Bug 29669 - docker-containerd new security issue CVE-2021-41190
Summary: docker-containerd new security issue CVE-2021-41190
Status: ASSIGNED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 8
Hardware: All Linux
Priority: Normal major
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA8-64-OK
Keywords: validated_update
Depends on:
Blocks:
 
Reported: 2021-11-18 21:54 CET by David Walser
Modified: 2021-11-27 00:03 CET (History)
4 users (show)

See Also:
Source RPM: docker-containerd-1.5.7-1.mga9.src.rpm
CVE:
Status comment:


Attachments

Description David Walser 2021-11-18 21:54:18 CET
Upstream has issued an advisory on November 17:
https://github.com/moby/moby/security/advisories/GHSA-xmmx-7jpf-fx42

The issue is fixed upstream in 1.4.12 and 1.5.8:
https://github.com/containerd/containerd/releases/tag/v1.4.12
https://github.com/containerd/containerd/releases/tag/v1.5.8

It's also mentioned in the Docker/moby 20.10.11 release notes, but probably just because the upstream distribution bundles containerd:
https://github.com/moby/moby/releases/tag/v20.10.11
David Walser 2021-11-18 21:54:43 CET

Status comment: (none) => Fixed upstream in 1.4.12 and 1.5.8
Whiteboard: (none) => MGA8TOO

Comment 1 Bruno Cornec 2021-11-19 00:11:49 CET
Version 1.5.8 pushed to cauldron.

Status: NEW => ASSIGNED

Comment 2 Bruno Cornec 2021-11-19 00:14:30 CET
Same version also pushed to updates_testing for mga8

Assignee: bruno => qa-bugs

Comment 3 David Walser 2021-11-19 00:18:22 CET
docker-containerd-1.5.8-1.mga8

from docker-containerd-1.5.8-1.mga8.src.rpm

Version: Cauldron => 8
Status comment: Fixed upstream in 1.4.12 and 1.5.8 => (none)
CC: (none) => bruno
Whiteboard: MGA8TOO => (none)

Comment 4 Len Lawrence 2021-11-25 19:07:45 CET
mga8, x64

Updated docker-containerd and restarted the docker service.
$ urpmq --requires docker | grep containerd
docker: docker-containerd[>= 1.1.0]

Followed the procedure in bug 29268.
$ docker run hello-world
Hello from Docker!
This message shows that your installation appears to be working correctly.
.................
$ docker run -it ubuntu
root@14c631130af7:/# ls -l
total 48
lrwxrwxrwx   1 root root    7 Jul 23 17:35 bin -> usr/bin
drwxr-xr-x   2 root root 4096 Apr 15  2020 boot
drwxr-xr-x   5 root root  360 Nov 25 17:45 dev
drwxr-xr-x   1 root root 4096 Nov 25 17:45 etc
............
root@14c631130af7:/# ls bin
'['                        getopt             rgrep
 addpart                   gpasswd            rm
.............
root@14c631130af7:/# exit
exit
$ docker ps -a
CONTAINER ID   IMAGE           COMMAND       CREATED         STATUS                      PORTS     NAMES
14c631130af7   ubuntu          "bash"        3 minutes ago   Exited (0) 23 seconds ago             youthful_satoshi
4ebe8822fac9   hello-world     "/hello"      4 minutes ago   Exited (0) 4 minutes ago              funny_bhabha
...........
$ docker rm 88f8321c5926 61f76f4e329d 22517f8bed0e 5b03ae090d6e
88f8321c5926
61f76f4e329d
22517f8bed0e
5b03ae090d6e
$ docker run -it fedora:latest bash
[root@07421e5a620a /]# dnf install ruby
............
Install  11 Packages
Total download size: 4.4 M
Installed size: 16 M
Is this ok [y/N]: y
...............
Installed:
[.....]
  rubygems-3.2.22-149.fc34.noarch                                               
  rubypick-1.1.1-14.fc34.noarch                                                 
Complete!
[root@07421e5a620a /]# ruby -e "puts Object.methods"
.......
equal?
instance_eval
instance_exec
__id__
__send__
[root@07421e5a620a /]# exit

Good enough.

CC: (none) => tarazed25
Whiteboard: (none) => MGA8-64-OK

Comment 5 Thomas Andrews 2021-11-27 00:03:06 CET
Validating.

CC: (none) => andrewsfarm, sysadmin-bugs
Keywords: (none) => validated_update


Note You need to log in before you can comment on or make changes to this bug.