{"id":"RLSA-2020:1650","summary":"Moderate: container-tools:rhel8 security, bug fix, and enhancement update","details":"The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.\n\nSecurity Fix(es):\n\n* runc: volume mount race condition with shared mounts leads to information leak/integrity manipulation (CVE-2019-19921)\n\n* containers/image: Container images read entire image manifest into memory (CVE-2020-1702)\n\n* podman: incorrectly allows existing files in volumes to be overwritten by a container when it is created (CVE-2020-1726)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 8.2 Release Notes linked from the References section.","modified":"2026-02-05T06:45:12.461277Z","published":"2020-04-28T09:01:00Z","upstream":["CVE-2019-19921","CVE-2020-1702","CVE-2020-1726"],"references":[{"type":"ADVISORY","url":"https://errata.rockylinux.org/RLSA-2020:1650"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1703245"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1717357"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1731107"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1732704"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1732713"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1748519"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1749999"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1754744"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1754763"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1755119"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1756919"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1757693"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1757845"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1763454"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1766774"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1768930"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1769469"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1771990"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1774755"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1775307"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1776112"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1779834"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1783267"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1783268"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1783270"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1783272"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1783274"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1784267"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1784952"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1788539"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1792796"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1793084"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1793598"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1796107"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1801152"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1802907"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1803496"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1804849"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1805017"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1805212"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1806901"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1808707"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1810053"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1811514"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1813295"}],"affected":[{"package":{"name":"criu","ecosystem":"Rocky Linux:8","purl":"pkg:rpm/rocky-linux/criu?distro=rocky-linux-8&epoch=0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12-9.module+el8.5.0+681+c9a1951f"}],"database_specific":{"yum_repository":"AppStream"}}],"database_specific":{"source":"https://storage.googleapis.com/resf-osv-data/RLSA-2020:1650.json"}},{"package":{"name":"criu","ecosystem":"Rocky Linux:8","purl":"pkg:rpm/rocky-linux/criu?distro=rocky-linux-8-4-legacy&epoch=0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.12-9.module+el8.4.0+557+48ba8b2f"}],"database_specific":{"yum_repository":"AppStream"}}],"database_specific":{"source":"https://storage.googleapis.com/resf-osv-data/RLSA-2020:1650.json"}},{"package":{"name":"python-podman-api","ecosystem":"Rocky Linux:8","purl":"pkg:rpm/rocky-linux/python-podman-api?distro=rocky-linux-8&epoch=0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.0-0.2.gitd0a45fe.module+el8.5.0+770+e2f49861"}],"database_specific":{"yum_repository":"AppStream"}}],"database_specific":{"source":"https://storage.googleapis.com/resf-osv-data/RLSA-2020:1650.json"}},{"package":{"name":"python-podman-api","ecosystem":"Rocky