Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[v5.2-rhel] Fix CVE-2024-9407, 9675, 9676, 9341 #24324

Merged
merged 1 commit into from
Oct 22, 2024
Merged

[v5.2-rhel] Fix CVE-2024-9407, 9675, 9676, 9341 #24324

merged 1 commit into from
Oct 22, 2024

Conversation

TomSweeneyRedHat
Copy link
Member

@TomSweeneyRedHat TomSweeneyRedHat commented Oct 20, 2024 •
edited
Loading

This fixes four CVES:
CVE-2024-9341 - FIPS Crypto-Policy Directory Mounting Issue in containers/common Go Library CVE-2024-9407 - Improper Input Validation in bind-propagation Option of Dockerfile RUN --mount Instruction CVE-2024-9675 - Buildah allows arbitrary directory mount [rhel-9.5] CVE-2024-9676 - symlink traversal vulnerability in the containers/storage library can cause Denial of Service (DoS)

And Jira cards:

https://issues.redhat.com/browse/RHEL-60963 - CVE-2024-9341
https://issues.redhat.com/browse/RHEL-62369 - CVE-2024-9341
https://issues.redhat.com/browse/RHEL-61152 - CVE-2024-9407
https://issues.redhat.com/browse/RHEL-61849 (RHEL 9.5) - CVE-2024-9675
https://issues.redhat.com/browse/RHEL-61847 (RHEL 9.5.z) - CVE-2024-9675
https://issues.redhat.com/browse/RHEL-61865 - CVE-2024-9676

Does this PR introduce a user-facing change?

None

@TomSweeneyRedHat
[v5.2-rhel] Fix CVE-2024-9407, 9675, 9676, 9341
0c12cb5 
This fixes four CVES:
CVE-2024-9341 - FIPS Crypto-Policy Directory Mounting Issue in containers/common Go Library
CVE-2024-9407 - Improper Input Validation in bind-propagation Option of Dockerfile RUN --mount Instruction
CVE-2024-9675 - Buildah allows arbitrary directory mount [rhel-9.5]
CVE-2024-9676 - symlink traversal vulnerability in the containers/storage library can cause Denial of Service (DoS)

And Jira cards:

https://issues.redhat.com/browse/RHEL-60963 - CVE-2024-9341
https://issues.redhat.com/browse/RHEL-62369 - CVE-2024-9341
https://issues.redhat.com/browse/RHEL-61152 - CVE-2024-9407
https://issues.redhat.com/browse/RHEL-61849 (RHEL 9.5) - CVE-2024-9675
https://issues.redhat.com/browse/RHEL-61849 (RHEL 9.5.z) - CVE-2024-9675
https://issues.redhat.com/browse/RHEL-61865 - CVE-2024-9676

Signed-off-by: tomsweeneyredhat <[email protected]>
@TomSweeneyRedHat TomSweeneyRedHat added the No New Tests Allow PR to proceed without adding regression tests label Oct 20, 2024
@openshift-ci openshift-ci bot added release-note-none approved Indicates a PR has been approved by an approver from all required OWNERS files. labels Oct 20, 2024
@giuseppe giuseppe added the No Jira Link Use JUDICIOUSLY on -rhel branches for PRs that do not address a Jira issue label Oct 21, 2024
@Luap99
Copy link
Member

Luap99 commented Oct 21, 2024

CVE-2024-9341 was already fixed in #24132

And btw the correct syntax should be Fixes: https://issues.redhat.com/browse/RHEL-62369,etc... as this is what the CI checks for and what we require now per our guidelines https://github.com/containers/podman/blob/main/CONTRIBUTING.md#describe-your-changes-in-commit-messages
And given the auto team wnated this I assume they check for this syntax and bypassing it via "No Jira Link" does not sounds correct.

@TomSweeneyRedHat
Copy link
Member Author

Fixes: https://issues.redhat.com/browse/RHEL-60963, https://issues.redhat.com/browse/RHEL-62369, https://issues.redhat.com/browse/RHEL-61152, https://issues.redhat.com/browse/RHEL-61849, https://issues.redhat.com/browse/RHEL-61849, https://issues.redhat.com/browse/RHEL-61865

@TomSweeneyRedHat
Copy link
Member Author

Happy green test buttons on this one, can it be merged?

Luap99
Luap99 approved these changes Oct 22, 2024
View reviewed changes
Copy link
Member

@Luap99 Luap99 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

@openshift-ci openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Oct 22, 2024
@openshift-ci OpenShift CI
Copy link
Contributor

openshift-ci bot commented Oct 22, 2024

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Luap99, TomSweeneyRedHat

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:
  • OWNERS [Luap99,TomSweeneyRedHat]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-merge-bot openshift-merge-bot bot merged commit 6df7dfb into containers:v5.2-rhel Oct 22, 2024
59 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@Luap99 Luap99 Luap99 approved these changes

Assignees

@Luap99 Luap99

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. lgtm Indicates that a PR is ready to be merged. No Jira Link Use JUDICIOUSLY on -rhel branches for PRs that do not address a Jira issue No New Tests Allow PR to proceed without adding regression tests release-note-none
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@TomSweeneyRedHat @Luap99 @giuseppe