CVE-2024-9675

A vulnerability was found in Buildah. Cache mounts do not properly validate that user-specified paths for the cache are within our cache directory, allowing a RUN instruction in a Container file to mount an arbitrary directory from the host (read/write) into the container as long as those files can be accessed by the user running Buildah.

A vulnerability was found in Buildah. Cache mounts do not properly validate that user-specified paths for the cache are within our cache directory, allowing a RUN instruction in a Container file to mount an arbitrary directory from the host (read/write) into the container as long as those files can be accessed by the user running Buildah.

A vulnerability was found in Buildah. Cache mounts do not properly validate that user-specified paths for the cache are within our cache directory, allowing a RUN instruction in a Container file to mount an arbitrary directory from the host (read/write) into the container as long as those files can be accessed by the user running Buildah.

A vulnerability was found in Buildah. Cache mounts do not properly validate that user-specified paths for the cache are within our cache directory, allowing a RUN instruction in a Container file to mount an arbitrary directory from the host (read/write) into the container as long as those files can be accessed by the user running Buildah.

A vulnerability was found in Buildah. Cache mounts do not properly validate that user-specified paths for the cache are within our cache directory, allowing a RUN instruction in a Container file to mount an arbitrary directory from the host (read/write) into the container as long as those files can be accessed by the user running Buildah.

A vulnerability was found in Buildah. Cache mounts do not properly validate that user-specified paths for the cache are within our cache directory, allowing a RUN instruction in a Container file to mount an arbitrary directory from the host (read/write) into the container as long as those files can be accessed by the user running Buildah.

A vulnerability was found in Buildah. Cache mounts do not properly validate that user-specified paths for the cache are within our cache directory, allowing a RUN instruction in a Container file to mount an arbitrary directory from the host (read/write) into the container as long as those files can be accessed by the user running Buildah.

A vulnerability was found in Buildah. Cache mounts do not properly validate that user-specified paths for the cache are within our cache directory, allowing a RUN instruction in a Container file to mount an arbitrary directory from the host (read/write) into the container as long as those files can be accessed by the user running Buildah.

Podman manages the entire container ecosystem which includes pods, containers, container images, and container volumes using the libpod library.

Security Fix(es):

Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both.(CVE-2019-9514)

Uncontrolled recursion in the Parse functions in go/parser before Go 1.17.12 and Go 1.18.4 allow an attacker to cause a panic due to stack exhaustion via deeply nested types or declarations.(CVE-2022-1962)

Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy forwards a parameter with an unparsable value. After fix, ReverseProxy sanitizes the query parameters in the forwarded query when the outbound request's Form field is set after the ReverseProxy. Director function returns, indicating that the proxy has parsed the query parameters. Proxies which do not parse query parameters continue to forward the original query parameters unchanged.(CVE-2022-2880)

A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go before 1.17.13 and 1.18.5, potentially allowing a denial of service.(CVE-2022-32189)

Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed regexp representation is linear in the size of the input, but in some cases the constant factor can be as high as 40,000, making relatively small regexps consume much larger amounts of memory. After fix, each regexp being parsed is limited to a 256 MB memory footprint. Regular expressions whose representation would use more space than that are rejected. Normal use of regular expressions is unaffected.(CVE-2022-41715)

The net/http HTTP/1.1 client mishandled the case where a server responds to a request with an "Expect: 100-continue" header with a non-informational (200 or higher) status. This mishandling could leave a client connection in an invalid state, where the next request sent on the connection will fail. An attacker sending a request to a net/http/httputil.ReverseProxy proxy can exploit this mishandling to cause a denial of service by sending "Expect: 100-continue" requests which elicit a non-informational response from the backend. Each such request leaves the proxy with an invalid connection, and causes one subsequent request using that connection to fail.(CVE-2024-24791)

gorilla/schema converts structs to and from form values. Prior to version 1.4.1 Running schema.Decoder.Decode() on a struct that has a field of type []struct{...} opens it up to malicious attacks regarding memory allocations, taking advantage of the sparse slice functionality. Any use of schema.Decoder.Decode() on a struct with arrays of other structs could be vulnerable to this memory exhaustion vulnerability. Version 1.4.1 contains a patch for the issue.(CVE-2024-37298)

go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability, CVE-2024-6104, was fixed in go-retryablehttp 0.7.7.(CVE-2024-6104)

A flaw was found in Go. When FIPS mode is enabled on a system, container runtimes may incorrectly handle certain file paths due to improper validation in the containers/common Go library. This flaw allows an attacker to exploit symbolic links and trick the system into mounting sensitive host directories inside a container. This issue also allows attackers to access critical host files, bypassing the intended…

Podman manages the entire container ecosystem which includes pods, containers, container images, and container volumes using the libpod library.

