This update for containerd, docker, docker-runc, golang-github-docker-libnetwork, runc fixes the following issues :

Security issues fixed :

CVE-2018-16875: Fixed a CPU Denial of Service (bsc#1118899).

CVE-2018-16874: Fixed a vulnerabity in go get command which could allow directory traversal in GOPATH mode (bsc#1118898).

CVE-2018-16873: Fixed a vulnerability in go get command which could allow remote code execution when executed with -u in GOPATH mode (bsc#1118897).

CVE-2019-5736: Effectively copying /proc/self/exe during re-exec to avoid write attacks to the host runc binary, which could lead to a container breakout (bsc#1121967).

Other changes and fixes: Update shell completion to use Group:
System/Shells.

Add daemon.json file with rotation logs configuration (bsc#1114832)

Update to Docker 18.09.1-ce (bsc#1124308) and to to runc 96ec2177ae84.
See upstream changelog in the packaged /usr/share/doc/packages/docker/CHANGELOG.md.

Update go requirements to >= go1.10

Use -buildmode=pie for tests and binary build (bsc#1048046 and bsc#1051429).

Remove the usage of 'cp -r' to reduce noise in the build logs.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for lxc fixes the following issues :

Update to lxc 3.2.1. The changelog can be found at

https://discuss.linuxcontainers.org/t/lxc-3-2-1-has-been-released/5322

  + seccomp: support syscall forwarding to userspace

  + add lxc.seccomp.allow_nesting

  + pidfd: Add initial support for the new pidfd api

  - Many hardening improvements.

  - Use /sys/kernel/cgroup/delegate file for cgroup v2.

  - Fix CVE-2019-5736 equivalent bug.

  - fix apparmor dropin to be compatible with LXC 3.1.0     (boo#1131762)

An update for docker is now available for Red Hat Enterprise Linux 7 Extras.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Docker is an open source engine that automates the deployment of any application as a lightweight, portable, self-sufficient container that runs virtually anywhere.

Security Fix(es) :

* A flaw was found in the way runc handled system file descriptors when running containers. A malicious container could use this flaw to overwrite contents of the runc binary and consequently run arbitrary commands on the container host system. (CVE-2019-5736)

Additional details about this flaw, including mitigation information, can be found in the vulnerability article linked from the Reference section.

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Update to 1.2.3

Fixes security vulnerability related to CVE-2019-5736.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2019:0975 advisory.

  - runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite     the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a     command as root within one of these types of containers: (1) a new container with an attacker-controlled     image, or (2) an existing container, to which the attacker previously had write access, that can be     attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/self/exe.
    (CVE-2019-5736)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for lxc, lxcfs to version 3.1.0 fixes the following issues :

Security issues fixed :

  - CVE-2019-5736: Fixed a container breakout vulnerability     (boo#1122185).

  - CVE-2018-6556: Enable setuid bit on lxc-user-nic     (boo#988348).

Non-security issues fixed :

  - Update to LXC 3.1.0. The changelog is far too long to     include here, please look at     https://linuxcontainers.org/. (boo#1131762)

ID	Name	Product	Family	Published	Updated	Severity
122472	SUSE SLED15 / SLES15 Security Update : containerd, docker, docker-runc, golang-github-docker-libnetwork, runc (SUSE-SU-2019:0495-1)	Nessus	SuSE Local Security Checks	2/27/2019	1/26/2022	high
129580	openSUSE Security Update : lxc (openSUSE-2019-2245)	Nessus	SuSE Local Security Checks	10/4/2019	4/19/2024	high
122111	RHEL 7 : docker (RHSA-2019:0304)	Nessus	Red Hat Local Security Checks	2/12/2019	2/1/2022	high
122139	Fedora 29 : flatpak (2019-fd9345f44a)	Nessus	Fedora Local Security Checks	2/13/2019	6/20/2024	high
185070	Rocky Linux 8 : container-tools:rhel8 (RLSA-2019:0975)	Nessus	Rocky Linux Local Security Checks	11/7/2023	11/8/2023	high
124312	openSUSE Security Update : lxc / lxcfs (openSUSE-2019-1275)	Nessus	SuSE Local Security Checks	4/26/2019	5/31/2024	high
125668	openSUSE Security Update : lxc / lxcfs (openSUSE-2019-1481)	Nessus	SuSE Local Security Checks	6/3/2019	5/17/2024	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high