almalinux/podman-gvproxy

Vulnerabilities (97)

• CVE-2022-1708Jun 7, 2022
  affected < 2:4.0.2-8.module_el8.7.0+3344+5bcd850ffixed 2:4.0.2-8.module_el8.7.0+3344+5bcd850f

  A vulnerability was found in CRI-O that causes memory or disk space exhaustion on the node for anyone with access to the Kube API. The ExecSync request runs commands in a container and logs the output of the command. This output is then read by CRI-O after command execution, and

• CVE-2022-29162May 17, 2022
  affected < 2:4.0.2-8.module_el8.7.0+3344+5bcd850ffixed 2:4.0.2-8.module_el8.7.0+3344+5bcd850f

  runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. A bug was found in runc prior to version 1.1.2 where `runc exec --cap` created processes with non-empty inheritable Linux process capabilities, creating an atypical Linux environme

• CVE-2022-1227Apr 29, 2022
  affected < 2:4.0.2-6.module_el8.6.0+2878+e681bc44fixed 2:4.0.2-6.module_el8.6.0+2878+e681bc44

  A privilege escalation flaw was found in Podman. This flaw allows an attacker to publish a malicious image to a public registry. Once this image is downloaded by a potential victim, the vulnerability is triggered after a user runs the 'podman top' command. This action gives the a

• CVE-2022-27650Apr 4, 2022
  affected < 2:4.0.2-6.module_el8.6.0+2878+e681bc44fixed 2:4.0.2-6.module_el8.6.0+2878+e681bc44

  A flaw was found in crun where containers were incorrectly started with non-empty default permissions. A vulnerability was found in Moby (Docker Engine) where containers were started incorrectly with non-empty inheritable Linux process capabilities. This flaw allows an attacker w

• CVE-2022-27651Apr 4, 2022
  affected < 2:4.0.2-6.module_el8.6.0+2878+e681bc44fixed 2:4.0.2-6.module_el8.6.0+2878+e681bc44

  A flaw was found in buildah where containers were incorrectly started with non-empty default permissions. A bug was found in Moby (Docker Engine) where containers were incorrectly started with non-empty inheritable Linux process capabilities, enabling an attacker with access to p

• CVE-2022-27649Apr 4, 2022
  affected < 2:4.0.2-6.module_el8.6.0+2878+e681bc44fixed 2:4.0.2-6.module_el8.6.0+2878+e681bc44

  A flaw was found in Podman, where containers were started incorrectly with non-empty default permissions. A vulnerability was found in Moby (Docker Engine), where containers were started incorrectly with non-empty inheritable Linux process capabilities. This flaw allows an attack

• CVE-2022-27191Mar 18, 2022
  affected < 2:4.0.2-8.module_el8.7.0+3344+5bcd850ffixed 2:4.0.2-8.module_el8.7.0+3344+5bcd850f

  The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey.

• CVE-2022-21698Feb 15, 2022
  affected < 2:4.0.2-6.module_el8.6.0+2878+e681bc44fixed 2:4.0.2-6.module_el8.6.0+2878+e681bc44

  client_golang is the instrumentation library for Go applications in Prometheus, and the promhttp package in client_golang provides tooling around HTTP servers and clients. In client_golang prior to version 1.11.1, HTTP server is susceptible to a Denial of Service through unbounde

• CVE-2021-4024Dec 23, 2021
  affected < 2:4.2.0-3.el9fixed 2:4.2.0-3.el9

  A flaw was found in podman. The `podman machine` function (used to create and manage Podman virtual machine containing a Podman process) spawns a `gvproxy` process on the host system. The `gvproxy` API is accessible on port 7777 on all IP addresses on the host. If that port is op

• CVE-2021-33198Aug 2, 2021
  affected < 4:4.9.4-18.module_el8.10.0+3926+f12484f5fixed 4:4.9.4-18.module_el8.10.0+3926+f12484f5

  In Go before 1.15.13 and 1.16.x before 1.16.5, there can be a panic for a large exponent to the math/big.Rat SetString or UnmarshalText method.

• CVE-2021-33197Aug 2, 2021
  affected < 2:4.2.0-3.el9fixed 2:4.2.0-3.el9

  In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from net/http/httputil) result in a situation where an attacker is able to drop arbitrary headers.

• CVE-2021-34558Jul 15, 2021
  affected < 2:4.2.0-3.el9fixed 2:4.2.0-3.el9

  The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS server to cause a TLS client to panic.

• CVE-2021-20291Apr 1, 2021
  affected < 2:4.2.0-3.el9fixed 2:4.2.0-3.el9

  A deadlock vulnerability was found in 'github.com/containers/storage' in versions before 1.28.1. When a container image is processed, each layer is unpacked using `tar`. If one of those layers is not a valid `tar` archive this causes an error leading to an unexpected situation wh

• CVE-2021-20199Feb 2, 2021
  affected < 2:4.2.0-3.el9fixed 2:4.2.0-3.el9

  Rootless containers run with Podman, receive all traffic with a source IP address of 127.0.0.1 (including from remote hosts). This impacts containerized applications that trust localhost (127.0.01) connections by default and do not require authentication. This issue affects Podma

• CVE-2020-28852Jan 2, 2021
  affected < 2:4.2.0-3.el9fixed 2:4.2.0-3.el9

  In x/text in Go before v0.3.5, a "slice bounds out of range" panic occurs in language.ParseAcceptLanguage while processing a BCP 47 tag. (x/text/language is supposed to be able to parse an HTTP Accept-Language header.)

• CVE-2020-28851Jan 2, 2021
  affected < 2:4.2.0-3.el9fixed 2:4.2.0-3.el9

  In x/text in Go 1.15.4, an "index out of range" panic occurs in language.ParseAcceptLanguage while parsing the -u- extension. (x/text/language is supposed to be able to parse an HTTP Accept-Language header.)

• CVE-2019-19921Feb 12, 2020
  affected < 2:4.0.2-24.module_el8.9.0+3627+db8ec155fixed 2:4.0.2-24.module_el8.9.0+3627+db8ec155

  runc through 1.0.0-rc9 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. (This vul