Security Fix(es):

Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both.(CVE-2019-9514)

Uncontrolled recursion in the Parse functions in go/parser before Go 1.17.12 and Go 1.18.4 allow an attacker to cause a panic due to stack exhaustion via deeply nested types or declarations.(CVE-2022-1962)

Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy forwards a parameter with an unparsable value. After fix, ReverseProxy sanitizes the query parameters in the forwarded query when the outbound request's Form field is set after the ReverseProxy. Director function returns, indicating that the proxy has parsed the query parameters. Proxies which do not parse query parameters continue to forward the original query parameters unchanged.(CVE-2022-2880)

A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go before 1.17.13 and 1.18.5, potentially allowing a denial of service.(CVE-2022-32189)

Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed regexp representation is linear in the size of the input, but in some cases the constant factor can be as high as 40,000, making relatively small regexps consume much larger amounts of memory. After fix, each regexp being parsed is limited to a 256 MB memory footprint. Regular expressions whose representation would use more space than that are rejected. Normal use of regular expressions is unaffected.(CVE-2022-41715)

The net/http HTTP/1.1 client mishandled the case where a server responds to a request with an "Expect: 100-continue" header with a non-informational (200 or higher) status. This mishandling could leave a client connection in an invalid state, where the next request sent on the connection will fail. An attacker sending a request to a net/http/httputil.ReverseProxy proxy can exploit this mishandling to cause a denial of service by sending "Expect: 100-continue" requests which elicit a non-informational response from the backend. Each such request leaves the proxy with an invalid connection, and causes one subsequent request using that connection to fail.(CVE-2024-24791)

gorilla/schema converts structs to and from form values. Prior to version 1.4.1 Running schema.Decoder.Decode() on a struct that has a field of type []struct{...} opens it up to malicious attacks regarding memory allocations, taking advantage of the sparse slice functionality. Any use of schema.Decoder.Decode() on a struct with arrays of other structs could be vulnerable to this memory exhaustion vulnerability. Version 1.4.1 contains a patch for the issue.(CVE-2024-37298)

go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability, CVE-2024-6104, was fixed in go-retryablehttp 0.7.7.(CVE-2024-6104)

A flaw was found in Go. When FIPS mode is enabled on a system, container runtimes may incorrectly handle certain file paths due to improper validation in the containers/common Go library. This flaw allows an attacker to exploit symbolic links and trick the system into mounting sensitive host directories inside a container. This issue also allows attackers to access critical host files, bypassing the intended…

A vulnerability was found in Buildah. Cache mounts do not properly validate that user-specified paths for the cache are within our cache directory, allowing a RUN instruction in a Container file to mount an arbitrary directory from the host (read/write) into the container as long as those files can be accessed by the user running Buildah.

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images.

Security Fix(es):

• buildah: Buildah allows arbitrary directory mount (CVE-2024-9675)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

• Podman: Buildah: cri-o: FIPS Crypto-Policy Directory Mounting Issue in containers/common Go Library (CVE-2024-9341)
• Buildah: Podman: Improper Input Validation in bind-propagation Option of Dockerfile RUN --mount Instruction (CVE-2024-9407)
• buildah: Buildah allows arbitrary directory mount (CVE-2024-9675)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.

Security Fix(es):

• Buildah: Podman: Improper Input Validation in bind-propagation Option of Dockerfile RUN --mount Instruction (CVE-2024-9407)
• buildah: Buildah allows arbitrary directory mount (CVE-2024-9675)
• Podman: Buildah: CRI-O: symlink traversal vulnerability in the containers/storage library can cause Denial of Service (DoS) (CVE-2024-9676)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.

Security Fix(es):

• go/parser: golang: Calling any of the Parse functions containing deeply nested literals can cause a panic/stack exhaustion (CVE-2024-34155)
• encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion (CVE-2024-34156)
• go/build/constraint: golang: Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion (CVE-2024-34158)
• Podman: Buildah: cri-o: FIPS Crypto-Policy Directory Mounting Issue in containers/common Go Library (CVE-2024-9341)
• Buildah: Podman: Improper Input Validation in bind-propagation Option of Dockerfile RUN --mount Instruction (CVE-2024-9407)
• buildah: Buildah allows arbitrary directory mount (CVE-2024-9675)
• Podman: Buildah: CRI-O: symlink traversal vulnerability in the containers/storage library can cause Denial of Service (DoS) (CVE-2024-9676)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images.

