Security update for docker, sle2docker, go
Announcement ID: | SUSE-SU-2014:1648-1 |
---|---|
Rating: | moderate |
References: | |
Cross-References: | |
CVSS scores: |
|
Affected Products: |
|
An update that solves five vulnerabilities can now be installed.
Description:
Docker was updated to version 1.3.2 to fix five security issues and several other bugs.
- Updated to 1.3.2 (2014-11-20) - fixes bnc#907012 (CVE-2014-6407) and bnc#907014 (CVE-2014-6408)
- Fixed minor packaging issues.
These security issues were fixed:
- Prevent fallback to SSL protocols lower than TLS 1.0 for client, daemon and registry (CVE-2014-5277).
- Secure HTTPS connection to registries with certificate verification and without HTTP fallback unless --insecure-registry
is specified.
- Tagging image to ID can redirect images on subsequent pulls (CVE-2014-5282).
- Fix tar breakout vulnerability (CVE-2014-6407)
- Extractions are now sandboxed chroot (CVE-2014-6407)
- Security options are no longer committed to images (CVE-2014-6408)
These non-security issues were fixed:
- Fix deadlock in docker ps -f exited=1
- Fix a bug when --volumes-from
references a container that failed to start
- --insecure-registry
now accepts CIDR notation such as 10.1.0.0/16
- Private registries whose IPs fall in the 127.0.0.0/8 range do no need
the --insecure-registry
flag
- Skip the experimental registry v2 API when mirroring is enabled
- Fix issue where volumes would not be shared
- Fix issue with --iptables=false
not automatically setting --ip-masq=false
- Fix docker run output to non-TTY stdout
- Fix escaping $
for environment variables
- Fix issue with lowercase onbuild
Dockerfile instruction
- Restrict envrionment variable expansion to ENV
, ADD
, COPY
, WORKDIR
, EXPOSE
, VOLUME
and USER
- docker exec
allows you to run additional processes inside existing containers
- docker create
gives you the ability to create a container via the cli without executing a process
- --security-opts
options to allow user to customize container labels and apparmor profiles
- docker ps
filters
- Wildcard support to copy/add
- Move production urls to get.docker.com from get.docker.io
- Allocate ip address on the bridge inside a valid cidr
- Use drone.io for pr and ci testing
- Ability to setup an official registry mirror
- Ability to save multiple images with docker save
go was updated to version 1.3.3 to fix one security issue and several other bugs.
This security issue was fixed: - TLS client authentication issue (CVE-2014-7189).
These non-security issues were fixed: - Avoid stripping debuginfo on arm, it fails (and is not necessary) - Revert the /usr/share/go/contrib symlink as it caused problems during update. Moved all go sources to /usr/share/go/contrib/src instead of /usr/share/go/contrib/src/pkg and created pkg and src symlinks in contrib to add it to GOPATH - Fixed %go_contribsrcdir value - Copy temporary macros.go as go.macros to avoid it to be built - Do not modify Source: files, because that makes the .src.rpm being tied to one specific arch. - Removed extra src folder in /usr/share/go/contrib: the goal is to transform this folder into a proper entry for GOPATH. This folder is now linked to %{_libdir}/go/contrib - go requires gcc to build sources using cgo - tools-packaging.patch: Allow building cover and vet tools in $GOROOT_TARGET/pkg/tool instead of $GOROOT/pkg/tool. This will allow building go tools as a separate package
sle2docker was updated to version 0.2.2 to fix one bug: - Fix SLE12 urls (bnc#902289)
Patch Instructions:
To install this SUSE update use the SUSE recommended
installation methods like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
-
SUSE Linux Enterprise Server 12
zypper in -t patch SUSE-SLE-SERVER-12-2014-111=1
-
SUSE Linux Enterprise Server for SAP Applications 12
zypper in -t patch SUSE-SLE-SERVER-12-2014-111=1
Package List:
-
SUSE Linux Enterprise Server 12 (x86_64)
- docker-1.3.2-9.1
- docker-debuginfo-1.3.2-9.1
- ruby2.1-rubygem-sle2docker-0.2.3-5.1
- sle2docker-0.2.3-5.1
- docker-debugsource-1.3.2-9.1
-
SUSE Linux Enterprise Server for SAP Applications 12 (x86_64)
- docker-1.3.2-9.1
- docker-debuginfo-1.3.2-9.1
- ruby2.1-rubygem-sle2docker-0.2.3-5.1
- sle2docker-0.2.3-5.1
- docker-debugsource-1.3.2-9.1
References:
- https://www.suse.com/security/cve/CVE-2014-5277.html
- https://www.suse.com/security/cve/CVE-2014-5282.html
- https://www.suse.com/security/cve/CVE-2014-6407.html
- https://www.suse.com/security/cve/CVE-2014-6408.html
- https://www.suse.com/security/cve/CVE-2014-7189.html
- https://bugzilla.suse.com/show_bug.cgi?id=898901
- https://bugzilla.suse.com/show_bug.cgi?id=902289
- https://bugzilla.suse.com/show_bug.cgi?id=902413
- https://bugzilla.suse.com/show_bug.cgi?id=907012
- https://bugzilla.suse.com/show_bug.cgi?id=907014