RHSA-2022:4816: Important: container-tools:3.0 security update
The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.Security Fix(es): psgo: Privilege escalation in 'podman top' (CVE-2022-1227) podman: Default inheritable capabilities for linux container should be empty (CVE-2022-27649) buildah: Default inheritable capabilities for linux container should be empty (CVE-2022-27651) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/buildahto a version that resolves this vulnerability.Fixed in 1.19.9-1.module+el8.4.0+14872+9efa52a3 - Upgrade
Upgrade
redhat/cockpit-podmanto a version that resolves this vulnerability.Fixed in 29-2.module+el8.4.0+14872+9efa52a3 - Upgrade
Upgrade
redhat/conmonto a version that resolves this vulnerability.Fixed in 2.0.26-1.module+el8.4.0+14872+9efa52a3 - Upgrade
Upgrade
redhat/container-selinuxto a version that resolves this vulnerability.Fixed in 2.167.0-1.module+el8.4.0+14872+9efa52a3 - Upgrade
Upgrade
redhat/containernetworking-pluginsto a version that resolves this vulnerability.Fixed in 0.9.1-1.module+el8.4.0+14872+9efa52a3 - Upgrade
Upgrade
redhat/criuto a version that resolves this vulnerability.Fixed in 3.15-1.module+el8.4.0+14872+9efa52a3 - Upgrade
Upgrade
redhat/crunto a version that resolves this vulnerability.Fixed in 0.18-2.module+el8.4.0+14872+9efa52a3 - Upgrade
Upgrade
redhat/fuse-overlayfsto a version that resolves this vulnerability.Fixed in 1.4.0-2.module+el8.4.0+14872+9efa52a3 - Upgrade
Upgrade
redhat/libslirpto a version that resolves this vulnerability.Fixed in 4.3.1-1.module+el8.4.0+14872+9efa52a3 - Upgrade
Upgrade
redhat/oci-seccomp-bpf-hookto a version that resolves this vulnerability.Fixed in 1.2.0-1.module+el8.4.0+14872+9efa52a3 - Upgrade
Upgrade
redhat/podmanto a version that resolves this vulnerability.Fixed in 3.0.1-9.module+el8.4.0+14872+9efa52a3 - Upgrade
Upgrade
redhat/runcto a version that resolves this vulnerability.Fixed in 1.0.0-76.rc95.module+el8.4.0+14872+9efa52a3 - Upgrade
Upgrade
redhat/skopeoto a version that resolves this vulnerability.Fixed in 1.2.2-8.module+el8.4.0+14872+9efa52a3 - Upgrade
Upgrade
redhat/slirp4netnsto a version that resolves this vulnerability.Fixed in 1.1.8-1.module+el8.4.0+14872+9efa52a3 - Upgrade
Upgrade
redhat/toolboxto a version that resolves this vulnerability.Fixed in 0.0.8-1.module+el8.4.0+14872+9efa52a3 - Upgrade
Upgrade
redhat/udicato a version that resolves this vulnerability.Fixed in 0.2.4-1.module+el8.4.0+14872+9efa52a3 - Upgrade
Upgrade
redhat/podman-dockerto a version that resolves this vulnerability.Fixed in 3.0.1-9.module+el8.4.0+14872+9efa52a3 - Upgrade
Upgrade
redhat/buildah-debuginfoto a version that resolves this vulnerability.Fixed in 1.19.9-1.module+el8.4.0+14872+9efa52a3 - Upgrade
Upgrade
redhat/buildah-debugsourceto a version that resolves this vulnerability.Fixed in 1.19.9-1.module+el8.4.0+14872+9efa52a3 - Upgrade
Upgrade
redhat/buildah-teststo a version that resolves this vulnerability.Fixed in 1.19.9-1.module+el8.4.0+14872+9efa52a3 - Upgrade
Upgrade
redhat/buildah-tests-debuginfoto a version that resolves this vulnerability.Fixed in 1.19.9-1.module+el8.4.0+14872+9efa52a3 - Upgrade
