FEDORA-2023-9f5f1ef40a — security update for moby-engine

stable

moby-engine-24.0.5-1.fc38

FEDORA-2023-9f5f1ef40a created by sergiomb a year ago for Fedora 38

Update moby-engine to 24.0.5
Security fix for CVE-2021-41803
Security fix for CVE-2023-28842
Security fix for CVE-2023-28841
Security fix for CVE-2023-28840
Security fix for CVE-2023-0845
Security fix for CVE-2023-26054
Security fix for CVE-2022-3064
Security fix for CVE-2022-40716
Security fix for CVE-2023-25173

Update moby-engine to 23.0.4

How to install

Updates may require up to 24 hours to propagate to mirrors. If the following command doesn't work, please retry later:

sudo dnf upgrade --refresh --advisory=FEDORA-2023-9f5f1ef40a

This update has been submitted for testing by sergiomb.

a year ago

This update's test gating status has been changed to 'ignored'.

a year ago

This update has obsoleted moby-engine-23.0.4-1.fc38, and has inherited its bugs and notes.

a year ago

markec provided feedback a year ago

karma

This update has been pushed to testing.

a year ago

marok provided feedback a year ago

karma

This update can be pushed to stable now if the maintainer wishes

a year ago

okram provided feedback a year ago

karma

This update has been submitted for stable by bodhi.

a year ago

This update has been pushed to stable.

a year ago

Please login to add feedback.

Metadata

Type

security

Severity

medium

Karma

Signed

Content Type

RPM

Test Gating

ignored

Autopush Settings

Unstable by Karma

-3

Stable by Karma

Stable by Time

7 days

Dates

submitted

a year ago

in testing

a year ago

in stable

a year ago

approved

a year ago

Builds

moby-engine-24.0.5-1.fc38

BZ#2156860 CVE-2022-40716 consul: Consul Service Mesh Intention Bypass with Malicious Certificate Signing Request

BZ#2156864 CVE-2022-40716 moby-engine: consul: Consul Service Mesh Intention Bypass with Malicious Certificate Signing Request [fedora-37]

BZ#2163037 CVE-2022-3064 go-yaml: Improve heuristics preventing CPU/memory abuse by parsing malicious or large YAML documents

BZ#2163550 CVE-2022-3064 moby-engine: go-yaml: Improve heuristics preventing CPU/memory abuse by parsing malicious or large YAML documents [fedora-all]

BZ#2174485 CVE-2023-25173 containerd: Supplementary groups are not set up properly

BZ#2174544 moby-engine: containerd: Supplementary groups are not set up properly [fedora-all]

BZ#2176447 CVE-2023-26054 buildkit: Data disclosure in provenance attestation describing a build

BZ#2176448 CVE-2023-26054 moby-engine: buildkit: Data disclosure in provenance attestation describing a build [fedora-all]

BZ#2177595 CVE-2023-0845 hashicorp/consul: Consul Server Panic when Ingress and API Gateways Configured with Peering Connections

BZ#2177596 CVE-2023-0845 moby-engine: hashicorp/consul: Consul Server Panic when Ingress and API Gateways Configured with Peering Connections [fedora-all]

BZ#2184683 CVE-2023-28840 moby: Encrypted overlay network may be unauthenticated

BZ#2184684 CVE-2023-28840 moby-engine: moby: Encrypted overlay network may be unauthenticated [fedora-all]

BZ#2184685 CVE-2023-28841 moby: Encrypted overlay network traffic may be unencrypted

BZ#2184686 CVE-2023-28841 moby-engine: moby: Encrypted overlay network traffic may be unencrypted [fedora-all]

BZ#2184688 CVE-2023-28842 moby: Encrypted overlay network with a single endpoint is unauthenticated

BZ#2184689 CVE-2023-28842 moby-engine: moby: Encrypted overlay network with a single endpoint is unauthenticated [fedora-all]

BZ#2189788 CVE-2021-41803 consul: Consul Auto-Config JWT Authorization Missing Input Validation

BZ#2189789 CVE-2021-41803 moby-engine: consul: Consul Auto-Config JWT Authorization Missing Input Validation [fedora-all]

BZ#2190033 moby-engine-24.0.5 is available

moby-engine-24.0.5-1.fc38

Automated Test Results

ignored