SB2020111317 - Red Hat Enterprise Linux 7 Extras update for podman
Published: November 13, 2020
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 2 secuirty vulnerabilities.
1) Infinite loop (CVE-ID: CVE-2020-14040)
The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.
The x/text package before 0.3.3 for Go has a vulnerability in encoding/unicode that could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory. An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to trigger an infinite loop if the String function on the Decoder is called, or the Decoder is passed to golang.org/x/text/transform.String.
2) Information disclosure (CVE-ID: CVE-2020-14370)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to the way application processes environment variables with deprecated Varlink API or the Docker-compatible REST API. If multiple containers are created in a short duration, the environment variables from the first container gets leaked into subsequent containers. A remote user with control over the subsequent containers could use this flaw to gain access to sensitive information stored in such variables.
Remediation
Install update from vendor's website.