Security Fix(es):

• go/parser: golang: Calling any of the Parse functions containing deeply nested literals can cause a panic/stack exhaustion (CVE-2024-34155)
• encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion (CVE-2024-34156)
• go/build/constraint: golang: Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion (CVE-2024-34158)
• Podman: Buildah: cri-o: FIPS Crypto-Policy Directory Mounting Issue in containers/common Go Library (CVE-2024-9341)
• Buildah: Podman: Improper Input Validation in bind-propagation Option of Dockerfile RUN --mount Instruction (CVE-2024-9407)
• buildah: Buildah allows arbitrary directory mount (CVE-2024-9675)
• Podman: Buildah: CRI-O: symlink traversal vulnerability in the containers/storage library can cause Denial of Service (DoS) (CVE-2024-9676)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

• CVE-2024-9675: fix incorrect handling of paths in cache mounts that allows mounting of arbitrary directories in a container

Buildah allows arbitrary directory mount in github.com/containers/buildah

This update for govulncheck-vulndb fixes the following issues:

• Update to version 0.0.20241104T154416 2024-11-04T15:44:16Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2024-3233 CVE-2024-46872 GHSA-762g-9p7f-mrww
  • GO-2024-3234 CVE-2024-47401 GHSA-762v-rq7q-ff97
  • GO-2024-3235 CVE-2024-50052 GHSA-g376-m3h3-mj4r
  • GO-2024-3237 CVE-2024-0133 GHSA-f748-7hpg-88ch
  • GO-2024-3239 CVE-2024-0132 GHSA-mjjw-553x-87pq
  • GO-2024-3240 CVE-2024-10452 GHSA-66c4-2g2v-54qw
  • GO-2024-3241 CVE-2024-10006 GHSA-5c4w-8hhh-3c3h
  • GO-2024-3242 CVE-2024-10086 GHSA-99wr-c2px-grmh
  • GO-2024-3243 CVE-2024-10005 GHSA-chgm-7r52-whjj

• Update to version 0.0.20241101T215616 2024-11-01T21:56:16Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2024-3244 CVE-2024-50354 GHSA-cph5-3pgr-c82g
  • GO-2024-3245 CVE-2024-39720
  • GO-2024-3246 CVE-2024-8185 GHSA-g233-2p4r-3q7v

• Update to version 0.0.20241030T212825 2024-10-30T21:28:25Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2024-3230 CVE-2024-48921 GHSA-qjvc-p88j-j9rm
  • GO-2024-3232 CVE-2024-10241 GHSA-6mvp-gh77-7vwh

• Update to version 0.0.20241030T160108 2024-10-30T16:01:08Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2024-3226 CVE-2024-47827 GHSA-ghjw-32xw-ffwr
  • GO-2024-3227 CVE-2024-10214 GHSA-hm57-h27x-599c
  • GO-2024-3228 GHSA-wcx9-ccpj-hx3c

• Packaging improvments:

  • Backfill CVE aliases in recent changelog entries

• Update to version 0.0.20241028T152002 2024-10-28T15:20:02Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2024-3207 GHSA-p5wf-cmr4-xrwr
  • GO-2024-3208 CVE-2024-47825 GHSA-3wwx-63fv-pfq6
  • GO-2024-3210 CVE-2024-8901
  • GO-2024-3211 CVE-2024-50312
  • GO-2024-3212 GHSA-rjfv-pjvx-mjgv
  • GO-2024-3213 CVE-2024-49380
  • GO-2024-3214 CVE-2024-49381
  • GO-2024-3215 CVE-2024-9264 GHSA-q99m-qcv4-fpm7
  • GO-2024-3216 CVE-2024-49753 GHSA-6cf5-w9h3-4rqv
  • GO-2024-3217 CVE-2024-49757 GHSA-3rmw-76m6-4gjc
  • GO-2024-3219 GHSA-7h65-4p22-39j6
  • GO-2024-3220 CVE-2023-32197 GHSA-7h8m-pvw3-5gh4
  • GO-2024-3221 CVE-2024-22036 GHSA-h99m-6755-rgwc
  • GO-2024-3222 GHSA-x7xj-jvwp-97rv
  • GO-2024-3223 CVE-2022-45157 GHSA-xj7w-r753-vj8v
  • GO-2024-3224 CVE-2024-39223 GHSA-8wxx-35qc-vp6r