Upgrade
redhat/conmon-debuginfoto a version that resolves this vulnerability.Fixed in 2.0.26-1.module+el8.4.0+14872+9efa52a3 - Upgrade
Upgrade
redhat/conmon-debugsourceto a version that resolves this vulnerability.Fixed in 2.0.26-1.module+el8.4.0+14872+9efa52a3 - Upgrade
Upgrade
redhat/containernetworking-plugins-debuginfoto a version that resolves this vulnerability.Fixed in 0.9.1-1.module+el8.4.0+14872+9efa52a3 - Upgrade
Upgrade
redhat/containernetworking-plugins-debugsourceto a version that resolves this vulnerability.Fixed in 0.9.1-1.module+el8.4.0+14872+9efa52a3 - Upgrade
Upgrade
redhat/containers-commonto a version that resolves this vulnerability.Fixed in 1.2.2-8.module+el8.4.0+14872+9efa52a3 - Upgrade
Upgrade
redhat/critto a version that resolves this vulnerability.Fixed in 3.15-1.module+el8.4.0+14872+9efa52a3 - Upgrade
Upgrade
redhat/criu-debuginfoto a version that resolves this vulnerability.Fixed in 3.15-1.module+el8.4.0+14872+9efa52a3 - Upgrade
Upgrade
redhat/criu-debugsourceto a version that resolves this vulnerability.Fixed in 3.15-1.module+el8.4.0+14872+9efa52a3 - Upgrade
Upgrade
redhat/crun-debuginfoto a version that resolves this vulnerability.Fixed in 0.18-2.module+el8.4.0+14872+9efa52a3 - Upgrade
Upgrade
redhat/crun-debugsourceto a version that resolves this vulnerability.Fixed in 0.18-2.module+el8.4.0+14872+9efa52a3 - Upgrade
Upgrade
redhat/fuse-overlayfs-debuginfoto a version that resolves this vulnerability.Fixed in 1.4.0-2.module+el8.4.0+14872+9efa52a3 - Upgrade
Upgrade
redhat/fuse-overlayfs-debugsourceto a version that resolves this vulnerability.Fixed in 1.4.0-2.module+el8.4.0+14872+9efa52a3 - Upgrade
Upgrade
redhat/libslirp-debuginfoto a version that resolves this vulnerability.Fixed in 4.3.1-1.module+el8.4.0+14872+9efa52a3 - Upgrade
Upgrade
redhat/libslirp-debugsourceto a version that resolves this vulnerability.Fixed in 4.3.1-1.module+el8.4.0+14872+9efa52a3 - Upgrade
Upgrade
redhat/libslirp-develto a version that resolves this vulnerability.Fixed in 4.3.1-1.module+el8.4.0+14872+9efa52a3 - Upgrade
Upgrade
redhat/oci-seccomp-bpf-hook-debuginfoto a version that resolves this vulnerability.Fixed in 1.2.0-1.module+el8.4.0+14872+9efa52a3 - Upgrade
Upgrade
redhat/oci-seccomp-bpf-hook-debugsourceto a version that resolves this vulnerability.Fixed in 1.2.0-1.module+el8.4.0+14872+9efa52a3 - Upgrade
Upgrade
redhat/podman-catatonitto a version that resolves this vulnerability.Fixed in 3.0.1-9.module+el8.4.0+14872+9efa52a3 - Upgrade
Upgrade
redhat/podman-catatonit-debuginfoto a version that resolves this vulnerability.Fixed in 3.0.1-9.module+el8.4.0+14872+9efa52a3 - Upgrade
Upgrade
redhat/podman-debuginfoto a version that resolves this vulnerability.Fixed in 3.0.1-9.module+el8.4.0+14872+9efa52a3 - Upgrade
Upgrade
redhat/podman-debugsourceto a version that resolves this vulnerability.Fixed in 3.0.1-9.module+el8.4.0+14872+9efa52a3 - Upgrade
Upgrade
redhat/podman-pluginsto a version that resolves this vulnerability.Fixed in 3.0.1-9.module+el8.4.0+14872+9efa52a3 - Upgrade
Upgrade
redhat/podman-plugins-debuginfoto a version that resolves this vulnerability.Fixed in 3.0.1-9.module+el8.4.0+14872+9efa52a3 - Upgrade
