docker-1.13.1-161.git64e9980.0.1.el7.AXS7
エラータID: AXSA:2020-4546:03
リリース日:
2020/04/02 Thursday - 05:52
題名:
docker-1.13.1-161.git64e9980.0.1.el7.AXS7
影響のあるチャネル:
Asianux Server 7 for x86_64
Severity:
Moderate
Description:
以下項目について対処しました。
[Security Fix]
- runc には libcontainer/rootfs_linux.go がマウントターゲットのチェックが誤っていた
ため、AppArmor の制限を迂回し、不正な Docker イメージを /proc ディレクトリ上でマウン
トできる脆弱性があります。(CVE-2019-16884)
- GPGME ライブラリ用の proglottis Go ラッパーには、Docker あるいは CRI-O によって
コンテナイメージを pull することで例証されるように、解放後使用の問題があり、GPG 署名の
検証の間にクラッシュあるいは潜在的にコードの実行につながる脆弱性があります。
(CVE-2020-8945)
- 現時点では CVE-2020-1702 の情報が公開されておりません。
CVE の情報が公開され次第情報をアップデートいたします。
一部CVEの翻訳文はJVNからの引用になります。
http://jvndb.jvn.jp/
解決策:
パッケージをアップデートしてください。
CVE:
CVE-2019-16884
runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /proc directory.
runc through 1.0.0-rc8, as used in Docker through 19.03.2-ce and other products, allows AppArmor restriction bypass because libcontainer/rootfs_linux.go incorrectly checks mount targets, and thus a malicious Docker image can mount over a /proc directory.
CVE-2020-1702
** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.
** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.
CVE-2020-8945
The proglottis Go wrapper before 0.1.1 for the GPGME library has a use-after-free, as demonstrated by use for container image pulls by Docker or CRI-O. This leads to a crash or potential code execution during GPG signature verification.
The proglottis Go wrapper before 0.1.1 for the GPGME library has a use-after-free, as demonstrated by use for container image pulls by Docker or CRI-O. This leads to a crash or potential code execution during GPG signature verification.
追加情報:
N/A
ダウンロード:
SRPMS
- docker-1.13.1-161.git64e9980.0.1.el7.AXS7.src.rpm
MD5: ee4f59c5a6f895d7c23a2fe36a79f29b
SHA-256: 6e11ae124abe5a44c8658d935fa79cefef9f67201933aad737af14b4ceeb84a9
Size: 15.05 MB
Asianux Server 7 for x86_64
- docker-1.13.1-161.git64e9980.0.1.el7.AXS7.x86_64.rpm
MD5: 5495f24ea1f070ddee0ff168afd8358c
SHA-256: 441c63d6fcdb77795fc91405f5171bcd8dec4fb2711035db0121ae162cdcaded
Size: 17.67 MB - docker-client-1.13.1-161.git64e9980.0.1.el7.AXS7.x86_64.rpm
MD5: 02371349bffefb3c745dac971e740fbb
SHA-256: 073e0f12153aad4ad381e5916387b976121c712ed80aa4050075121d647e065f
Size: 3.90 MB - docker-common-1.13.1-161.git64e9980.0.1.el7.AXS7.x86_64.rpm
MD5: 3167baf139b751df8f90c0ba3633394e
SHA-256: 5ead7772c13b61db9e31fbc7f468d31264018ef8a7a4e3ecfce94b8d32ad068e
Size: 98.42 kB - docker-logrotate-1.13.1-161.git64e9980.0.1.el7.AXS7.x86_64.rpm
MD5: eb5115872e41f31ecef4770a35d99fc9
SHA-256: 702908df0d57a00046ad5f0fbf63700fbef72a1868f46498096e96e31ed076de
Size: 96.39 kB - docker-lvm-plugin-1.13.1-161.git64e9980.0.1.el7.AXS7.x86_64.rpm
MD5: f3e730ffd148d0760a740e43f4265168
SHA-256: 23377b546f81096b69d6fb78f482edbc652af0a6975ca8303700334097e62d65
Size: 1.87 MB - docker-novolume-plugin-1.13.1-161.git64e9980.0.1.el7.AXS7.x86_64.rpm
MD5: 2083c2127a15de401e7d2e99ad9692a2
SHA-256: e7e48f3dcfefdb3846c35c2d81d438ef31a9ab867c9984229aefde713814014c
Size: 1.89 MB - docker-v1.10-migrator-1.13.1-161.git64e9980.0.1.el7.AXS7.x86_64.rpm
MD5: a7f811b35ad2a3e6dfedfba2d9cf01f9
SHA-256: 2319717df36d9f85099bcea14d6d50426d81dd9df959b56d12980c5f68bac2ef
Size: 2.68 MB
English