Your message dated Sun, 13 Nov 2022 17:52:35 +0000
with message-id <[email protected]>
and subject line Bug#1009882: fixed in golang-github-containers-buildah
1.28.0+ds1-1
has caused the Debian Bug report #1009882,
regarding golang-github-containers-buildah: CVE-2022-27651
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1009882: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1009882
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: golang-github-containers-buildah
Version: 1.23.1+ds1-2
Severity: important
Tags: security upstream
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi,
The following vulnerability was published for golang-github-containers-buildah.
CVE-2022-27651[0]:
| A flaw was found in buildah where containers were incorrectly started
| with non-empty default permissions. A bug was found in Moby (Docker
| Engine) where containers were incorrectly started with non-empty
| inheritable Linux process capabilities, enabling an attacker with
| access to programs with inheritable file capabilities to elevate those
| capabilities to the permitted set when execve(2) runs. This has the
| potential to impact confidentiality and integrity.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2022-27651
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27651
[1]
https://github.com/containers/buildah/commit/e7e55c988c05dd74005184ceb64f097a0cfe645b
Please adjust the affected versions in the BTS as needed.
Regards,
Salvaotre
--- End Message ---
--- Begin Message ---
Source: golang-github-containers-buildah
Source-Version: 1.28.0+ds1-1
Done: Reinhard Tartler <[email protected]>
We believe that the bug you reported is fixed in the latest version of
golang-github-containers-buildah, which is due to be installed in the Debian
FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Reinhard Tartler <[email protected]> (supplier of updated
golang-github-containers-buildah package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sat, 12 Nov 2022 11:23:23 -0500
Source: golang-github-containers-buildah
Architecture: source
Version: 1.28.0+ds1-1
Distribution: experimental
Urgency: medium
Maintainer: Debian Go Packaging Team <[email protected]>
Changed-By: Reinhard Tartler <[email protected]>
Closes: 1009882
Changes:
golang-github-containers-buildah (1.28.0+ds1-1) experimental; urgency=medium
.
* New upstream release
new upstream version fixes CVE-2022-27651, Closes: #1009882
Checksums-Sha1:
4c00ab757a49c9b3e689c78de16c6f446fea2149 4007
golang-github-containers-buildah_1.28.0+ds1-1.dsc
b6a92b801633a3ffb89ba087f34df5b915e74efd 910896
golang-github-containers-buildah_1.28.0+ds1.orig.tar.xz
c617b574f85afe0774edb011d20b5413ce7799ad 6832
golang-github-containers-buildah_1.28.0+ds1-1.debian.tar.xz
Checksums-Sha256:
087079a6f0a700a7ca198be0c05e5cb4f236e285227b1b556aec36e26af12448 4007
golang-github-containers-buildah_1.28.0+ds1-1.dsc
f488a1560e9ca3a01102604ad90e67f3d7bed2177f447b3daf147bbd569d022d 910896
golang-github-containers-buildah_1.28.0+ds1.orig.tar.xz
5e37196a2cf36d239cede214885dbf8d212ecdd4e73b6979dadc14459f9fa7b6 6832
golang-github-containers-buildah_1.28.0+ds1-1.debian.tar.xz
Files:
0c9b5e2e44d318417a912a0f997032eb 4007 devel optional
golang-github-containers-buildah_1.28.0+ds1-1.dsc
14e1b5a6b99bd82a0f7ab45f96a0eda8 910896 devel optional
golang-github-containers-buildah_1.28.0+ds1.orig.tar.xz
613cbe06d00ee627e4c55ad31e72e38c 6832 devel optional
golang-github-containers-buildah_1.28.0+ds1-1.debian.tar.xz
-----BEGIN PGP SIGNATURE-----
iQJIBAEBCgAyFiEEMN59F2OrlFLH4IJQSadpd5QoJssFAmNxJn4UHHNpcmV0YXJ0
QHRhdXdhcmUuZGUACgkQSadpd5QoJstg6xAAqcY/y5c1o9whdDI1t5ron37HvTsE
hUdu6xboX94DOZhTsSZ4OIYbFOB2PxHcDPcQLHb999UU6THRduV3lB3Cyxtk7G3E
amtZxvDz4j1/PAmW4ZudGh/fRMy9gJ7ucvkhPK+ilHNXkdK6UiTK2WLWJmdCT9s1
C23yYQD6o74F1UALLFlEHoj1xF1GpblCb7wvwdew+P8j/XVXagpx63eU/fRlCrj1
9mem0qiOk1yRlBflQ6Uw//wCO+hxJ1yWLluo6UPxTYyPz2e98mDQCLX5AkpOZaZi
PZZqKNpS5z0TOB08wGBsOVXgf9Yk1iJ95gx930aRGDMINj3tfDpNwhbXsheGjF/e
HHoY/YkAhLSw4Qg1eKHQobEbbZbcwy2J9KlJCK5FuMJSpLcMmrZWf+Wyp173C4fk
YO6MoXTCA1FIie63LpqG4Dlw2nZkeoHLqxDdX6zTzLe74Bhlwvii8OLLTsZOnoO/
0diSmo2q3jxktLEfmVE9fUKiyYp5BAij+16on8JBttpZ+k1tybkQaOm1uOEQDwlI
Fi+Djr2xNTycTcLRm8iE8nIqWP8Z58oCYh6fiA/qJuXEvpxcTMaHKsZcClRl2mj1
QeouVIVcGPHpPsDt+YSQQ04y6BdtoWJYPVKxvBGOYUUF+p4We6XonWT0vsRkUYZx
LAlEKTaojf5iNX0=
=3VhZ
-----END PGP SIGNATURE-----
--- End Message ---