Upgrade
redhat/podman-remoteto a version that resolves this vulnerability.Fixed in 3.0.1-9.module+el8.4.0+14872+9efa52a3 - Upgrade
Upgrade
redhat/podman-remote-debuginfoto a version that resolves this vulnerability.Fixed in 3.0.1-9.module+el8.4.0+14872+9efa52a3 - Upgrade
Upgrade
redhat/podman-teststo a version that resolves this vulnerability.Fixed in 3.0.1-9.module+el8.4.0+14872+9efa52a3 - Upgrade
Upgrade
redhat/python3-criuto a version that resolves this vulnerability.Fixed in 3.15-1.module+el8.4.0+14872+9efa52a3 - Upgrade
Upgrade
redhat/runc-debuginfoto a version that resolves this vulnerability.Fixed in 1.0.0-76.rc95.module+el8.4.0+14872+9efa52a3 - Upgrade
Upgrade
redhat/runc-debugsourceto a version that resolves this vulnerability.Fixed in 1.0.0-76.rc95.module+el8.4.0+14872+9efa52a3 - Upgrade
Upgrade
redhat/skopeo-debuginfoto a version that resolves this vulnerability.Fixed in 1.2.2-8.module+el8.4.0+14872+9efa52a3 - Upgrade
Upgrade
redhat/skopeo-debugsourceto a version that resolves this vulnerability.Fixed in 1.2.2-8.module+el8.4.0+14872+9efa52a3 - Upgrade
Upgrade
redhat/skopeo-teststo a version that resolves this vulnerability.Fixed in 1.2.2-8.module+el8.4.0+14872+9efa52a3 - Upgrade
Upgrade
redhat/slirp4netns-debuginfoto a version that resolves this vulnerability.Fixed in 1.1.8-1.module+el8.4.0+14872+9efa52a3 - Upgrade
Upgrade
redhat/slirp4netns-debugsourceto a version that resolves this vulnerability.Fixed in 1.1.8-1.module+el8.4.0+14872+9efa52a3 - Upgrade
Upgrade
redhat/buildahto a version that resolves this vulnerability.Fixed in 1.19.9-1.module+el8.4.0+14872+9efa52a3.aa - Upgrade
Upgrade
redhat/buildah-debuginfoto a version that resolves this vulnerability.Fixed in 1.19.9-1.module+el8.4.0+14872+9efa52a3.aa - Upgrade
Upgrade
redhat/buildah-debugsourceto a version that resolves this vulnerability.Fixed in 1.19.9-1.module+el8.4.0+14872+9efa52a3.aa - Upgrade
Upgrade
redhat/buildah-teststo a version that resolves this vulnerability.Fixed in 1.19.9-1.module+el8.4.0+14872+9efa52a3.aa - Upgrade
Upgrade
redhat/buildah-tests-debuginfoto a version that resolves this vulnerability.Fixed in 1.19.9-1.module+el8.4.0+14872+9efa52a3.aa - Upgrade
Upgrade
redhat/conmonto a version that resolves this vulnerability.Fixed in 2.0.26-1.module+el8.4.0+14872+9efa52a3.aa - Upgrade
Upgrade
redhat/conmon-debuginfoto a version that resolves this vulnerability.Fixed in 2.0.26-1.module+el8.4.0+14872+9efa52a3.aa - Upgrade
Upgrade
redhat/conmon-debugsourceto a version that resolves this vulnerability.Fixed in 2.0.26-1.module+el8.4.0+14872+9efa52a3.aa - Upgrade
Upgrade
redhat/containernetworking-pluginsto a version that resolves this vulnerability.Fixed in 0.9.1-1.module+el8.4.0+14872+9efa52a3.aa - Upgrade
Upgrade
redhat/containernetworking-plugins-debuginfoto a version that resolves this vulnerability.Fixed in 0.9.1-1.module+el8.4.0+14872+9efa52a3.aa - Upgrade
Upgrade
redhat/containernetworking-plugins-debugsourceto a version that resolves this vulnerability.Fixed in 0.9.1-1.module+el8.4.0+14872+9efa52a3.aa - Upgrade
Upgrade
redhat/containers-commonto a version that resolves this vulnerability.Fixed in 1.2.2-8.module+el8.4.0+14872+9efa52a3.aa - Upgrade
