Bug 33036 - buildah and podman new security issues CVE-2024-1753, CVE-2023-45290, CVE-2024-28180 and CVE-2024-28176; buildah and skopeo new security issue CVE-2024-3727; podman new security issue CVE-2024-6104
Summary: buildah and podman new security issues CVE-2024-1753, CVE-2023-45290, CVE-202...
Status: NEW
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: Cauldron
Hardware: All Linux
Priority: Normal major
Target Milestone: ---
Assignee: Joseph Wang
QA Contact: Sec team
URL:
Whiteboard: MGA9TOO
Keywords:
Depends on:
Blocks:
 
Reported: 2024-03-29 14:52 CET by Nicolas Salguero
Modified: 2024-07-04 09:18 CEST (History)
0 users

See Also:
Source RPM: buildah-1.35.0-1.mga10.src.rpm, podman-4.8.3-1.mga10.src.rpm, skopeo-1.12.0-1.mga9.src.rpm
CVE: CVE-2024-1753, CVE-2024-3727, CVE-2023-45290, CVE-2024-28180, CVE-2024-28176
Status comment: Fixed upstream in buildah 1.35.4 and podman 4.9.4

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description Nicolas Salguero 2024-03-29 14:52:41 CET 
That CVE was announced here:
https://github.com/containers/buildah/security/advisories/GHSA-pmf3-c36m-g5cf
https://github.com/containers/podman/security/advisories/GHSA-874v-pj72-92f3

That problem is fixed in buildah 1.35.1 and podman 4.9.4 (or 5.0.1).

Mageia 9 is also affected.
Nicolas Salguero 2024-03-29 14:53:18 CET

CVE: (none) => CVE-2024-1753
Source RPM: (none) => buildah-1.35.0-1.mga10.src.rpm, podman-4.8.3-1.mga10.src.rpm
Status comment: (none) => Fixed upstream in buildah 1.35.1 and podman 4.9.4
Whiteboard: (none) => MGA9TOO

Comment 1 Lewis Smith 2024-03-31 21:09:29 CEST 
Both new version cures.
Assigning to Joseph who currently maintains these pkgs.

Assignee: bugsquad => joequant

Comment 2 Nicolas Salguero 2024-05-21 09:30:56 CEST 
Fedora has issued an advisory on May 19:
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CYT3D2P3OJKISNFKOOHGY6HCUCQZYAVR/

Status comment: Fixed upstream in buildah 1.35.1 and podman 4.9.4 => Fixed upstream in buildah 1.35.4 and podman 4.9.4
Summary: buildah and podman new security issue CVE-2024-1753 => buildah and podman new security issue CVE-2024-1753, buildah new security issue CVE-2024-3727
CVE: CVE-2024-1753 => CVE-2024-1753, CVE-2024-3727

Comment 3 Nicolas Salguero 2024-06-11 15:30:43 CEST 
SUSE has issued an advisory on June 11:
https://lwn.net/Articles/977925/

Skopeo version 1.14.4 solves the problem so only Mageia 9 is affected.

Source RPM: buildah-1.35.0-1.mga10.src.rpm, podman-4.8.3-1.mga10.src.rpm => buildah-1.35.0-1.mga10.src.rpm, podman-4.8.3-1.mga10.src.rpm, skopeo-1.12.0-1.mga9.src.rpm
Summary: buildah and podman new security issue CVE-2024-1753, buildah new security issue CVE-2024-3727 => buildah and podman new security issue CVE-2024-1753, buildah and skopeo new security issue CVE-2024-3727

Comment 4 Nicolas Salguero 2024-06-13 10:01:29 CEST 
RedHat has issued advisories on June 12:
https://lwn.net/Articles/978101/
https://lwn.net/Articles/978102/

CVE: CVE-2024-1753, CVE-2024-3727 => CVE-2024-1753, CVE-2024-3727, CVE-2023-45290, CVE-2024-28180, CVE-2024-28176
Summary: buildah and podman new security issue CVE-2024-1753, buildah and skopeo new security issue CVE-2024-3727 => buildah and podman new security issues CVE-2024-1753, CVE-2023-45290, CVE-2024-28180 and CVE-2024-28176; buildah and skopeo new security issue CVE-2024-3727

Comment 5 Nicolas Salguero 2024-07-04 09:18:29 CEST 
SUSE has issued an advisory on July 3:
https://lists.suse.com/pipermail/sle-security-updates/2024-July/018858.html

Summary: buildah and podman new security issues CVE-2024-1753, CVE-2023-45290, CVE-2024-28180 and CVE-2024-28176; buildah and skopeo new security issue CVE-2024-3727 => buildah and podman new security issues CVE-2024-1753, CVE-2023-45290, CVE-2024-28180 and CVE-2024-28176; buildah and skopeo new security issue CVE-2024-3727; podman new security issue CVE-2024-6104
Note You need to log in before you can comment on or make changes to this bug.