Test ID:	1.3.6.1.4.1.25623.1.1.4.2022.23018.1
Category:	SuSE Local Security Checks
Title:	SUSE: Security Advisory (SUSE-SU-2022:23018-1)
Summary:	The remote host is missing an update for the 'conmon, libcontainers-common, libseccomp, podman' package(s) announced via the SUSE-SU-2022:23018-1 advisory.
Description:	Summary: The remote host is missing an update for the 'conmon, libcontainers-common, libseccomp, podman' package(s) announced via the SUSE-SU-2022:23018-1 advisory. Vulnerability Insight: This update for conmon, libcontainers-common, libseccomp, podman fixes the following issues: podman was updated to 3.4.4. Security issues fixed: fix CVE-2021-41190 [bsc#1193273], opencontainers: OCI manifest and index parsing confusion fix CVE-2021-4024 [bsc#1193166], podman machine spawns gvproxy with port binded to all IPs fix CVE-2021-20199 [bsc#1181640], Remote traffic to rootless containers is seen as originating from localhost Add: Provides: podman:/usr/bin/podman-remote subpackage for a clearer upgrade path from podman < 3.1.2 Update to version 3.4.4: * Bugfixes - Fixed a bug where the podman exec command would, under some circumstances, print a warning message about failing to move conmon to the appropriate cgroup (#12535). - Fixed a bug where named volumes created as part of container creation (e.g. podman run --volume avolume:/a/mountpoint or similar) would be mounted with incorrect permissions (#12523). - Fixed a bug where the podman-remote create and podman-remote run commands did not properly handle the --entrypoint='' option (to clear the container's entrypoint) (#12521). Update to version 3.4.3: * Security - This release addresses CVE-2021-4024, where the podman machine command opened the gvproxy API (used to forward ports to podman machine VMs) to the public internet on port 7777. - This release addresses CVE-2021-41190, where incomplete specification of behavior regarding image manifests could lead to inconsistent decoding on different clients. * Features - The --secret type=mount option to podman create and podman run supports a new option, target=, which specifies where in the container the secret will be mounted (#12287). * Bugfixes - Fixed a bug where rootless Podman would occasionally print warning messages about failing to move the pause process to a new cgroup (#12065). - Fixed a bug where the podman run and podman create commands would, when pulling images, still require TLS even with registries set to Insecure via config file (#11933). - Fixed a bug where the podman generate systemd command generated units that depended on multi-user.target, which has been removed from some distributions (#12438). - Fixed a bug where Podman could not run containers with images that had /etc/ as a symlink (#12189). - Fixed a bug where the podman logs -f command would, when using the journald logs backend, exit immediately if the container had previously been restarted (#12263). - Fixed a bug where, in containers on VMs created by podman machine, the host.containers.internal name pointed to the VM, not the host system (#11642). - Fixed a bug where containers and pods created by the podman play kube command in VMs managed by podman machine would not automatically forward ports from the host machine (#12248). - Fixed a bug where podman machine init would fail on OS X when GNU Coreutils was installed ... [Please see the references for more information on the vulnerabilities] Affected Software/OS: 'conmon, libcontainers-common, libseccomp, podman' package(s) on SUSE Linux Enterprise Micro 5.1, SUSE Linux Enterprise Module for Basesystem 15-SP3, SUSE Linux Enterprise Module for Containers 15-SP3. Solution: Please install the updated package(s). CVSS Score: 7.1 CVSS Vector: AV:N/AC:M/Au:N/C:N/I:N/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2020-14370 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z4Y2FSGQWP4AFT5AZ6UBN6RKHVXUBRFV/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/G6BPCZX4ASKNONL3MSCK564IVXNYSKLP/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Y74V7HGQBNLT6XECCSNZNFZIB7G7XSAR/ https://bugzilla.redhat.com/show_bug.cgi?id=1874268 Common Vulnerability Exposure (CVE) ID: CVE-2020-15157 https://github.com/containerd/containerd/security/advisories/GHSA-742w-89gc-8m9c Debian Security Information: DSA-4865 (Google Search) https://www.debian.org/security/2021/dsa-4865 https://github.com/containerd/containerd/releases/tag/v1.2.14 https://usn.ubuntu.com/4589-1/ https://usn.ubuntu.com/4589-2/ Common Vulnerability Exposure (CVE) ID: CVE-2021-20199 https://bugzilla.redhat.com/show_bug.cgi?id=1919050 https://github.com/containers/podman/issues/5138 https://github.com/containers/podman/pull/9052 https://github.com/rootless-containers/rootlesskit/pull/206 Common Vulnerability Exposure (CVE) ID: CVE-2021-20291 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNMB7O2UIXE34PGSCSOULGHPX5LIJBMM/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WX24EITRXVHDM5M223BVTJA2ODF2FSHI/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SPYOHNG2Q7DCAQZMGYLMENLKALGDLG3X/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/R5D7XL7FL24TWFMGQ3K2S72EOUSLZMKL/ https://unit42.paloaltonetworks.com/cve-2021-20291/ https://bugzilla.redhat.com/show_bug.cgi?id=1939485 Common Vulnerability Exposure (CVE) ID: CVE-2021-3602 https://bugzilla.redhat.com/show_bug.cgi?id=1969264 https://github.com/containers/buildah/commit/a468ce0ffd347035d53ee0e26c205ef604097fb0 https://github.com/containers/buildah/security/advisories/GHSA-7638-r9r3-rmjj https://ubuntu.com/security/CVE-2021-3602 Common Vulnerability Exposure (CVE) ID: CVE-2021-4024 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QFFVJ6S3ZRMPDYB7KYAWEMDHXFZYQPU3/ https://bugzilla.redhat.com/show_bug.cgi?id=2026675, https://github.com/containers/podman/releases/tag/v3.4.3 Common Vulnerability Exposure (CVE) ID: CVE-2021-41190 https://github.com/opencontainers/distribution-spec/security/advisories/GHSA-mc8v-mgrf-8f4m https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3TUZNDAH2B26VPBK342UC3BHZNLBUXGX/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4334HT7AZPLWNYHW4ARU6JBUF3VZJPZN/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YIGVQWOA5XXCQXEOOKZX4CDAGLBDRPRX/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DX63GRWFEI5RVMYV6XLMCG4OHPWZML27/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SQBCYJUIM5GVCMFUPRWKRZNXMMI5EFA4/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RZTO6N55WHKHIZI4IMLY2QFBPMVTAERM/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/A2RRFNTMFYKOTRKD37F5ANMCIO3GGJML/ https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/T4OJ764CKKCWCVONHD4YXTGR7HZ7LRUV/ https://github.com/opencontainers/distribution-spec/commit/ac28cac0557bcd3084714ab09f9f2356fe504923 http://www.openwall.com/lists/oss-security/2021/11/19/10
Copyright	Copyright (C) 2022 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.