CVE-2022-2989

An incorrect handling of the supplementary groups in the Podman container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set access permissions and is able to execute a binary code in that container.

An incorrect handling of the supplementary groups in the Podman container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set access permissions and is able to execute a binary code in that container.

An incorrect handling of the supplementary groups in the Podman container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set access permissions and is able to execute a binary code in that container.

Podman manages the entire container ecosystem which includes pods, containers, container images, and container volumes using the libpod library.

Security Fix(es):

A flaw was found in Podman, where containers were started incorrectly with non-empty default permissions. A vulnerability was found in Moby (Docker Engine), where containers were started incorrectly with non-empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs.(CVE-2022-27649)

An incorrect handling of the supplementary groups in the Podman container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set access permissions and is able to execute a binary code in that container.(CVE-2022-2989)

A Time-of-check Time-of-use (TOCTOU) flaw was found in podman. This issue may allow a malicious user to replace a normal file in a volume with a symlink while exporting the volume, allowing for access to arbitrary files on the host file system.(CVE-2023-0778)

If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing for subsequent actions to inject unexpected content into templates.(CVE-2024-24785)

Podman manages the entire container ecosystem which includes pods, containers, container images, and container volumes using the libpod library.

Security Fix(es):

A flaw was found in Podman, where containers were started incorrectly with non-empty default permissions. A vulnerability was found in Moby (Docker Engine), where containers were started incorrectly with non-empty inheritable Linux process capabilities. This flaw allows an attacker with access to programs with inheritable file capabilities to elevate those capabilities to the permitted set when execve(2) runs.(CVE-2022-27649)

An incorrect handling of the supplementary groups in the Podman container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set access permissions and is able to execute a binary code in that container.(CVE-2022-2989)

A Time-of-check Time-of-use (TOCTOU) flaw was found in podman. This issue may allow a malicious user to replace a normal file in a volume with a symlink while exporting the volume, allowing for access to arbitrary files on the host file system.(CVE-2023-0778)

If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing for subsequent actions to inject unexpected content into templates.(CVE-2024-24785)

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

• podman: possible information disclosure and modification (CVE-2022-2989)

• buildah: possible information disclosure and modification (CVE-2022-2990)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• podman creates lock file in /etc/cni/net.d/cni.lock instead of /run/lock/ (BZ#2125644)

• (podman image trust) does not support the new trust type "sigstoreSigned " (BZ#2125645)

• podman kill may deadlock (BZ#2125647)

• Error: runc: exec failed: unable to start container process: open /dev/pts/0: operation not permitted: OCI permission denied [Rocky Linux 8.7] (BZ#2125648)

• containers-common-1-44 is missing RPM-GPG-KEY-redhat-beta [Rocky Linux 8.7] (BZ#2125686)

• ADD Dockerfile reference is not validating HTTP status code [Rocky Linux8-8.7.0] (BZ#2129767)

• Two aardvark-dns instances trying to use the same port on the same interface. [Rocky Linux-8.7.0.z] (netavark) (BZ#2130234)

• containers config.json gets empty after sudden power loss (BZ#2130236)

• PANIC podman API service endpoint handler panic (BZ#2132412)

• Podman container got global IPv6 address unexpectedly even when macvlan network is created for pure IPv4 network (BZ#2133390)

• Skopeo push image to redhat quay with sigstore was failed (BZ#2136406)

• Podman push image to redhat quay with sigstore was failed (BZ#2136433)

• Buildah push image to redhat quay with sigstore was failed (BZ#2136438)

• Two aardvark-dns instances trying to use the same port on the same interface. [Rocky Linux-8.8] (aardvark-dns) (BZ#2137295)

Enhancement(s):

• [RFE]Podman support to perform custom actions on unhealthy containers (BZ#2130911)

• [RFE] python-podman: Podman support to perform custom actions on unhealthy containers (BZ#2132360)

• Podman volume plugin timeout should be configurable (BZ#2132992)

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

• golang: net/http: improper sanitization of Transfer-Encoding header (CVE-2022-1705)

• golang: go/parser: stack exhaustion in all Parse* functions (CVE-2022-1962)

• golang: net/http: handle server errors after sending GOAWAY (CVE-2022-27664)

• golang: encoding/xml: stack exhaustion in Decoder.Skip (CVE-2022-28131)

• golang: io/fs: stack exhaustion in Glob (CVE-2022-30630)

• golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)

• golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632)

• golang: encoding/xml: stack exhaustion in Unmarshal (CVE-2022-30633)

• golang: encoding/gob: stack exhaustion in Decoder.Decode (CVE-2022-30635)

• golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working (CVE-2022-32148)

• golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests (CVE-2022-41717)

• podman: symlink exchange attack in podman export volume (CVE-2023-0778)

• podman: possible information disclosure and modification (CVE-2022-2989)

• golang: math/big: decoding big.Float and big.Rat types can panic if the encoded message is too short, potentially allowing a denial of service (CVE-2022-32189)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.8 Release Notes linked from the References section.

An incorrect handling of the supplementary groups in the Podman container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set access permissions and is able to execute a binary code in that container.

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

• podman: possible information disclosure and modification (CVE-2022-2989)
• buildah: possible information disclosure and modification (CVE-2022-2990)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• podman creates lock file in /etc/cni/net.d/cni.lock instead of /run/lock/ (BZ#2125644)
• (podman image trust) does not support the new trust type "sigstoreSigned " (BZ#2125645)
• podman kill may deadlock (BZ#2125647)
• Error: runc: exec failed: unable to start container process: open /dev/pts/0: operation not permitted: OCI permission denied [AlmaLinux 8.7] (BZ#2125648)
• containers-common-1-44 is missing RPM-GPG-KEY-AlmaLinux-beta [AlmaLinux 8.7] (BZ#2125686)
• ADD Dockerfile reference is not validating HTTP status code [rhel8-8.7.0] (BZ#2129767)
• Two aardvark-dns instances trying to use the same port on the same interface. [rhel-8.7.0.z] (netavark) (BZ#2130234)
• containers config.json gets empty after sudden power loss (BZ#2130236)
• PANIC podman API service endpoint handler panic (BZ#2132412)
• Podman container got global IPv6 address unexpectedly even when macvlan network is created for pure IPv4 network (BZ#2133390)
• Skopeo push image to AlmaLinux quay with sigstore was failed (BZ#2136406)
• Podman push image to AlmaLinux quay with sigstore was failed (BZ#2136433)
• Buildah push image to AlmaLinux quay with sigstore was failed (BZ#2136438)
• Two aardvark-dns instances trying to use the same port on the same interface. [rhel-8.8] (aardvark-dns) (BZ#2137295)

Enhancement(s):

• [RFE]Podman support to perform custom actions on unhealthy containers (BZ#2130911)
• [RFE] python-podman: Podman support to perform custom actions on unhealthy containers (BZ#2132360)
• Podman volume plugin timeout should be configurable (BZ#2132992)

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images.

Security Fix(es):

• containers/storage: DoS via malicious image (CVE-2021-20291)
• golang: net: lookup functions may return invalid host names (CVE-2021-33195)
• golang: net/http/httputil: ReverseProxy forwards connection headers if first one is empty (CVE-2021-33197)
• golang: math/big.Rat: may cause a panic or an unrecoverable fatal error if passed inputs with very large exponents (CVE-2021-33198)
• golang: crash in a golang.org/x/crypto/ssh server (CVE-2022-27191)
• podman: possible information disclosure and modification (CVE-2022-2989)
• buildah: possible information disclosure and modification (CVE-2022-2990)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.

Security Fix(es):

• podman: possible information disclosure and modification (CVE-2022-2989)
• buildah: possible information disclosure and modification (CVE-2022-2990)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

• (podman image trust) does not support the new trust type "sigstoreSigned " (BZ#2120436)
• dnf-update broken for podman/catatonit (BZ#2123319)
• podman creates lock file in /etc/cni/net.d/cni.lock instead of /run/lock/ (BZ#2123905)
• podman kill may deadlock [AlmaLinux 9.1] (BZ#2124716)
• containers config.json gets empty after sudden power loss (BZ#2136278)
• PANIC podman API service endpoint handler panic (BZ#2136287)

Enhancement(s):

• Podman volume plugin timeout should be configurable [almalinux-9.1.0 Z] (BZ#2124676)
• [RFE]Podman support to perform custom actions on unhealthy containers (BZ#2136281)

