Anolis OS update for container-tools:an8 module
| Risk | Medium |
| Patch available | YES |
| Number of vulnerabilities | 2 |
| CVE-ID | CVE-2022-27191 CVE-2022-2989 |
| CWE-ID | CWE-327 CWE-863 |
| Exploitation vector | Network |
| Public exploit | N/A |
| Vulnerable software |
Anolis OS Operating systems & Components / Operating system podman-docker Operating systems & Components / Operating system package or component container-selinux Operating systems & Components / Operating system package or component runc Operating systems & Components / Operating system package or component podman-tests Operating systems & Components / Operating system package or component podman-remote Operating systems & Components / Operating system package or component podman-plugins Operating systems & Components / Operating system package or component podman-gvproxy Operating systems & Components / Operating system package or component podman-catatonit Operating systems & Components / Operating system package or component podman Operating systems & Components / Operating system package or component netavark Operating systems & Components / Operating system package or component containers-common Operating systems & Components / Operating system package or component containernetworking-plugins Operating systems & Components / Operating system package or component buildah-tests Operating systems & Components / Operating system package or component buildah Operating systems & Components / Operating system package or component aardvark-dns Operating systems & Components / Operating system package or component udica Operating systems & Components / Operating system package or component python3-podman Operating systems & Components / Operating system package or component cockpit-podman Operating systems & Components / Operating system package or component toolbox-tests Operating systems & Components / Operating system package or component toolbox Operating systems & Components / Operating system package or component slirp4netns Operating systems & Components / Operating system package or component skopeo-tests Operating systems & Components / Operating system package or component skopeo Operating systems & Components / Operating system package or component python3-criu Operating systems & Components / Operating system package or component oci-seccomp-bpf-hook Operating systems & Components / Operating system package or component libslirp-devel Operating systems & Components / Operating system package or component libslirp Operating systems & Components / Operating system package or component fuse-overlayfs Operating systems & Components / Operating system package or component crun Operating systems & Components / Operating system package or component criu-libs Operating systems & Components / Operating system package or component criu-devel Operating systems & Components / Operating system package or component criu Operating systems & Components / Operating system package or component crit Operating systems & Components / Operating system package or component conmon Operating systems & Components / Operating system package or component |
| Vendor | OpenAnolis |
Security Bulletin
This security bulletin contains information about 2 vulnerabilities.
1) Use of a broken or risky cryptographic algorithm
EUVDB-ID: #VU62039
Risk: Medium
CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]
CVE-ID: CVE-2022-27191
CWE-ID:
CWE-327 - Use of a Broken or Risky Cryptographic Algorithm
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to an error in golang.org/x/crypto/ssh before 0.0.0-20220314234659-1baeb1ce4c0b, as used in Go programming language. A remote attacker can crash a server in certain circumstances involving AddHostKey.
MitigationInstall updates from vendor's repository.
Vulnerable software versionsAnolis OS: 8
podman-docker: before 4.0.2-6
container-selinux: before 2.179.1-1
runc: before 1.0.3-2
podman-tests: before 4.0.2-6
podman-remote: before 4.0.2-6
podman-plugins: before 4.0.2-6
podman-gvproxy: before 4.0.2-6
podman-catatonit: before 4.0.2-6
podman: before 4.0.2-6
netavark: before 1.0.1-27
containers-common: before 1-27
containernetworking-plugins: before 1.0.1-2
buildah-tests: before 1.24.2-4
buildah: before 1.24.2-4
aardvark-dns: before 1.0.1-27
udica: before 0.2.6-3
python3-podman: before 4.0.0-1
cockpit-podman: before 43-1
toolbox-tests: before 0.0.99.3-0.4
toolbox: before 0.0.99.3-0.4
slirp4netns: before 1.1.8-2
skopeo-tests: before 1.6.1-2
skopeo: before 1.6.1-2
python3-criu: before 3.15-3
oci-seccomp-bpf-hook: before 1.2.3-3
libslirp-devel: before 4.4.0-1
libslirp: before 4.4.0-1
fuse-overlayfs: before 1.8.2-1
crun: before 1.4.4-1
criu-libs: before 3.15-3
criu-devel: before 3.15-3
criu: before 3.15-3
crit: before 3.15-3
conmon: before 2.1.0-1
CPE2.3- cpe:2.3:o:openanolis:anolis_os:8:*:*:*:*:*:*:*
