CVE-2018-15664

In Docker through 18.06.1-ce-rc2, the API endpoints behind the 'docker cp' command are vulnerable to a symlink-exchange attack with Directory Traversal, giving attackers arbitrary read-write access to the host filesystem with root privileges, because daemon/archive.go does not do archive operations on a frozen filesystem (or from within a chroot).

In Docker through 18.06.1-ce-rc2, the API endpoints behind the 'docker cp' command are vulnerable to a symlink-exchange attack with Directory Traversal, giving attackers arbitrary read-write access to the host filesystem with root privileges, because daemon/archive.go does not do archive operations on a frozen filesystem (or from within a chroot).

This update for docker fixes the following issues:

Security issue fixed:

• CVE-2018-15664: Fixed an issue which could make docker cp vulnerable to symlink-exchange race attacks (bsc#1096726).

This update was imported from the SUSE:SLE-15:Update update project.

This is a version update for podman to version 1.4.4 (bsc#1143386).

Additional changes by SUSE on top:

• Remove fuse-overlayfs because it's (currently) an unsatisfied dependency on SLE (bsc#1143386)
• Update libpod.conf to use correct infra_command
• Update libpod.conf to use better versioned pause container
• Update libpod.conf to use official kubic pause container
• Update libpod.conf to match latest features set: detach_keys, lock_type, runtime_supports_json
• Add podman-remote varlink client

Version update podman to v1.4.4:

• Features

  • Podman now has greatly improved support for containers using multiple OCI runtimes. Containers now remember if they were created with a different runtime using --runtime and will always use that runtime
  • The cached and delegated options for volume mounts are now allowed for Docker compatability (#3340)
  • The podman diff command now supports the --latest flag

• Bugfixes

  • Fixed a bug where rootless Podman would attempt to use the entire root configuration if no rootless configuration was present for the user, breaking rootless Podman for new installations
  • Fixed a bug where rootless Podman's pause process would block SIGTERM, preventing graceful system shutdown and hanging until the system's init send SIGKILL
  • Fixed a bug where running Podman as root with sudo -E would not work after running rootless Podman at least once
  • Fixed a bug where options for tmpfs volumes added with the --tmpfs flag were being ignored
  • Fixed a bug where images with no layers could not properly be displayed and removed by Podman
  • Fixed a bug where locks were not properly freed on failure to create a container or pod
  • Fixed a bug where podman cp on a single file would create a directory at the target and place the file in it (#3384)
  • Fixed a bug where podman inspect --format '{{.Mounts}}' would print a hexadecimal address instead of a container's mounts
  • Fixed a bug where rootless Podman would not add an entry to container's /etc/hosts files for their own hostname (#3405)
  • Fixed a bug where podman ps --sync would segfault (#3411)
  • Fixed a bug where podman generate kube would produce an invalid ports configuration (#3408)

• Misc

  • Updated containers/storage to v1.12.13
  • Podman now performs much better on systems with heavy I/O load
  • The --cgroup-manager flag to podman now shows the correct default setting in help if the default was overridden by libpod.conf
  • For backwards compatability, setting --log-driver=json-file in podman run is now supported as an alias for --log-driver=k8s-file. This is considered deprecated, and json-file will be moved to a new implementation in the future ([#3363](https://github.com/containers/libpo
    d/issues/3363))
  • Podman's default libpod.conf file now allows the crun OCI runtime to be used if it is installed

Update podman to v1.4.2:

• Fixed a bug where Podman could not run containers using an older version of Systemd as init
• Updated vendored Buildah to v1.9.0 to resolve a critical bug with Dockerfile RUN instructions
• The error message for running podman kill on containers that are not running has been improved
• Podman remote client can now log to a file if syslog is not available
• The podman exec command now sets its error code differently based on whether the container does not exist, and the command in the container does not exist
• The podman inspect command on containers now outputs Mounts JSON that matches that of docker inspect, only including user-specified volumes and differentiating bind mounts and named volumes
• The podman inspect command now reports the path to a container's OCI spec with the OCIConfigPath key (only included when the container is initialized or running)
• The podman run --mount command now supports the bind-nonrecursive option for bind mounts
• Fixed a bug where podman play kube…

These are all security issues fixed in the docker-20.10.6_ce-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the libcontainers-common-20210626-5.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the docker-stable-24.0.9_ce-15.1 package on the GA media of openSUSE Tumbleweed.

This update for docker fixes the following issues:

Security issue fixed:

• CVE-2018-15664: Fixed an issue which made docker cp vulnerable to symlink-exchange race attacks (bsc#1096726).

This update for docker fixes the following issues:

Security issue fixed:

• CVE-2018-15664: Fixed an issue which could make docker cp vulnerable to symlink-exchange race attacks (bsc#1096726).

This is a version update for podman to version 1.4.4 (bsc#1143386).