Linux:8","purl":"pkg:rpm/rocky-linux/python-podman-api?distro=rocky-linux-8-4-legacy&epoch=0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.0-0.2.gitd0a45fe.module+el8.4.0+559+c02fa3b2"}],"database_specific":{"yum_repository":"AppStream"}}],"database_specific":{"source":"https://storage.googleapis.com/resf-osv-data/RLSA-2020:1650.json"}},{"package":{"name":"python-podman-api","ecosystem":"Rocky Linux:8","purl":"pkg:rpm/rocky-linux/python-podman-api?distro=rocky-linux-8-5-legacy&epoch=0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.0-0.2.gitd0a45fe.module+el8.5.0+708+6758137d"}],"database_specific":{"yum_repository":"AppStream"}}],"database_specific":{"source":"https://storage.googleapis.com/resf-osv-data/RLSA-2020:1650.json"}},{"package":{"name":"runc","ecosystem":"Rocky Linux:8","purl":"pkg:rpm/rocky-linux/runc?distro=rocky-linux-8-4-legacy&epoch=0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.0-65.rc10.module+el8.4.0+559+c02fa3b2"}],"database_specific":{"yum_repository":"AppStream"}}],"database_specific":{"source":"https://storage.googleapis.com/resf-osv-data/RLSA-2020:1650.json"}},{"package":{"name":"slirp4netns","ecosystem":"Rocky Linux:8","purl":"pkg:rpm/rocky-linux/slirp4netns?distro=rocky-linux-8&epoch=0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.2-3.git21fdece.module+el8.5.0+770+e2f49861"}],"database_specific":{"yum_repository":"AppStream"}}],"database_specific":{"source":"https://storage.googleapis.com/resf-osv-data/RLSA-2020:1650.json"}},{"package":{"name":"slirp4netns","ecosystem":"Rocky Linux:8","purl":"pkg:rpm/rocky-linux/slirp4netns?distro=rocky-linux-8-4-legacy&epoch=0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.2-3.git21fdece.module+el8.4.0+536+994a2182"}],"database_specific":{"yum_repository":"AppStream"}}],"database_specific":{"source":"https://storage.googleapis.com/resf-osv-data/RLSA-2020:1650.json"}},{"package":{"name":"slirp4netns","ecosystem":"Rocky Linux:8","purl":"pkg:rpm/rocky-linux/slirp4netns?distro=rocky-linux-8-5-legacy&epoch=0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.2-3.git21fdece.module+el8.5.0+708+6758137d"}],"database_specific":{"yum_repository":"AppStream"}}],"database_specific":{"source":"https://storage.googleapis.com/resf-osv-data/RLSA-2020:1650.json"}},{"package":{"name":"toolbox","ecosystem":"Rocky Linux:8","purl":"pkg:rpm/rocky-linux/toolbox?distro=rocky-linux-8&epoch=0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.0.7-1.module+el8.5.0+770+e2f49861"}],"database_specific":{"yum_repository":"AppStream"}}],"database_specific":{"source":"https://storage.googleapis.com/resf-osv-data/RLSA-2020:1650.json"}},{"package":{"name":"toolbox","ecosystem":"Rocky Linux:8","purl":"pkg:rpm/rocky-linux/toolbox?distro=rocky-linux-8-4-legacy&epoch=0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.0.7-1.module+el8.4.0+559+c02fa3b2"}],"database_specific":{"yum_repository":"AppStream"}}],"database_specific":{"source":"https://storage.googleapis.com/resf-osv-data/RLSA-2020:1650.json"}},{"package":{"name":"toolbox","ecosystem":"Rocky Linux:8","purl":"pkg:rpm/rocky-linux/toolbox?distro=rocky-linux-8-5-legacy&epoch=0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.0.7-1.module+el8.5.0+708+6758137d"}],"database_specific":{"yum_repository":"AppStream"}}],"database_specific":{"source":"https://storage.googleapis.com/resf-osv-data/RLSA-2020:1650.json"}},{"package":{"name":"udica","ecosystem":"Rocky Linux:8","purl":"pkg:rpm/rocky-linux/udica?distro=rocky-linux-8&epoch=0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.2.1-2.module+el8.5.0+770+e2f49861"}],"database_specific":{"yum_repository":"AppStream"}}],"database_specific":{"source":"https://storage.googleapis.com/resf-osv-data/RLSA-2020:1650.json"}},{"package":{"name":"udica","ecosystem":"Rocky Linux:8","purl":"pkg:rpm/rocky-linux/udica?distro=rocky-linux-8-4-legacy&epoch=0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.2.1-2.module+el8.4.0+559+c02fa3b2"}],"database_specific":{"yum_repository":"AppStream"}}],"database_specific":{"source":"https://storage.googleapis.com/resf-osv-data/RLSA-2020:1650.json"}},{"package":{"name":"udica","ecosystem":"Rocky Linux:8","purl":"pkg:rpm/rocky-linux/udica?distro=rocky-linux-8-5-legacy&epoch=0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.2.1-2.module+el8.5.0+708+6758137d"}],"database_specific":{"yum_repository":"AppStream"}}],"database_specific":{"source":"https://storage.googleapis.com/resf-osv-data/RLSA-2020:1650.json"}},{"package":{"name":"container-selinux","ecosystem":"Rocky Linux:8","purl":"pkg:rpm/rocky-linux/container-selinux?distro=rocky-linux-8&epoch=2"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.124.0-1.gitf958d0c.module+el8.5.0+681+c9a1951f"}],"database_specific":{"yum_repository":"AppStream"}}],"database_specific":{"source":"https://storage.googleapis.com/resf-osv-data/RLSA-2020:1650.json"}}],"schema_version":"1.7.3","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"}],"credits":[{"name":"Rocky Enterprise Software Foundation"},{"name":"Red Hat"}]}