Upgrade
redhat/critto a version that resolves this vulnerability.Fixed in 3.15-1.module+el8.4.0+14872+9efa52a3.aa - Upgrade
Upgrade
redhat/criuto a version that resolves this vulnerability.Fixed in 3.15-1.module+el8.4.0+14872+9efa52a3.aa - Upgrade
Upgrade
redhat/criu-debuginfoto a version that resolves this vulnerability.Fixed in 3.15-1.module+el8.4.0+14872+9efa52a3.aa - Upgrade
Upgrade
redhat/criu-debugsourceto a version that resolves this vulnerability.Fixed in 3.15-1.module+el8.4.0+14872+9efa52a3.aa - Upgrade
Upgrade
redhat/crunto a version that resolves this vulnerability.Fixed in 0.18-2.module+el8.4.0+14872+9efa52a3.aa - Upgrade
Upgrade
redhat/crun-debuginfoto a version that resolves this vulnerability.Fixed in 0.18-2.module+el8.4.0+14872+9efa52a3.aa - Upgrade
Upgrade
redhat/crun-debugsourceto a version that resolves this vulnerability.Fixed in 0.18-2.module+el8.4.0+14872+9efa52a3.aa - Upgrade
Upgrade
redhat/fuse-overlayfsto a version that resolves this vulnerability.Fixed in 1.4.0-2.module+el8.4.0+14872+9efa52a3.aa - Upgrade
Upgrade
redhat/fuse-overlayfs-debuginfoto a version that resolves this vulnerability.Fixed in 1.4.0-2.module+el8.4.0+14872+9efa52a3.aa - Upgrade
Upgrade
redhat/fuse-overlayfs-debugsourceto a version that resolves this vulnerability.Fixed in 1.4.0-2.module+el8.4.0+14872+9efa52a3.aa - Upgrade
Upgrade
redhat/libslirpto a version that resolves this vulnerability.Fixed in 4.3.1-1.module+el8.4.0+14872+9efa52a3.aa - Upgrade
Upgrade
redhat/libslirp-debuginfoto a version that resolves this vulnerability.Fixed in 4.3.1-1.module+el8.4.0+14872+9efa52a3.aa - Upgrade
Upgrade
redhat/libslirp-debugsourceto a version that resolves this vulnerability.Fixed in 4.3.1-1.module+el8.4.0+14872+9efa52a3.aa - Upgrade
Upgrade
redhat/libslirp-develto a version that resolves this vulnerability.Fixed in 4.3.1-1.module+el8.4.0+14872+9efa52a3.aa - Upgrade
Upgrade
redhat/oci-seccomp-bpf-hookto a version that resolves this vulnerability.Fixed in 1.2.0-1.module+el8.4.0+14872+9efa52a3.aa - Upgrade
Upgrade
redhat/oci-seccomp-bpf-hook-debuginfoto a version that resolves this vulnerability.Fixed in 1.2.0-1.module+el8.4.0+14872+9efa52a3.aa - Upgrade
Upgrade
redhat/oci-seccomp-bpf-hook-debugsourceto a version that resolves this vulnerability.Fixed in 1.2.0-1.module+el8.4.0+14872+9efa52a3.aa - Upgrade
Upgrade
redhat/podmanto a version that resolves this vulnerability.Fixed in 3.0.1-9.module+el8.4.0+14872+9efa52a3.aa - Upgrade
Upgrade
redhat/podman-catatonitto a version that resolves this vulnerability.Fixed in 3.0.1-9.module+el8.4.0+14872+9efa52a3.aa - Upgrade
Upgrade
redhat/podman-catatonit-debuginfoto a version that resolves this vulnerability.Fixed in 3.0.1-9.module+el8.4.0+14872+9efa52a3.aa - Upgrade
Upgrade
redhat/podman-debuginfoto a version that resolves this vulnerability.Fixed in 3.0.1-9.module+el8.4.0+14872+9efa52a3.aa - Upgrade
Upgrade
redhat/podman-debugsourceto a version that resolves this vulnerability.Fixed in 3.0.1-9.module+el8.4.0+14872+9efa52a3.aa - Upgrade
Upgrade
redhat/podman-pluginsto a version that resolves this vulnerability.Fixed in 3.0.1-9.module+el8.4.0+14872+9efa52a3.aa - Upgrade
