SB2023072574 - Anolis OS update for container-tools:an8 module 

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2023072574

SB2023072574 - Anolis OS update for container-tools:an8 module

Published: July 25, 2023 Updated: March 28, 2025

Security Bulletin ID SB2023072574
Severity
Medium
Patch available
YES
Number of vulnerabilities 2
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 50% Low 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.


1) Use of a broken or risky cryptographic algorithm (CVE-ID: CVE-2022-27191)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to an error in golang.org/x/crypto/ssh before 0.0.0-20220314234659-1baeb1ce4c0b, as used in Go programming language. A remote attacker can crash a server in certain circumstances involving AddHostKey.


2) Incorrect authorization (CVE-ID: CVE-2022-2989)

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to incorrect handling of the supplementary groups in the Podman container engine. A local user with direct access to the affected container where supplementary groups are used can set access permissions and execute a binary code in that container.


Remediation

Install update from vendor's website.

References