RHSA-2020:1231: Moderate: buildah security and bug fix update
The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point. Create an image, either from a working container or using the instructions in a Dockerfile. Build both Docker and OCI images. Security Fix(es): proglottis/gpgme: Use-after-free in GPGME bindings during container image pull (CVE-2020-8945) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Bug Fix(es): rootless buildah does not work with UID in /etc/subuid (BZ#1765469) Extras RHEL-7.8 update - buildah (BZ#1791286) buildah should be linked against gpgme-pthread (BZ#1793074)
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2020:1231?
The severity of RHSA-2020:1231 is classified as moderate.
How do I fix RHSA-2020:1231?
To fix RHSA-2020:1231, update the buildah package to version 1.11.6-8.el7_8 or newer.
What software is affected by RHSA-2020:1231?
RHSA-2020:1231 affects the buildah and buildah-debuginfo packages on Red Hat Enterprise Linux.
Is RHSA-2020:1231 relevant to container security?
Yes, RHSA-2020:1231 is relevant to container security as it deals with vulnerabilities in the container image building tool buildah.
What are the potential impacts of RHSA-2020:1231?
The potential impacts of RHSA-2020:1231 include security vulnerabilities that could be exploited while building OCI container images.