SUSE update for podman

1) Security restrictions bypass

EUVDB-ID: #VU62468

Risk: Medium

CVSSv3.1: 6.1 [CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C]

CVE-ID: CVE-2022-1227

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to escalate privileges on the system.

The vulnerability exists due to improper privilege management when running podman top on a container made from a maliciously-crafted image and using a user namespace. An attacker with full access to the container can execute arbitrary code  in the host context.

Mitigation

Update the affected package podman to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Module for Containers: 15-SP4

SUSE Manager Retail Branch Server: 4.3

SUSE Manager Server: 4.3

SUSE Manager Proxy: 4.3

SUSE Linux Enterprise Server: 15-SP4

openSUSE Leap: 15.4

SUSE Linux Enterprise Server for SAP Applications: 15-SP4

SUSE Linux Enterprise High Performance Computing: 15-SP4

podman-docker: before 3.4.7-150400.4.3.1

podman-cni-config: before 3.4.7-150400.4.3.1

podman-remote-debuginfo: before 3.4.7-150400.4.3.1

podman-remote: before 3.4.7-150400.4.3.1

podman-debuginfo: before 3.4.7-150400.4.3.1

podman: before 3.4.7-150400.4.3.1

External links

http://www.suse.com/support/update/announcement/2022/suse-su-20222834-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

2) Input validation error

EUVDB-ID: #VU61599

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-21698

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input within method label cardinality. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Mitigation

Update the affected package podman to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Module for Containers: 15-SP4

SUSE Manager Retail Branch Server: 4.3

SUSE Manager Server: 4.3

SUSE Manager Proxy: 4.3

SUSE Linux Enterprise Server: 15-SP4

openSUSE Leap: 15.4

SUSE Linux Enterprise Server for SAP Applications: 15-SP4

SUSE Linux Enterprise High Performance Computing: 15-SP4

podman-docker: before 3.4.7-150400.4.3.1

podman-cni-config: before 3.4.7-150400.4.3.1

podman-remote-debuginfo: before 3.4.7-150400.4.3.1

podman-remote: before 3.4.7-150400.4.3.1

podman-debuginfo: before 3.4.7-150400.4.3.1

podman: before 3.4.7-150400.4.3.1

External links

http://www.suse.com/support/update/announcement/2022/suse-su-20222834-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Use of a broken or risky cryptographic algorithm

EUVDB-ID: #VU62039

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-27191

CWE-ID: CWE-327 - Use of a Broken or Risky Cryptographic Algorithm

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to an error in golang.org/x/crypto/ssh before 0.0.0-20220314234659-1baeb1ce4c0b, as used in Go programming language. A remote attacker can crash a server in certain circumstances involving AddHostKey.

Mitigation

Update the affected package podman to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Module for Containers: 15-SP4

SUSE Manager Retail Branch Server: 4.3

SUSE Manager Server: 4.3

SUSE Manager Proxy: 4.3

SUSE Linux Enterprise Server: 15-SP4

openSUSE Leap: 15.4

SUSE Linux Enterprise Server for SAP Applications: 15-SP4

SUSE Linux Enterprise High Performance Computing: 15-SP4

podman-docker: before 3.4.7-150400.4.3.1

podman-cni-config: before 3.4.7-150400.4.3.1

podman-remote-debuginfo: before 3.4.7-150400.4.3.1

podman-remote: before 3.4.7-150400.4.3.1

podman-debuginfo: before 3.4.7-150400.4.3.1

podman: before 3.4.7-150400.4.3.1

External links

http://www.suse.com/support/update/announcement/2022/suse-su-20222834-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.