• Update to version 0.0.20241017T153730 date 2024-10-17T15:37:30Z. Refs jsc#PED-11136 Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2024-3189 CVE-2024-38365 GHSA-27vh-h6mc-q6g8
  • GO-2024-3203 CVE-2024-9486
  • GO-2024-3204 CVE-2024-9594

  Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2024-3189 CVE-2024-38365 GHSA-27vh-h6mc-q6g8
  • GO-2024-3196 CVE-2024-47877 GHSA-8rm2-93mq-jqhc
  • GO-2024-3199 GHSA-vv6c-69r6-chg9
  • GO-2024-3200 CVE-2024-48909 GHSA-3c32-4hq9-6wgj
  • GO-2024-3201 CVE-2023-22644 Go CVE Numbering Authority IDs added or updated with aliases:
  • GO-2024-3166 CVE-2024-47534 GHSA-4f8r-qqr9-fq8j
  • GO-2024-3171 CVE-2024-9341 GHSA-mc76-5925-c5p6 Go CVE Numbering Authority IDs added or updated with aliases:
  • GO-2024-3161 CVE-2024-22030 GHSA-h4h5-9833-v2p4
  • GO-2024-3162 CVE-2024-7594 GHSA-jg74-mwgw-v6x3
  • GO-2024-3163 CVE-2024-47182
  • GO-2024-3164 CVE-2024-47003 GHSA-59hf-mpf8-pqjh
  • GO-2024-3166 CVE-2024-47534 GHSA-4f8r-qqr9-fq8j
  • GO-2024-3167 CVE-2024-9355 GHSA-3h3x-2hwv-hr52
  • GO-2024-3168 CVE-2024-8975 GHSA-chqx-36rm-rf8h
  • GO-2024-3169 CVE-2024-9407 GHSA-fhqq-8f65-5xfc
  • GO-2024-3170 CVE-2024-8996 GHSA-m5gv-m5f9-wgv4
  • GO-2024-3172 CVE-2024-33662 GHSA-9mjw-79r6-c9m8
  • GO-2024-3173 CVE-2024-7558 GHSA-mh98-763h-m9v4
  • GO-2024-3174 CVE-2024-8037 GHSA-8v4w-f4r9-7h6x
  • GO-2024-3175 CVE-2024-8038 GHSA-xwgj-vpm9-q2rq
  • GO-2024-3179 CVE-2024-47616 GHSA-r7rh-jww5-5fjr
  • GO-2024-3181 CVE-2024-9313 GHSA-x5q3-c8rm-w787
  • GO-2024-3182 GHSA-wpr2-j6gr-pjw9 *…

These are all security issues fixed in the buildah-1.37.4-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the podman-5.2.4-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the govulncheck-vulndb-0.0.20241030T212825-1.1 package on the GA media of openSUSE Tumbleweed.

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images.

Security Fix(es):

• buildah: Buildah allows arbitrary directory mount (CVE-2024-9675)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.

Security Fix(es):

• Buildah: Podman: Improper Input Validation in bind-propagation Option of Dockerfile RUN --mount Instruction (CVE-2024-9407)

• buildah: Buildah allows arbitrary directory mount (CVE-2024-9675)

• Podman: Buildah: CRI-O: symlink traversal vulnerability in the containers/storage library can cause Denial of Service (DoS) (CVE-2024-9676)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This update for buildah fixes the following issues:

• CVE-2024-9675: Fixed arbitrary cache directory mount (bsc#1231499)

This update for podman fixes the following issues:

• CVE-2024-9675: Fixed cache arbitrary directory mount (bsc#1231499).
• CVE-2024-9407: Fixed improper Input Validation in bind-propagation Option of Dockerfile RUN --mount Instruction (bsc#1231208).

The following non-security bug was fixed:

• rootless ipv6 containers can't be started (bsc#1214612).

