RHSA-2021:4154 - Security Advisory

Topic

An update for the container-tools:rhel8 module is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

• buildah: Host environment variables leaked in build container when using chroot isolation (CVE-2021-3602)
• containers/storage: DoS via malicious image (CVE-2021-20291)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.5 Release Notes linked from the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux for x86_64 8 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.6 x86_64
• Red Hat Enterprise Linux Server - AUS 8.6 x86_64
• Red Hat Enterprise Linux for IBM z Systems 8 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.6 s390x
• Red Hat Enterprise Linux for Power, little endian 8 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.6 ppc64le
• Red Hat Enterprise Linux Server - TUS 8.6 x86_64
• Red Hat Enterprise Linux for ARM 64 8 aarch64
• Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.6 aarch64
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.6 ppc64le
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.6 x86_64

Fixes

• BZ - 1914687 - Rebase to github.com/containers/toolbox
• BZ - 1928935 - RFE: Let `podman volume prune` show the volumes that are going to be removed
• BZ - 1932399 - IPv6 errors after exiting crictl
• BZ - 1933775 - shortname for ubi8-minimal leads to "Repo not found" error [RHEL 8.5]
• BZ - 1933776 - podman 3.0.1 ships with a v2 go module [RHEL 8.5]
• BZ - 1934415 - Work on 8.5.0 container-tools module.
• BZ - 1934480 - Podman will pull image for rootless CNI
• BZ - 1937641 - Regression: Overlay mounts is broken on existing directories. [rhel-8.5.0]
• BZ - 1937830 - regressions cp command in Podman v3.0 [rhel-8.5.0]
• BZ - 1939485 - CVE-2021-20291 containers/storage: DoS via malicious image
• BZ - 1940037 - toolbox does not provide /:/host mount required for sosreport
• BZ - 1940054 - Support logging into a registry if necessary
• BZ - 1940082 - toolbox does not support a config file
• BZ - 1940493 - [gss][podman]Getting the error while starting container "Error: readlink /var/lib/containers/storage/overlay/l/XXX no such file or directory" [rhel-8.5.0]
• BZ - 1941380 - Podman - secondary groups not available in container when using userns=keep-id
• BZ - 1947432 - podman run --pid=host command causes OCI permission error
• BZ - 1947999 - rootless podman --cgroup-manager=cgroupfs run command causes OCI permission error when CGroups V2 is enabled
• BZ - 1952204 - shortnames for containerized images
• BZ - 1952698 - Permission on /dev/null are changing from 666 to 777 after running podman as root
• BZ - 1957299 - Podman "--format" does not support "join"
• BZ - 1957840 - kubelet service fail to load EnvironmentFile due to SELinux denial
• BZ - 1957904 - Confined selinux users of type staff_u and user_u cannot run rootless podman containers
• BZ - 1958353 - "rootless-cni-infra": executable file not found in $PATH: OCI not found
• BZ - 1960948 - Error refreshing container XXX: error acquiring lock 0 for container
• BZ - 1966538 - Podman returns development version
• BZ - 1966872 - podman's image index corrupted during WAN emulation tests
• BZ - 1969264 - CVE-2021-3602 buildah: Host environment variables leaked in build container when using chroot isolation
• BZ - 1972150 - Image fails to prune from registry, preventing subsequent prunes
• BZ - 1972209 - Under load, container failed to be created due to missing cgroup scope
• BZ - 1972211 - When running a lot of one-off containers, podman hangs forever
• BZ - 1972282 - TMPDIR is not working in podman pull and podman load
• BZ - 1972648 - Update shortname list
• BZ - 1973418 - kubelet service fail to load EnvironmentFile due to SELinux denial (Re-opened)
• BZ - 1976283 - podman search does not return an exact match
• BZ - 1977280 - registries.conf mixes v1 and v2 syntax
• BZ - 1977673 - podman v3.2.2 writes image events too early
• BZ - 1978415 - Supply the python-podman package in RHEL 8.5.0
• BZ - 1978556 - podman v3.2.2 - error resolving image of another architecture
• BZ - 1978647 - [RFE] Podman secrets for RHEL 8.4
• BZ - 1979497 - podman v3.2.2 - cannot get logs when running in namespace with /var/log overmounted
• BZ - 1980212 - [Cockpit 8.5] [ja_JP, ko_KR] Podman Container Page is not localized
• BZ - 1982593 - podman 3.2 - CNI-in-slirp4netns DNS gets broken when running a rootful container after running a rootless container
• BZ - 1982762 - podman v3.2.2 - race condition with rootless cni networking
• BZ - 1985499 - podman: Cannot run Fedora 35/RHEL 9 Beta images due to clone3 incompatibility
• BZ - 1985905 - Podman report unsupported pull policy if set imagePullPolicy with capitalized Word
• BZ - 1987049 - inability to start container with runc caused by redundant seccomp rules
• BZ - 1993209 - new containers-common packaging conflicts with redhat-release
• BZ - 1993249 - Make volume removal with third-party drivers consistent with Docker behavior
• BZ - 1995041 - Rebase udica to v0.2.5
• BZ - 1998191 - Suggest a way forward if coreos/toolbox was used
• BZ - 1999144 - podman update to 3.3 removes default network config
• BZ - 2000943 - podman auto update fails to login to registry after podman upgrade to 3.2
• BZ - 2004562 - Switch to using the Toolbox-specific UBI image by default
• BZ - 2005018 - [8.4.0.z] kubelet service fail to load EnvironmentFile due to SELinux denial (Re-opened)

CVEs

• CVE-2021-3602
• CVE-2021-20291

References

• https://access.redhat.com/security/updates/classification/#moderate
• https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.5_release_notes/