- cpe:2.3:o:openanolis:podman-docker:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:container-selinux:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:runc:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:podman-tests:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:podman-remote:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:podman-plugins:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:podman-gvproxy:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:podman-catatonit:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:podman:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:netavark:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:containers-common:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:containernetworking-plugins:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:buildah-tests:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:buildah:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:aardvark-dns:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:udica:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:python3-podman:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:cockpit-podman:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:toolbox-tests:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:toolbox:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:slirp4netns:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:skopeo-tests:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:skopeo:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:python3-criu:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:oci-seccomp-bpf-hook:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:libslirp-devel:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:libslirp:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:fuse-overlayfs:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:crun:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:criu-libs:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:criu-devel:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:criu:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:crit:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:conmon:*:*:*:*:*:anolis_os:*:*
https://anas.openanolis.cn/errata/detail/ANSA-2023:0440
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Incorrect authorization
EUVDB-ID: #VU69290
Risk: Low
CVSSv4.0: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID: CVE-2022-2989
CWE-ID:
CWE-863 - Incorrect Authorization
Exploit availability: No
DescriptionThe vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to incorrect handling of the supplementary groups in the Podman container engine. A local user with direct access to the affected container where supplementary groups are used can set access permissions and execute a binary code in that container.
Install updates from vendor's repository.
Vulnerable software versionsAnolis OS: 8
podman-docker: before 4.0.2-6
container-selinux: before 2.179.1-1
runc: before 1.0.3-2
podman-tests: before 4.0.2-6
podman-remote: before 4.0.2-6
podman-plugins: before 4.0.2-6
podman-gvproxy: before 4.0.2-6
podman-catatonit: before 4.0.2-6
podman: before 4.0.2-6
netavark: before 1.0.1-27
containers-common: before 1-27
containernetworking-plugins: before 1.0.1-2
buildah-tests: before 1.24.2-4
buildah: before 1.24.2-4
aardvark-dns: before 1.0.1-27
udica: before 0.2.6-3
python3-podman: before 4.0.0-1
cockpit-podman: before 43-1
toolbox-tests: before 0.0.99.3-0.4
toolbox: before 0.0.99.3-0.4
slirp4netns: before 1.1.8-2
skopeo-tests: before 1.6.1-2
skopeo: before 1.6.1-2
python3-criu: before 3.15-3
oci-seccomp-bpf-hook: before 1.2.3-3
libslirp-devel: before 4.4.0-1
libslirp: before 4.4.0-1
fuse-overlayfs: before 1.8.2-1
crun: before 1.4.4-1
criu-libs: before 3.15-3
criu-devel: before 3.15-3
criu: before 3.15-3
crit: before 3.15-3
conmon: before 2.1.0-1
CPE2.3- cpe:2.3:o:openanolis:anolis_os:8:*:*:*:*:*:*:*
- cpe:2.3:o:openanolis:podman-docker:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:container-selinux:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:runc:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:podman-tests:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:podman-remote:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:podman-plugins:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:podman-gvproxy:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:podman-catatonit:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:podman:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:netavark:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:containers-common:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:containernetworking-plugins:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:buildah-tests:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:buildah:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:aardvark-dns:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:udica:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:python3-podman:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:cockpit-podman:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:toolbox-tests:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:toolbox:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:slirp4netns:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:skopeo-tests:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:skopeo:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:python3-criu:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:oci-seccomp-bpf-hook:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:libslirp-devel:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:libslirp:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:fuse-overlayfs:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:crun:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:criu-libs:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:criu-devel:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:criu:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:crit:*:*:*:*:*:anolis_os:*:*
- cpe:2.3:o:openanolis:conmon:*:*:*:*:*:anolis_os:*:*
https://anas.openanolis.cn/errata/detail/ANSA-2023:0440
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
