SUSE-SU-2021:0445-1: important: Security update for containerd, docker, docker-runc, golang-github-docker-libnetwork

[sle-updates at lists.suse.com]

   SUSE Security Update: Security update for containerd, docker, docker-runc, golang-github-docker-libnetwork
______________________________________________________________________________

Announcement ID:    SUSE-SU-2021:0445-1
Rating:             important
References:         #1065609 #1153367 #1157330 #1158590 #1176708 
                    #1177598 #1178801 #1180401 #1181730 #1181732 
                    
Cross-References:   CVE-2020-15157 CVE-2021-21284 CVE-2021-21285
                   
CVSS scores:
                    CVE-2020-15157 (NVD) : 6.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N
                    CVE-2020-15157 (SUSE): 6.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:N/A:N
                    CVE-2021-21284 (NVD) : 6.8 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
                    CVE-2021-21284 (SUSE): 2.5 CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:N
                    CVE-2021-21285 (NVD) : 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
                    CVE-2021-21285 (SUSE): 5 CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

Affected Products:
                    SUSE Linux Enterprise Module for Containers 12
______________________________________________________________________________

   An update that solves three vulnerabilities and has 7 fixes
   is now available.

Description:

   This update for containerd, docker, docker-runc,
   golang-github-docker-libnetwork fixes the following issues:

   Update Docker to 19.03.15-ce:

   - CVE-2021-21284: potential privilege escalation when the root user in the
     remapped namespace has access to the host filesystem (bsc#1181732)
   - CVE-2021-21285: malformed Docker image manifest crashes the dockerd
     daemon (bsc#1181730)
   - CVE-2020-15157: containerd: credentials leaking during image pull
     (bsc#1177598)


Patch Instructions:

   To install this SUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - SUSE Linux Enterprise Module for Containers 12:

      zypper in -t patch SUSE-SLE-Module-Containers-12-2021-445=1



Package List:

   - SUSE Linux Enterprise Module for Containers 12 (ppc64le s390x x86_64):

      containerd-1.3.9-16.35.1
      docker-19.03.15_ce-98.60.2
      docker-debuginfo-19.03.15_ce-98.60.2
      docker-libnetwork-0.7.0.1+gitr2908_55e924b8a842-37.1
      docker-libnetwork-debuginfo-0.7.0.1+gitr2908_55e924b8a842-37.1
      docker-runc-1.0.0rc10+gitr3981_dc9208a3303f-1.52.1


References:

   https://www.suse.com/security/cve/CVE-2020-15157.html
   https://www.suse.com/security/cve/CVE-2021-21284.html
   https://www.suse.com/security/cve/CVE-2021-21285.html
   https://bugzilla.suse.com/1065609
   https://bugzilla.suse.com/1153367
   https://bugzilla.suse.com/1157330
   https://bugzilla.suse.com/1158590
   https://bugzilla.suse.com/1176708
   https://bugzilla.suse.com/1177598
   https://bugzilla.suse.com/1178801
   https://bugzilla.suse.com/1180401
   https://bugzilla.suse.com/1181730
   https://bugzilla.suse.com/1181732