This update for govulncheck-vulndb fixes the following issues:

Update to version 0.0.20241030T212825 2024-10-30T21:28:25Z ( jsc#PED-11136 )

• Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2024-3230 CVE-2024-48921 GHSA-qjvc-p88j-j9rm
  • GO-2024-3232 CVE-2024-10241 GHSA-6mvp-gh77-7vwh

• Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2024-3226 CVE-2024-47827 GHSA-ghjw-32xw-ffwr
  • GO-2024-3227 CVE-2024-10214 GHSA-hm57-h27x-599c
  • GO-2024-3228 GHSA-wcx9-ccpj-hx3c

• Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2024-3207 GHSA-p5wf-cmr4-xrwr
  • GO-2024-3208 CVE-2024-47825 GHSA-3wwx-63fv-pfq6
  • GO-2024-3210 CVE-2024-8901
  • GO-2024-3211 CVE-2024-50312
  • GO-2024-3212 GHSA-rjfv-pjvx-mjgv
  • GO-2024-3213 CVE-2024-49380
  • GO-2024-3214 CVE-2024-49381
  • GO-2024-3215 CVE-2024-9264 GHSA-q99m-qcv4-fpm7
  • GO-2024-3216 CVE-2024-49753 GHSA-6cf5-w9h3-4rqv
  • GO-2024-3217 CVE-2024-49757 GHSA-3rmw-76m6-4gjc
  • GO-2024-3219 GHSA-7h65-4p22-39j6
  • GO-2024-3220 CVE-2023-32197 GHSA-7h8m-pvw3-5gh4
  • GO-2024-3221 CVE-2024-22036 GHSA-h99m-6755-rgwc
  • GO-2024-3222 GHSA-x7xj-jvwp-97rv
  • GO-2024-3223 CVE-2022-45157 GHSA-xj7w-r753-vj8v
  • GO-2024-3224 CVE-2024-39223 GHSA-8wxx-35qc-vp6r

• Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2024-3189 CVE-2024-38365 GHSA-27vh-h6mc-q6g8
  • GO-2024-3203 CVE-2024-9486
  • GO-2024-3204 CVE-2024-9594

• Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2024-3189 CVE-2024-38365 GHSA-27vh-h6mc-q6g8
  • GO-2024-3196 CVE-2024-47877 GHSA-8rm2-93mq-jqhc
  • GO-2024-3199 GHSA-vv6c-69r6-chg9
  • GO-2024-3200 CVE-2024-48909 GHSA-3c32-4hq9-6wgj
  • GO-2024-3201 CVE-2023-22644

• Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2024-3166 CVE-2024-47534 GHSA-4f8r-qqr9-fq8j
  • GO-2024-3171 CVE-2024-9341 GHSA-mc76-5925-c5p6

• Go CVE Numbering Authority IDs added or updated with aliases:

  • GO-2024-3161 CVE-2024-22030 GHSA-h4h5-9833-v2p4
  • GO-2024-3162 CVE-2024-7594 GHSA-jg74-mwgw-v6x3
  • GO-2024-3163 CVE-2024-47182
  • GO-2024-3164 CVE-2024-47003 GHSA-59hf-mpf8-pqjh
  • GO-2024-3166 CVE-2024-47534 GHSA-4f8r-qqr9-fq8j
  • GO-2024-3167 CVE-2024-9355 GHSA-3h3x-2hwv-hr52
  • GO-2024-3168 CVE-2024-8975 GHSA-chqx-36rm-rf8h
  • GO-2024-3169 CVE-2024-9407 GHSA-fhqq-8f65-5xfc
  • GO-2024-3170 CVE-2024-8996 GHSA-m5gv-m5f9-wgv4
  • GO-2024-3172 CVE-2024-33662 GHSA-9mjw-79r6-c9m8
  • GO-2024-3173 CVE-2024-7558 GHSA-mh98-763h-m9v4
  • GO-2024-3174 CVE-2024-8037 GHSA-8v4w-f4r9-7h6x
  • GO-2024-3175 CVE-2024-8038 GHSA-xwgj-vpm9-q2rq
  • GO-2024-3179 CVE-2024-47616 GHSA-r7rh-jww5-5fjr
  • GO-2024-3181 CVE-2024-9313 GHSA-x5q3-c8rm-w787
  • GO-2024-3182 GHSA-wpr2-j6gr-pjw9
  • GO-2024-3184 CVE-2024-36814 GHSA-9cp9-8gw2-8v7m
  • GO-2024-3185 CVE-2024-47832
  • GO-2024-3186 CVE-2024-9675 GHSA-586p-749j-fhwp
  • GO-2024-3188 CVE-2024-9312 GHSA-4gfw-wf7c-w6g2
  • GO-2024-3190 CVE-2024-47067 GHSA-8pph-gfhp-w226
  • GO-2024-3191 CVE-2024-9180 GHSA-rr8j-7w34-xp5j

