1:42 p.m.
Hi,
In the last few days, a new CVE affecting Podman, CVE-2021-20291, was
made public. This vulnerability affects the containers/storage library
and can cause a denial of service if the user pulls a
specially-crafted image, causing most Podman commands to hang. The
Podman team does not feel that this is a serious vulnerability, as any
affected Podman image pull can be killed without adverse effect on
other Podman processes and running containers. However, we still
encourage all users to upgrade to the latest Podman release, Podman
v3.1.0, which resolves the issue.
Thanks,
Matt Heon
2:09 p.m.
Unfortunately 3.1.0 is not available for centos 7, or ubuntu 18.0.4 we
currently using. I tried to build Centos 7 one from OBS srpm specs for
fedora but go build fails somewhere in k8 vendor folder.
I understand the reasons for dropping packaging support but curious if
there are certain requirements for 3.1 that are missing in Centos 7.
On Mon, Apr 5, 2021, 12:43 PM Matt Heon <mheon(a)redhat.com> wrote:
Hi,
In the last few days, a new CVE affecting Podman, CVE-2021-20291, was
made public. This vulnerability affects the containers/storage library
and can cause a denial of service if the user pulls a
specially-crafted image, causing most Podman commands to hang. The
Podman team does not feel that this is a serious vulnerability, as any
affected Podman image pull can be killed without adverse effect on
other Podman processes and running containers. However, we still
encourage all users to upgrade to the latest Podman release, Podman
v3.1.0, which resolves the issue.
Thanks,
Matt Heon
_______________________________________________
Podman mailing list -- podman(a)lists.podman.io
To unsubscribe send an email to podman-leave(a)lists.podman.io
1117
days inactive
1117
days old
1 comments
2 participants
participants (2)
-
Matt Heon -
Sasha Litvak