SB2022083049 - Anolis OS update for podman

Description

This security bulletin contains information about 4 secuirty vulnerabilities.

1) Use-after-free (CVE-ID: CVE-2022-2738)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a use-after-free error when verifying GPG signature in podman. A remote attacker can can trigger a use-after-free error and perform a denial of service (DoS) attack.

Note, the vulnerability exists due to missing patch for #VU25501 (CVE-2020-8945) in podman Red Hat package.

2) Use-after-free (CVE-ID: CVE-2020-8945)

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error, as demonstrated by use for container image pulls by Docker or CRI-O. A remote attacker can crash the target system, or cause potential code execution for Go applications that use this library under certain conditions during GPG signature verification.

3) Information disclosure (CVE-ID: CVE-2022-2739)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a missing patch for #VU47117 (CVE-2020-14370) in podman Red Hat package. A remote user with control over the subsequent containers could use this flaw to gain access to sensitive information stored in such variables.

4) Information disclosure (CVE-ID: CVE-2020-14370)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to the way application processes environment variables with deprecated Varlink API or the Docker-compatible REST API. If multiple containers are created in a short duration, the environment variables from the first container gets leaked into subsequent containers. A remote user with control over the subsequent containers could use this flaw to gain access to sensitive information stored in such variables.

Remediation

Install update from vendor's website.

References

• https://anas.openanolis.cn/errata/detail/ANSA-2022:0667