Security update for podman SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2022:2839-2 Final 1 1 2022-08-18T05:39:12Z current 2022-08-18T05:39:12Z 2022-08-18T05:39:12Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for podman This update for podman fixes the following issues: Updated to version 3.4.7: - CVE-2022-1227: Fixed an issue that could allow an attacker to publish a malicious image to a public registry and run arbitrary code in the victim's context via the 'podman top' command (bsc#1182428). - CVE-2022-27191: Fixed a potential crash via SSH under specific configurations (bsc#1197284). - CVE-2022-21698: Fixed a potential denial of service that affected servers that used Prometheus instrumentation (bsc#1196338). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2022-2839,openSUSE-Leap-Micro-5.2-2022-2839 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2022/suse-su-20222839-2/ Link for SUSE-SU-2022:2839-2 https://lists.suse.com/pipermail/sle-security-updates/2022-September/012032.html E-Mail link for SUSE-SU-2022:2839-2 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1182428 SUSE Bug 1182428 https://bugzilla.suse.com/1196338 SUSE Bug 1196338 https://bugzilla.suse.com/1197284 SUSE Bug 1197284 https://www.suse.com/security/cve/CVE-2022-1227/ SUSE CVE CVE-2022-1227 page https://www.suse.com/security/cve/CVE-2022-21698/ SUSE CVE CVE-2022-21698 page https://www.suse.com/security/cve/CVE-2022-27191/ SUSE CVE CVE-2022-27191 page openSUSE Leap Micro 5.2 podman-3.4.7-150300.9.9.2 podman-cni-config-3.4.7-150300.9.9.2 podman-docker-3.4.7-150300.9.9.2 podman-remote-3.4.7-150300.9.9.2 podman-3.4.7-150300.9.9.2 as a component of openSUSE Leap Micro 5.2 podman-cni-config-3.4.7-150300.9.9.2 as a component of openSUSE Leap Micro 5.2 A privilege escalation flaw was found in Podman. This flaw allows an attacker to publish a malicious image to a public registry. Once this image is downloaded by a potential victim, the vulnerability is triggered after a user runs the 'podman top' command. This action gives the attacker access to the host filesystem, leading to information disclosure or denial of service. CVE-2022-1227 openSUSE Leap Micro 5.2:podman-3.4.7-150300.9.9.2 openSUSE Leap Micro 5.2:podman-cni-config-3.4.7-150300.9.9.2 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20222839-2/ https://www.suse.com/security/cve/CVE-2022-1227.html CVE-2022-1227 https://bugzilla.suse.com/1182428 SUSE Bug 1182428 client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers and clients. In client_golang prior to version 1.11.1, HTTP server is susceptible to a Denial of Service through unbounded cardinality, and potential memory exhaustion, when handling requests with non-standard HTTP methods. In order to be affected, an instrumented software must use any of `promhttp.InstrumentHandler*` middleware except `RequestsInFlight`; not filter any specific methods (e.g GET) before middleware; pass metric with `method` label name to our middleware; and not have any firewall/LB/proxy that filters away requests with unknown `method`. client_golang version 1.11.1 contains a patch for this issue. Several workarounds are available, including removing the `method` label name from counter/gauge used in the InstrumentHandler; turning off affected promhttp handlers; adding custom middleware before promhttp handler that will sanitize the request method given by Go http.Request; and using a reverse proxy or web application firewall, configured to only allow a limited set of methods. CVE-2022-21698 openSUSE Leap Micro 5.2:podman-3.4.7-150300.9.9.2 openSUSE Leap Micro 5.2:podman-cni-config-3.4.7-150300.9.9.2 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20222839-2/ https://www.suse.com/security/cve/CVE-2022-21698.html CVE-2022-21698 https://bugzilla.suse.com/1196338 SUSE Bug 1196338 The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey. CVE-2022-27191 openSUSE Leap Micro 5.2:podman-3.4.7-150300.9.9.2 openSUSE Leap Micro 5.2:podman-cni-config-3.4.7-150300.9.9.2 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20222839-2/ https://www.suse.com/security/cve/CVE-2022-27191.html CVE-2022-27191 https://bugzilla.suse.com/1197284 SUSE Bug 1197284