• Chown with environment variables not set should fail
• Just restore protections of shadow-utils
• Remove specific kernel version number requirement from install.md
• Multi-arch image workflow: Make steps generic
• chroot: fix environment value leakage to intermediate processes
• Update nix pin with make nixpkgs
• buildah source - create and manage source images
• Update cirrus-cron notification GH workflow
• Reuse code from containers/common/pkg/parse
• Cirrus: Freshen VM images
• Fix excludes exception begining with / or ./
• Fix syntax for --manifest example
• vendor containers/common@main
• Cirrus: Drop dependence on fedora-minimal
• Adjust conformance-test error-message regex
• Workaround appearance of differing debug messages
• Cirrus: Install docker from package cache
• Switch rusagelogfile to use options.Out
• Turn stdio back to blocking when command finishes
• Add support for default network creation
• Cirrus: Updates for master->main rename
• Change references from master to main
• Add --env and --workingdir flags to run command
• [CI:DOCS] buildah bud: spelling --ignore-file requires parameter
• [CI:DOCS] push/pull: clarify supported transports
• Remove unused function arguments
• Create mountOptions for mount command flags
• Extract version command implementation to function
• Add --json flags to mount and version commands
• copier.Put(): set xattrs after ownership
• buildah add/copy: spelling
• buildah copy and buildah add should support .containerignore
• Remove unused util.StartsWithValidTransport
• Fix documentation of the --format option of buildah push
• Don't use alltransports.ParseImageName with known transports
• man pages: clarify rmi removes dangling parents
• [CI:DOCS] Fix links to c/image master branch
• imagebuildah: use the specified logger for logging preprocessing warnings
• Fix copy into workdir for a single file
• Fix docs links due to branch rename
• Update nix pin with make nixpkgs
• fix(docs): typo
• Move to v1.22.0-dev
• Fix handling of auth.json file while in a user namespace
• Add rusage-logfile flag to optionally send rusage to a file
• imagebuildah: redo step logging
• Add volumes to make running buildah within a container easier
• Add and use a 'copy' helper instead of podman load/save
• Bump github.com/containers/common from 0.38.4 to 0.39.0
• containerImageRef/containerImageSource: don't buffer uncompressed layers
• containerImageRef(): squashed images have no parent images
• Sync. workflow across skopeo, buildah, and podman
• Bump github.com/containers/storage from 1.31.1 to 1.31.2
• Bump github.com/opencontainers/runc from 1.0.0-rc94 to 1.0.0-rc95
• Bump to v1.21.1-dev [NO TESTS NEEDED]

This update for buildah fixes the following issues:

• Updated to version 1.26.0:
  • CVE-2022-27651: Fixed an issue where containers were incorrectly started with non-empty inheritable Linux process capabilities (bsc#1197870).
  • CVE-2021-20206: Fixed an issue in libcni that could allow an attacker to execute arbitrary binaries on the host (bsc#1181961).
  • CVE-2020-10696: Fixed an issue that could lead to files being overwritten during the image building process (bsc#1167864).

This update for buildah fixes the following issues:

Buildah was updated to version 1.27.1:

• CVE-2021-20206: Fixed an issue in libcni that could allow an attacker to execute arbitrary binaries on the host (bsc#1181961).
• CVE-2020-10696: Fixed an issue that could lead to files being overwritten during the image building process (bsc#1167864).
• CVE-2022-2990: Fixed a possible information disclosure and modification (bsc#1202812).

This update for buildah fixes the following issues:

• CVE-2021-20206: Fixed an issue in libcni that could allow an attacker to execute arbitrary binaries on the host (bsc#1181961).
• CVE-2020-10696: Fixed an issue that could lead to files being overwritten during the image building process (bsc#1167864).
• CVE-2022-2990: Fixed possible information disclosure and modification / bsc#1202812

Buildah was updated to version 1.27.1:

• run: add container gid to additional groups

• Add fix for CVE-2022-2990 / bsc#1202812

Update to version 1.27.0:

• Don't try to call runLabelStdioPipes if spec.Linux is not set
• build: support filtering cache by duration using --cache-ttl
• build: support building from commit when using git repo as build context
• build: clean up git repos correctly when using subdirs
• integration tests: quote '?' in shell scripts
• test: manifest inspect should have OCIv1 annotation
• vendor: bump to c/common@87fab4b7019a
• Failure to determine a file or directory should print an error
• refactor: remove unused CommitOptions from generateBuildOutput
• stage_executor: generate output for cases with no commit
• stage_executor, commit: output only if last stage in build
• Use errors.Is() instead of os.Is{Not,}Exist
• Minor test tweak for podman-remote compatibility
• Cirrus: Use the latest imgts container
• imagebuildah: complain about the right Dockerfile
• tests: don't try to wrap nil errors
• cmd/buildah.commitCmd: don't shadow 'err'
• cmd/buildah.pullCmd: complain about DecryptConfig/EncryptConfig
• Fix a copy/paste error message
• Fix a typo in an error message
• build,cache: support pulling/pushing cache layers to/from remote sources
• Update vendor of containers/(common, storage, image)
• Rename chroot/run.go to chroot/run_linux.go
• Don't bother telling codespell to skip files that don't exist
• Set user namespace defaults correctly for the library
• imagebuildah: optimize cache hits for COPY and ADD instructions
• Cirrus: Update VM images w/ updated bats
• docs, run: show SELinux label flag for cache and bind mounts
• imagebuildah, build: remove undefined concurrent writes
• bump github.com/opencontainers/runtime-tools
• Add FreeBSD support for 'buildah info'
• Vendor in latest containers/(storage, common, image)
• Add freebsd cross build targets
• Make the jail package build on 32bit platforms
• Cirrus: Ensure the build-push VM image is labeled
• GHA: Fix dynamic script filename
• Vendor in containers/(common, storage, image)
• Run codespell
• Remove import of github.com/pkg/errors
• Avoid using cgo in pkg/jail
• Rename footypes to fooTypes for naming consistency
• Move cleanupTempVolumes and cleanupRunMounts to run_common.go
• Make the various run mounts work for FreeBSD
• Move get{Bind,Tmpfs,Secret,SSH}Mount to run_common.go
• Move runSetupRunMounts to run_common.go
• Move cleanableDestinationListFromMounts to run_common.go
• Make setupMounts and runSetupBuiltinVolumes work on FreeBSD
• Move setupMounts and runSetupBuiltinVolumes to run_common.go
• Tidy up - runMakeStdioPipe can't be shared with linux
• Move runAcceptTerminal to run_common.go
• Move stdio copying utilities to run_common.go
• Move runUsingRuntime and runCollectOutput to run_common.go
• Move fileCloser, waitForSync and contains to run_common.go
• Move checkAndOverrideIsolationOptions to run_common.go
• Move DefaultNamespaceOptions to run_common.go
• Move getNetworkInterface to run_common.go
• Move configureEnvironment to run_common.go
• Don't crash in configureUIDGID if Process.Capabilities is nil
• Move configureUIDGID to run_common.go
• Move runLookupPath to run_common.go
• Move setupTerminal to run_common.go
• Move etc file generation utilities to run_common.go
• Add run support for FreeBSD
• Add a simple FreeBSD jail library
• Add FreeBSD support to pkg/chrootuser
• Sync call signature for RunUsingChroot with chroot/run.go
• test: verify feature to resolve basename with args
• vendor: bump openshift/imagebuilder to master@4151e43…

This update for cni fixes the following issues:

• CVE-2021-20206: Fixed arbitrary path injection via type field in CNI configuration (bsc#1181961).

This update for cni-plugins fixes the following issues:

• CVE-2021-20206: Fixed arbitrary path injection via type field in CNI configuration (bsc#1181961).

This update for cni fixes the following issues:

• CVE-2021-20206: Fixed arbitrary path injection via type field in CNI configuration (bsc#1181961).

This update for cni-plugins fixes the following issues:

• CVE-2021-20206: Fixed arbitrary path injection via type field in CNI configuration (bsc#1181961).

This update for podman fixes the following issues:

podman was updated to version 4.3.1:

4.3.1:

• Bugfixes

• Fixed a deadlock between the podman ps and podman container inspect commands

• Misc

• Updated the containers/image library to v5.23.1

4.3.0:

• Features

• A new command, podman generate spec, has been added, which creates a JSON struct based on a given container that can be used with the Podman REST API to create containers.
• A new command, podman update, has been added,which makes changes to the resource limits of existing containers. Please note that these changes do not persist if the container is restarted
• A new command, podman kube down, has been added, which removes pods and containers created by the given Kubernetes YAML (functionality is identical to podman kube play --down, but it now has its own command).
• The podman kube play command now supports Kubernetes secrets using Podman's secrets backend.
• Systemd-managed pods created by the podman kube play command now integrate with sd-notify, using the io.containers.sdnotify annotation (or io.containers.sdnotify/$name for specific containers).
• Systemd-managed pods created by podman kube play can now be auto-updated, using the io.containers.auto-update annotation (or io.containers.auto-update/$name for specific containers).
• The podman kube play command can now read YAML from URLs, e.g. podman kube play https://example.com/demo.yml
• The podman kube play command now supports the emptyDir volume type
• The podman kube play command now supports the HostUsers field in the pod spec.
• The podman play kube command now supports binaryData in ConfigMaps.
• The podman pod create command can now set additional resource limits for pods using the new --memory-swap, --cpuset-mems, --device-read-bps, --device-write-bps, --blkio-weight, --blkio-weight-device, and --cpu-shares options.
• The podman machine init command now supports a new option, --username, to set the username that will be used to connect to the VM as a non-root user
• The podman volume create command's -o timeout= option can now set a timeout of 0, indicating volume plugin operations will never time out.
• Added support for a new volume driver, image, which allows volumes to be created that are backed by images.
• The podman run and podman create commands support a new option, --env-merge, allowing environment variables to be specified relative to other environment variables in the image (e.g. podman run --env-merge 'PATH=$PATH:/my/app' ...)
• The podman run and podman create commands support a new option, --on-failure, to allow action to be taken when a container fails health checks, with the following supported actions: none (take no action, the default), kill (kill the container), restart (restart the container), and stop (stop the container).
• The --keep-id option to podman create and podman run now supports new options, uid and gid, to set the UID and GID of the user in the container that will be mapped to the user running Podman (e.g. --userns=keep-id:uid=11 will made the user running Podman to UID 11 in the container)
• The podman generate systemd command now supports a new option, --env/-e, to set environment variables in the generated unit file
• The podman pause and podman unpause commands now support the --latest, --cidfile, and --filter options.
• The podman restart command now supports the --cidfile and --filter options.
• The podman rm command now supports the --filter option to select which containers will be removed.
• The podman rmi command now supports a new option, --no-prune, to prevent the removal of dangling parents of removed images.
• The --dns-opt option to podman create, podman run, and podman pod create has received a new alias, --dns-option, to improve Docker compatibility.
• The podman command now features a new global flag,…

This update for podman fixes the following issues:

podman was updated to version 4.3.1:

4.3.1:

• Bugfixes

• Fixed a deadlock between the podman ps and podman container inspect commands

• Misc

• Updated the containers/image library to v5.23.1

4.3.0:

• Features

• A new command, podman generate spec, has been added, which creates a JSON struct based on a given container that can be used with the Podman REST API to create containers.
• A new command, podman update, has been added,which makes changes to the resource limits of existing containers. Please note that these changes do not persist if the container is restarted
• A new command, podman kube down, has been added, which removes pods and containers created by the given Kubernetes YAML (functionality is identical to podman kube play --down, but it now has its own command).
• The podman kube play command now supports Kubernetes secrets using Podman's secrets backend.
• Systemd-managed pods created by the podman kube play command now integrate with sd-notify, using the io.containers.sdnotify annotation (or io.containers.sdnotify/$name for specific containers).
• Systemd-managed pods created by podman kube play can now be auto-updated, using the io.containers.auto-update annotation (or io.containers.auto-update/$name for specific containers).
• The podman kube play command can now read YAML from URLs, e.g. podman kube play https://example.com/demo.yml
• The podman kube play command now supports the emptyDir volume type
• The podman kube play command now supports the HostUsers field in the pod spec.
• The podman play kube command now supports binaryData in ConfigMaps.
• The podman pod create command can now set additional resource limits for pods using the new --memory-swap, --cpuset-mems, --device-read-bps, --device-write-bps, --blkio-weight, --blkio-weight-device, and --cpu-shares options.
• The podman machine init command now supports a new option, --username, to set the username that will be used to connect to the VM as a non-root user
• The podman volume create command's -o timeout= option can now set a timeout of 0, indicating volume plugin operations will never time out.
• Added support for a new volume driver, image, which allows volumes to be created that are backed by images.
• The podman run and podman create commands support a new option, --env-merge, allowing environment variables to be specified relative to other environment variables in the image (e.g. podman run --env-merge 'PATH=$PATH:/my/app' ...)
• The podman run and podman create commands support a new option, --on-failure, to allow action to be taken when a container fails health checks, with the following supported actions: none (take no action, the default), kill (kill the container), restart (restart the container), and stop (stop the container).
• The --keep-id option to podman create and podman run now supports new options, uid and gid, to set the UID and GID of the user in the container that will be mapped to the user running Podman (e.g. --userns=keep-id:uid=11 will made the user running Podman to UID 11 in the container)
• The podman generate systemd command now supports a new option, --env/-e, to set environment variables in the generated unit file
• The podman pause and podman unpause commands now support the --latest, --cidfile, and --filter options.
• The podman restart command now supports the --cidfile and --filter options.
• The podman rm command now supports the --filter option to select which containers will be removed.
• The podman rmi command now supports a new option, --no-prune, to prevent the removal of dangling parents of removed images.
• The --dns-opt option to podman create, podman run, and podman pod create has received a new alias, --dns-option, to improve Docker compatibility.
• The podman command now features a new global flag,…