This update for buildah fixes the following issues:

• CVE-2024-9676: Fixed github.com/containers/storage: symlink traversal vulnerability in the containers/storage library can cause Denial of Service (DoS) (bsc#1231698):

• CVE-2024-9675: VUL-0: CVE-2024-9675: buildah,podman: buildah: cache arbitrary directory mount (bsc#1231499):

• CVE-2024-9407: Fixed improper input validation in bind-propagation Option of Dockerfile RUN --mount Instruction (bsc#1231208)

• CVE-2024-9341: Fixed FIPS Crypto-Policy Directory Mounting Issue in containers/common Go Library (bsc#1231230)

• Using networking slirp4netns as default instead of pasta on SLE (bsc#1232522).

This update for buildah fixes the following issues:

Security issues fixed:

• CVE-2024-9675: cache arbitrary directory mount (bsc#1231499)
• CVE-2024-9407: Improper Input Validation in bind-propagation Option of Dockerfile RUN --mount Instruction (bsc#1231208)
• CVE-2024-9676: symlink traversal vulnerability in the containers/storage library can cause denial of service (bsc#1231698)
• CVE-2024-9341: FIPS Crypto-Policy Directory Mounting Issue in containers/common Go Library (bsc#1231230)

Non-security issue fixed:

• default to slirp4netns on SLE instead of pasta (bsc#1232522)

This update for podman fixes the following issues:

• CVE-2024-9676: github.com/containers/storage: Fixed symlink traversal vulnerability in the containers/storage library can cause Denial of Service (DoS) (bsc#1231698)

• Load ip_tables and ip6_tables kernel module (bsc#1214612)

  • Required for rootless mode as a regular user has no permission to load kernel modules

• CVE-2024-9675: Fixed cache arbitrary directory mount in buildah (bsc#1231499)

• CVE-2024-9407: Fixed Improper Input Validation in bind-propagation Option of Dockerfile RUN --mount Instruction in buildah (bsc#1231208)

• CVE-2024-9341: cri-o: FIPS Crypto-Policy Directory Mounting Issue in containers/common Go Library (bsc#1231230)

• CVE-2024-1753: Fixed full container escape at build time in buildah (bsc#1221677)

• CVE-2024-11218: Fixed a container breakout by using --jobs=2 and a race condition when building a malicious Containerfile. (bsc#1236270)

• Refactor network backend dependencies:

  • podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it.
  • This fixes missing cni-plugins in some scenarios
  • Default to netavark everywhere where it's available

This update for podman fixes the following issues:

• CVE-2025-27144: Fixed denial of service in parsing function of embedded library Go JOSE (bsc#1237641)

• CVE-2024-9676: github.com/containers/storage: Fixed symlink traversal vulnerability in the containers/storage library can cause Denial of Service (DoS) (bsc#1231698)

• CVE-2024-9675: Fixed cache arbitrary directory mount in buildah (bsc#1231499)

• CVE-2024-9407: Fixed Improper Input Validation in bind-propagation Option of Dockerfile RUN --mount Instruction in buildah (bsc#1231208)

• CVE-2024-9341: cri-o: FIPS Crypto-Policy Directory Mounting Issue in containers/common Go Library (bsc#1231230)

• CVE-2024-1753: Fixed full container escape at build time in buildah (bsc#1221677)

• CVE-2024-11218: Fixed a container breakout by using --jobs=2 and a race condition when building a malicious Containerfile. (bsc#1236270)

• CVE-2024-6104: Fixed hashicorp/go-retryablehttp writing sensitive information to log files (bsc#1227052)

• CVE-2023-45288: Fixed golang.org/x/net/http2 excessive resource consumption when receiving too many headers (bsc#1236507)

• Load ip_tables and ip6_tables kernel module (bsc#1214612)

  • Required for rootless mode as a regular user has no permission to load kernel modules

• Refactor network backend dependencies:

  • podman requires either netavark or cni-plugins. On ALP, require netavark, otherwise prefer netavark but don't force it.
  • This fixes missing cni-plugins in some scenarios
  • Default to netavark everywhere where it's available