Upgrade
redhat/podman-plugins-debuginfoto a version that resolves this vulnerability.Fixed in 3.0.1-9.module+el8.4.0+14872+9efa52a3.aa - Upgrade
Upgrade
redhat/podman-remoteto a version that resolves this vulnerability.Fixed in 3.0.1-9.module+el8.4.0+14872+9efa52a3.aa - Upgrade
Upgrade
redhat/podman-remote-debuginfoto a version that resolves this vulnerability.Fixed in 3.0.1-9.module+el8.4.0+14872+9efa52a3.aa - Upgrade
Upgrade
redhat/podman-teststo a version that resolves this vulnerability.Fixed in 3.0.1-9.module+el8.4.0+14872+9efa52a3.aa - Upgrade
Upgrade
redhat/python3-criuto a version that resolves this vulnerability.Fixed in 3.15-1.module+el8.4.0+14872+9efa52a3.aa - Upgrade
Upgrade
redhat/runcto a version that resolves this vulnerability.Fixed in 1.0.0-76.rc95.module+el8.4.0+14872+9efa52a3.aa - Upgrade
Upgrade
redhat/runc-debuginfoto a version that resolves this vulnerability.Fixed in 1.0.0-76.rc95.module+el8.4.0+14872+9efa52a3.aa - Upgrade
Upgrade
redhat/runc-debugsourceto a version that resolves this vulnerability.Fixed in 1.0.0-76.rc95.module+el8.4.0+14872+9efa52a3.aa - Upgrade
Upgrade
redhat/skopeoto a version that resolves this vulnerability.Fixed in 1.2.2-8.module+el8.4.0+14872+9efa52a3.aa - Upgrade
Upgrade
redhat/skopeo-debuginfoto a version that resolves this vulnerability.Fixed in 1.2.2-8.module+el8.4.0+14872+9efa52a3.aa - Upgrade
Upgrade
redhat/skopeo-debugsourceto a version that resolves this vulnerability.Fixed in 1.2.2-8.module+el8.4.0+14872+9efa52a3.aa - Upgrade
Upgrade
redhat/skopeo-teststo a version that resolves this vulnerability.Fixed in 1.2.2-8.module+el8.4.0+14872+9efa52a3.aa - Upgrade
Upgrade
redhat/slirp4netnsto a version that resolves this vulnerability.Fixed in 1.1.8-1.module+el8.4.0+14872+9efa52a3.aa - Upgrade
Upgrade
redhat/slirp4netns-debuginfoto a version that resolves this vulnerability.Fixed in 1.1.8-1.module+el8.4.0+14872+9efa52a3.aa - Upgrade
Upgrade
redhat/slirp4netns-debugsourceto a version that resolves this vulnerability.Fixed in 1.1.8-1.module+el8.4.0+14872+9efa52a3.aa - Upgrade
Upgrade
container-toolsto a version that resolves this vulnerability.Fixed in 3.0 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch CVE-2022-27651 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch CVE-2022-27649 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch CVE-2022-1227
Event History
Frequently Asked Questions
What is the severity of RHSA-2022:4816?
The severity of RHSA-2022:4816 is classified as important.
How do I fix RHSA-2022:4816?
To fix RHSA-2022:4816, update affected packages to their respective versions specified in the advisory.
What vulnerabilities are addressed in RHSA-2022:4816?
RHSA-2022:4816 addresses vulnerabilities including privilege escalation issues in 'podman top' (CVE-2022-1227).
Which packages are affected by RHSA-2022:4816?
Packages affected by RHSA-2022:4816 include podman, buildah, conmon, and various other container tools.
Is there a workaround for RHSA-2022:4816?
There are no official workarounds provided for RHSA-2022:4816; it is recommended to apply the security updates.