Additional changes by SUSE on top:

• Remove fuse-overlayfs because it's (currently) an unsatisfied dependency on SLE (bsc#1143386)
• Update libpod.conf to use correct infra_command
• Update libpod.conf to use better versioned pause container
• Update libpod.conf to use official kubic pause container
• Update libpod.conf to match latest features set: detach_keys, lock_type, runtime_supports_json
• Add podman-remote varlink client

Version update podman to v1.4.4:

• Features

  • Podman now has greatly improved support for containers using multiple OCI runtimes. Containers now remember if they were created with a different runtime using --runtime and will always use that runtime
  • The cached and delegated options for volume mounts are now allowed for Docker compatability (#3340)
  • The podman diff command now supports the --latest flag

• Bugfixes

  • Fixed a bug where rootless Podman would attempt to use the entire root configuration if no rootless configuration was present for the user, breaking rootless Podman for new installations
  • Fixed a bug where rootless Podman's pause process would block SIGTERM, preventing graceful system shutdown and hanging until the system's init send SIGKILL
  • Fixed a bug where running Podman as root with sudo -E would not work after running rootless Podman at least once
  • Fixed a bug where options for tmpfs volumes added with the --tmpfs flag were being ignored
  • Fixed a bug where images with no layers could not properly be displayed and removed by Podman
  • Fixed a bug where locks were not properly freed on failure to create a container or pod
  • Fixed a bug where podman cp on a single file would create a directory at the target and place the file in it (#3384)
  • Fixed a bug where podman inspect --format '{{.Mounts}}' would print a hexadecimal address instead of a container's mounts
  • Fixed a bug where rootless Podman would not add an entry to container's /etc/hosts files for their own hostname (#3405)
  • Fixed a bug where podman ps --sync would segfault (#3411)
  • Fixed a bug where podman generate kube would produce an invalid ports configuration (#3408)

• Misc

  • Updated containers/storage to v1.12.13
  • Podman now performs much better on systems with heavy I/O load
  • The --cgroup-manager flag to podman now shows the correct default setting in help if the default was overridden by libpod.conf
  • For backwards compatability, setting --log-driver=json-file in podman run is now supported as an alias for --log-driver=k8s-file. This is considered deprecated, and json-file will be moved to a new implementation in the future ([#3363](https://github.com/containers/libpo
    d/issues/3363))
  • Podman's default libpod.conf file now allows the crun OCI runtime to be used if it is installed

Update podman to v1.4.2:

• Fixed a bug where Podman could not run containers using an older version of Systemd as init
• Updated vendored Buildah to v1.9.0 to resolve a critical bug with Dockerfile RUN instructions
• The error message for running podman kill on containers that are not running has been improved
• Podman remote client can now log to a file if syslog is not available
• The podman exec command now sets its error code differently based on whether the container does not exist, and the command in the container does not exist
• The podman inspect command on containers now outputs Mounts JSON that matches that of docker inspect, only including user-specified volumes and differentiating bind mounts and named volumes
• The podman inspect command now reports the path to a container's OCI spec with the OCIConfigPath key (only included when the container is initialized or running)
• The podman run --mount command now supports the bind-nonrecursive option for bind mounts
• Fixed a bug where podman play kube…

This update for docker-stable fixes the following issues:

• Include historical changelog data from before the docker-stable fork. The initial changelog entry did technically provide all the necessary information, but our CVE tracking tools do not understand how the package is forked and so it seems that this package does not include fixes for ~12 years of updates. So, include a copy of the original package's changelog up until the fork point. (bsc#1250596)

• Remove git-core recommends on SLE. Most SLE systems have installRecommends=yes by default and thus end up installing git with Docker. bsc#1250508

  This feature is mostly intended for developers ('docker build git://') so most users already have the dependency installed, and the error when git is missing is fairly straightforward (so they can easily figure out what they need to install).

• Backport https://github.com/moby/moby/pull/48517. bsc#1247362

• Update to docker-buildx v0.25.0. Upstream changelog: https://github.com/docker/buildx/releases/tag/v0.25.0

• Do not try to inject SUSEConnect secrets when in Rootless Docker mode, as Docker does not have permission to access the host zypper credentials in this mode (and unprivileged users cannot disable the feature using /etc/docker/suse-secrets-enable.) bsc#1240150

• Initial docker-stable fork, forked from Docker 24.0.7-ce release (packaged on 2024-02-14). The original changelog is included below for historical reference.

This update for docker-stable fixes the following issues:

Note this update contains a already fixed references mostly.

• Remove git-core recommends on SLE to avoid pulling it in unnecessary. (bsc#1250508)

  This feature is mostly intended for developers ('docker build git://') so most users already have the dependency installed, and the error when git is missing is fairly straightforward (so they can easily figure out what they need to install).

• Include historical changelog data from before the docker-stable fork. The initial changelog entry did technically provide all the necessary information, but our CVE tracking tools do not understand how the package is forked and so it seems that this package does not include fixes for ~12 years of updates. So, include a copy of the original package's changelog up until the fork point. bsc#1250596

• Update to docker-buildx v0.25.0. Upstream changelog: https://github.com/docker/buildx/releases/tag/v0.25.0

• Update to Go 1.23 for building now that upstream has switched their 23.0.x LTSS to use Go 1.23.

• Do not try to inject SUSEConnect secrets when in Rootless Docker mode, as Docker does not have permission to access the host zypper credentials in this mode (and unprivileged users cannot disable the feature using /etc/docker/suse-secrets-enable.) bsc#1240150

• Initial docker-stable fork, forked from Docker 24.0.7-ce release (packaged on 2024-02-14). The original changelog is included below for historical reference.

Aleksa Sarai discovered that Docker was vulnerable to a directory traversal attack. An attacker could use this vulnerability to read and write arbitrary files on the host filesystem as root.