Security Bulletin
Summary
IBM Cloud Automation Manager Content Runtime is affected by an issue with Docker before 19.03.15. as described in CVE-2021-21284 and CVE-2021-21285. If you have IBM Cloud Automation Manager Content Runtime with docker engine 19.03.14 or earlier installed, upgrade it to 19.03.15.
Vulnerability Details
Refer to the security bulletin(s) listed in the Remediation/Fixes section
Affected Products and Versions
| Affected Product(s) | Version(s) |
| IBM Cloud Automation Manager | 4.2.0.1 |
Remediation/Fixes
IBM Cloud Automation Manager Content Runtime deployment installs either Docker CE or Docker EE on the Content Runtime system based on user selection. Docker CE is installed either using Docker provided convenience scripts or using the installation binary provided by the user. Docker EE is installed using the Docker EE repository URL provided by the user or the installation binary provided by the user.
Before you upgrade the Docker Engine:
1. Run the following command to verify the docker engine version that is running on your Content Runtime system.
docker version
If the version is earlier than 19.03.15, you need to upgrade it to 19.03.15.
2. Make sure you have no middleware content template deployments, destroys or deletes in “Progress” state. If they are in Progress state, wait for them to complete.
3. Run the following command to bring down the pattern manager and software repository containers on the Content Runtime system.
cd /root/advanced-content-runtime
docker-compose -f docker-compose.yml down
docker-compose -f docker-compose.yml down
Upgrade Docker CE on Ubuntu
1. Run the following command to update the apt packages.
sudo apt-get update
2. List the versions available in your repo. Verify whether the version you need is in the list.
sudo apt-cache madison docker-ce
3. Install a specific version by its fully qualified package name.
sudo apt-get install docker-ce=<VERSION_STRING> docker-ce-cli=<VERSION_STRING> containerd.io
where version string is the second column from output of step 2
Example:
sudo apt-get install docker-ce=5:19.03.15~3-0~ubuntu-xenial docker-ce-cli=5:19.03.15~3-0~ubuntu-xenial containerd.io
Example:
sudo apt-get install docker-ce=5:19.03.15~3-0~ubuntu-xenial docker-ce-cli=5:19.03.15~3-0~ubuntu-xenial containerd.io
4. Verify the docker version by running the following command.
sudo docker version
5. Restart the containers by running the following command.
cd /root/advanced-content-runtime
docker-compose -f docker-compose.yml up -d
docker-compose -f docker-compose.yml up -d
6. Verify whether the containers are started by running the following command.
sudo docker ps
For more details on install and upgrade of Docker CE on Ubuntu, see https://docs.docker.com/engine/install/ubuntu/
Upgrade Docker EE on Ubuntu
1. Run the following command to set up the repository for Docker Engine 19.03.
sudo add-apt-repository "deb [arch=amd64] <YOUR_DOCKER_EE_REPO_URL>/ubuntu <YOUR_UBUNTU_VERSION> stable-19.03"
Example: sudo add-apt-repository "deb [arch=amd64] https://storebits.docker.com/ee/trial/sub-xxx/ubuntu xenial stable-19.03"
2. Run the following command to update the apt packages.
sudo apt-get update
3. List the versions available in your repo. Verify whether the version you need is in the list.
sudo apt-cache madison docker-ee
4. Install a specific version by its fully qualified package name.
sudo apt-get install docker-ee=<VERSION_STRING> docker-ee-cli=<VERSION_STRING> containerd.io
Example: sudo apt-get install docker-ee=5:19.03.15~3-0~ubuntu-xenial docker-ee-cli=5:19.03.15~3-0~ubuntu-xenial containerd.io
5. Verify the docker version by running the following command.
sudo docker version
6. Restart the containers using the following command.
cd /root/advanced-content-runtime
docker-compose -f docker-compose.yml up -d
cd /root/advanced-content-runtime
docker-compose -f docker-compose.yml up -d
7. Verify whether the containers are started by executing the following command.
sudo docker ps
For more details on install and upgrade of Docker EE on Ubuntu, see https://docs.mirantis.com/containers/v3.1/mcr-deployment-guide/mcr-linux/ubuntu.html
Upgrade Docker EE on Red Hat Linux
1. Run the following command to set up the repository for Docker Engine 19.03.
sudo yum-config-manager --enable docker-ee-stable-19.03
2. List the versions available in your repository. Verify whether the version you need is in the list.
sudo yum list docker-ee --showduplicates | sort -r
3. To upgrade 19.03, run the following command:
sudo yum -y install docker-ee-< version_string > docker-ee-cli-< version_string > containerd.io
sudo yum -y install docker-ee-< version_string > docker-ee-cli-< version_string > containerd.io
where version_string is the second column from output of step 2 starting at the first colon (:), up to the first hyphen.
Example: sudo yum -y install docker-ee-19.03.15 docker-ee-cli-19.03.15 containerd.io
4. Verify the docker version by running the following command.
sudo docker version
5. Restart the containers by running the following command.
cd /root/advanced-content-runtime
docker-compose -f docker-compose.yml up -d
docker-compose -f docker-compose.yml up -d
6. Verify whether the containers are started by running the following command.
sudo docker ps
For more details on install and upgrade of Docker EE on Red Hat Linux, see https://docs.mirantis.com/containers/v3.1/mcr-deployment-guide/mcr-linux/rhel.html
Upgrade Docker installed using binary files
If you installed Docker on Content Runtime virtual machine using the Docker Installation file option during Content Runtime deployment, then you need to download the debian or rpm package from Docker and upgrade the package.
For more information, depending on your operating system and Docker Engine Edition, refer to Upgrade section in one of the following links
https://docs.mirantis.com/containers/v3.1/mcr-deployment-guide/mcr-linux/rhel.html#package-install-and-upgrade, or
Note: You must download and install docker-cli, containerd.io and docker-ce (or docker-ee).
For Ubuntu, do the following steps
1. Upgrade to new version by using the following command
sudo dpkg -i <PATH_TO_UPGRADE_PACKAGE>
2. Verify the docker version by running the following command
docker version
3. Restart the containers by running the following command
cd /root/advanced-content-runtime
docker-compose -f docker-compose.yml up -d
docker-compose -f docker-compose.yml up -d
4. Verify whether the containers are started by running the following command.
docker ps
For Red Hat, do the following steps
1. Upgrade to new version by running the following command.
sudo yum -y upgrade <PATH_TO_UPGRADE_PACKAGE>
2. Verify the docker version by running the following command.
docker version
3. Restart the containers by running the following command.
cd /root/advanced-content-runtime
docker-compose -f docker-compose.yml up -d
docker-compose -f docker-compose.yml up -d
4. Verify whether the containers are started by running the following command.
docker ps
Workarounds and Mitigations
None
Get Notified about Future Security Bulletins
References
Off
Change History
13 Apr 2021: Initial Publication
*The CVSS Environment Score is customer environment specific and will ultimately impact the Overall CVSS Score. Customers can evaluate the impact of this vulnerability in their environments by accessing the links in the Reference section of this Security Bulletin.
Disclaimer
Review the IBM security bulletin disclaimer and definitions regarding your responsibilities for assessing potential impact of security vulnerabilities to your environment.
Document Location
Worldwide
[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SS2L37","label":"IBM Cloud Automation Manager"},"Component":"","Platform":[{"code":"PF016","label":"Linux"}],"Version":"4.2.0.1","Edition":"","Line of Business":{"code":"LOB45","label":"Automation"}}]
Was this topic helpful?
Document Information
Modified date:
22 April 2021
UID
ibm16446211