SB2025012448 - openEuler 22.03 LTS SP4 update for podman

Description

This security bulletin contains information about 4 secuirty vulnerabilities.

1) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2022-27649)

The vulnerability allows a remote attacker to escalate privileges on the system.

The vulnerability exists due to excess inheritable capabilities set, which leads to security restrictions bypass and privilege escalation.

2) Incorrect authorization (CVE-ID: CVE-2022-2989)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to incorrect handling of the supplementary groups in the Podman container engine. A local user with direct access to the affected container where supplementary groups are used can set access permissions and execute a binary code in that container.

3) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2023-0778)

The vulnerability allows a remote attacker to gain compromise the affected system.

The vulnerability exists due to a race condition. A remote attacker can replace a normal file in a volume with a symlink while exporting the volume, allowing for access to arbitrary files on the host file system.

4) Cross-site scripting (CVE-ID: CVE-2024-24785)

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data in html/template when parsing errors returned from MarshalJSON methods. A remote attacker can execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Remediation

Install update from vendor's website.

References

• https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2025-1074