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

• golang: net/http: improper sanitization of Transfer-Encoding header (CVE-2022-1705)
• golang: go/parser: stack exhaustion in all Parse* functions (CVE-2022-1962)
• golang: net/http: handle server errors after sending GOAWAY (CVE-2022-27664)
• golang: encoding/xml: stack exhaustion in Decoder.Skip (CVE-2022-28131)
• golang: io/fs: stack exhaustion in Glob (CVE-2022-30630)
• golang: compress/gzip: stack exhaustion in Reader.Read (CVE-2022-30631)
• golang: path/filepath: stack exhaustion in Glob (CVE-2022-30632)
• golang: encoding/xml: stack exhaustion in Unmarshal (CVE-2022-30633)
• golang: encoding/gob: stack exhaustion in Decoder.Decode (CVE-2022-30635)
• golang: net/http/httputil: NewSingleHostReverseProxy - omit X-Forwarded-For not working (CVE-2022-32148)
• golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests (CVE-2022-41717)
• podman: symlink exchange attack in podman export volume (CVE-2023-0778)
• podman: possible information disclosure and modification (CVE-2022-2989)
• golang: math/big: decoding big.Float and big.Rat types can panic if the encoded message is too short, potentially allowing a denial of service (CVE-2022-32189)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

An incorrect handling of the supplementary groups in the Podman container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set access permissions and is able to execute a binary code in that container.

Information disclosure flaw was found in Buildah (CVE-2021-3602) podman allows forwarding hosts ports to vm from within vm (CVE-2021-4024) Allows use "../" separators in containernetworking/cni to reference binaries such as 'reboot' in network configuration (CVE-2021-20206) github.com/containers/storage ddos via crafted tar file (CVE-2021-20291) buildah improper checking of X.509 certificate (CVE-2021-34558) buildah improper Content-Type checking (CVE-2021-41190) podman privilege escalation (CVE-2022-1227) podman incorrect handling of the supplementary groups (CVE-2022-2989) buildah incorrect handling of the supplementary groups (CVE-2022-2990) skopeo/podman Denial of Service through unbounded cardinality, and potential memory exhaustion (CVE-2022-21698) buildah/podman AddHostKey denail of service (CVE-2022-27191) podman inheritable file capabilities (CVE-2022-27649) buildah inheritable file capabilities (CVE-2022-27651)

These are all security issues fixed in the podman-4.3.1-1.1 package on the GA media of openSUSE Tumbleweed.

This update for podman fixes the following issues:

• CVE-2022-2989: Fixed possible information disclosure and modification (bsc#1202809).

This update for podman fixes the following issues:

• CVE-2022-2989: Fixed possible information disclosure and modification (bsc#1202809).

This update for podman fixes the following issues:

podman was updated to version 4.3.1:

4.3.1:

• Bugfixes

• Fixed a deadlock between the podman ps and podman container inspect commands

• Misc

• Updated the containers/image library to v5.23.1

4.3.0:

• Features

• A new command, podman generate spec, has been added, which creates a JSON struct based on a given container that can be used with the Podman REST API to create containers.
• A new command, podman update, has been added,which makes changes to the resource limits of existing containers. Please note that these changes do not persist if the container is restarted
• A new command, podman kube down, has been added, which removes pods and containers created by the given Kubernetes YAML (functionality is identical to podman kube play --down, but it now has its own command).
• The podman kube play command now supports Kubernetes secrets using Podman's secrets backend.
• Systemd-managed pods created by the podman kube play command now integrate with sd-notify, using the io.containers.sdnotify annotation (or io.containers.sdnotify/$name for specific containers).
• Systemd-managed pods created by podman kube play can now be auto-updated, using the io.containers.auto-update annotation (or io.containers.auto-update/$name for specific containers).
• The podman kube play command can now read YAML from URLs, e.g. podman kube play https://example.com/demo.yml
• The podman kube play command now supports the emptyDir volume type
• The podman kube play command now supports the HostUsers field in the pod spec.
• The podman play kube command now supports binaryData in ConfigMaps.
• The podman pod create command can now set additional resource limits for pods using the new --memory-swap, --cpuset-mems, --device-read-bps, --device-write-bps, --blkio-weight, --blkio-weight-device, and --cpu-shares options.
• The podman machine init command now supports a new option, --username, to set the username that will be used to connect to the VM as a non-root user
• The podman volume create command's -o timeout= option can now set a timeout of 0, indicating volume plugin operations will never time out.
• Added support for a new volume driver, image, which allows volumes to be created that are backed by images.
• The podman run and podman create commands support a new option, --env-merge, allowing environment variables to be specified relative to other environment variables in the image (e.g. podman run --env-merge 'PATH=$PATH:/my/app' ...)
• The podman run and podman create commands support a new option, --on-failure, to allow action to be taken when a container fails health checks, with the following supported actions: none (take no action, the default), kill (kill the container), restart (restart the container), and stop (stop the container).
• The --keep-id option to podman create and podman run now supports new options, uid and gid, to set the UID and GID of the user in the container that will be mapped to the user running Podman (e.g. --userns=keep-id:uid=11 will made the user running Podman to UID 11 in the container)
• The podman generate systemd command now supports a new option, --env/-e, to set environment variables in the generated unit file
• The podman pause and podman unpause commands now support the --latest, --cidfile, and --filter options.
• The podman restart command now supports the --cidfile and --filter options.
• The podman rm command now supports the --filter option to select which containers will be removed.
• The podman rmi command now supports a new option, --no-prune, to prevent the removal of dangling parents of removed images.
• The --dns-opt option to podman create, podman run, and podman pod create has received a new alias, --dns-option, to improve Docker compatibility.
• The podman command now features a new global flag,…

