SUSE update for buildah



Published: 2022-09-30
Risk High
Patch available YES
Number of vulnerabilities 3
CVE-ID CVE-2020-10696
CVE-2021-20206
CVE-2022-27651
CWE-ID CWE-22
CWE-424
CWE-276
Exploitation vector Network
Public exploit N/A
Vulnerable software
Subscribe 		SUSE Enterprise Storage
Operating systems & Components / Operating system

SUSE Manager Server
Operating systems & Components / Operating system

SUSE Manager Retail Branch Server
Operating systems & Components / Operating system

SUSE Manager Proxy
Operating systems & Components / Operating system

SUSE Linux Enterprise Server for SAP
Operating systems & Components / Operating system

SUSE Linux Enterprise Server
Operating systems & Components / Operating system

SUSE Linux Enterprise High Performance Computing
Operating systems & Components / Operating system

SUSE CaaS Platform
Operating systems & Components / Operating system

buildah
Operating systems & Components / Operating system package or component

Vendor SUSE

Security Bulletin

This security bulletin contains information about 3 vulnerabilities.

1) Path traversal

EUVDB-ID: #VU26643

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-10696

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform directory traversal attacks.

The vulnerability exists due to input validation error when processing directory traversal sequences. A remote attacker can trick a victim to build a malicious container image hosted on an HTTP(s) server and then write files to the user's system anywhere that the user has permissions.

Mitigation

Update the affected package buildah to the latest version.

Vulnerable software versions

SUSE Enterprise Storage: 6 - 7.1

SUSE Manager Server: 4.1

SUSE Manager Retail Branch Server: 4.1

SUSE Manager Proxy: 4.1

SUSE Linux Enterprise Server for SAP: 15-SP1 - 15-SP2

SUSE Linux Enterprise Server: 15-SP1-BCL - 15-SP2-LTSS

SUSE Linux Enterprise High Performance Computing: 15-SP1-ESPOS - 15-SP2-LTSS

SUSE CaaS Platform: 4.0

buildah: before 1.25.1-150100.3.13.12

External links

http://www.suse.com/support/update/announcement/2022/suse-su-20223480-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Improper Protection of Alternate Path

EUVDB-ID: #VU55590

Risk: Medium

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-20206

CWE-ID: CWE-424 - Improper Protection of Alternate Path

Exploit availability: No

Description

The vulnerability allows a remote user to compromise the affected system.

the vulnerability exists due to improper input validation. When specifying the plugin to load in the 'type' field in the network configuration, it is possible to use special elements such as "../" separators to reference binaries elsewhere on the system. This flaw allows a remote user to execute other existing binaries other than the cni plugins/types, such as 'reboot'.

Mitigation

Update the affected package buildah to the latest version.

Vulnerable software versions

SUSE Enterprise Storage: 6 - 7.1

SUSE Manager Server: 4.1

SUSE Manager Retail Branch Server: 4.1

SUSE Manager Proxy: 4.1

SUSE Linux Enterprise Server for SAP: 15-SP1 - 15-SP2

SUSE Linux Enterprise Server: 15-SP1-BCL - 15-SP2-LTSS

SUSE Linux Enterprise High Performance Computing: 15-SP1-ESPOS - 15-SP2-LTSS

SUSE CaaS Platform: 4.0

buildah: before 1.25.1-150100.3.13.12

External links

http://www.suse.com/support/update/announcement/2022/suse-su-20223480-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Incorrect default permissions

EUVDB-ID: #VU61797

Risk: Medium

CVSSv3.1: 4.2 [CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-27651

CWE-ID: CWE-276 - Incorrect Default Permissions

Exploit availability: No

Description

The vulnerability allows a remote attacker to escalate privileges on the system.

The vulnerability exists due to incorrect default permissions for files and folders that are set by the application. A remote attacker can view contents of files and directories or modify them.

Mitigation

Update the affected package buildah to the latest version.

Vulnerable software versions

SUSE Enterprise Storage: 6 - 7.1

SUSE Manager Server: 4.1

SUSE Manager Retail Branch Server: 4.1

SUSE Manager Proxy: 4.1

SUSE Linux Enterprise Server for SAP: 15-SP1 - 15-SP2

SUSE Linux Enterprise Server: 15-SP1-BCL - 15-SP2-LTSS

SUSE Linux Enterprise High Performance Computing: 15-SP1-ESPOS - 15-SP2-LTSS

SUSE CaaS Platform: 4.0

buildah: before 1.25.1-150100.3.13.12

External links

http://www.suse.com/support/update/announcement/2022/suse-su-20223480-1/


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###