This update for podman fixes the following issues:

podman was updated to version 4.3.1:

4.3.1:

• Bugfixes

• Fixed a deadlock between the podman ps and podman container inspect commands

• Misc

• Updated the containers/image library to v5.23.1

4.3.0:

• Features

• A new command, podman generate spec, has been added, which creates a JSON struct based on a given container that can be used with the Podman REST API to create containers.
• A new command, podman update, has been added,which makes changes to the resource limits of existing containers. Please note that these changes do not persist if the container is restarted
• A new command, podman kube down, has been added, which removes pods and containers created by the given Kubernetes YAML (functionality is identical to podman kube play --down, but it now has its own command).
• The podman kube play command now supports Kubernetes secrets using Podman's secrets backend.
• Systemd-managed pods created by the podman kube play command now integrate with sd-notify, using the io.containers.sdnotify annotation (or io.containers.sdnotify/$name for specific containers).
• Systemd-managed pods created by podman kube play can now be auto-updated, using the io.containers.auto-update annotation (or io.containers.auto-update/$name for specific containers).
• The podman kube play command can now read YAML from URLs, e.g. podman kube play https://example.com/demo.yml
• The podman kube play command now supports the emptyDir volume type
• The podman kube play command now supports the HostUsers field in the pod spec.
• The podman play kube command now supports binaryData in ConfigMaps.
• The podman pod create command can now set additional resource limits for pods using the new --memory-swap, --cpuset-mems, --device-read-bps, --device-write-bps, --blkio-weight, --blkio-weight-device, and --cpu-shares options.
• The podman machine init command now supports a new option, --username, to set the username that will be used to connect to the VM as a non-root user
• The podman volume create command's -o timeout= option can now set a timeout of 0, indicating volume plugin operations will never time out.
• Added support for a new volume driver, image, which allows volumes to be created that are backed by images.
• The podman run and podman create commands support a new option, --env-merge, allowing environment variables to be specified relative to other environment variables in the image (e.g. podman run --env-merge 'PATH=$PATH:/my/app' ...)
• The podman run and podman create commands support a new option, --on-failure, to allow action to be taken when a container fails health checks, with the following supported actions: none (take no action, the default), kill (kill the container), restart (restart the container), and stop (stop the container).
• The --keep-id option to podman create and podman run now supports new options, uid and gid, to set the UID and GID of the user in the container that will be mapped to the user running Podman (e.g. --userns=keep-id:uid=11 will made the user running Podman to UID 11 in the container)
• The podman generate systemd command now supports a new option, --env/-e, to set environment variables in the generated unit file
• The podman pause and podman unpause commands now support the --latest, --cidfile, and --filter options.
• The podman restart command now supports the --cidfile and --filter options.
• The podman rm command now supports the --filter option to select which containers will be removed.
• The podman rmi command now supports a new option, --no-prune, to prevent the removal of dangling parents of removed images.
• The --dns-opt option to podman create, podman run, and podman pod create has received a new alias, --dns-option, to improve Docker compatibility.
• The podman command now features a new global flag,…

It was discovered that Podman incorrectly handled certain supplementary groups. An attacker could possibly use this issue to expose sensitive information or execute binary code.