From 107bff5a1e9639db5d110b27eb04a2b5b22ee2b2 Mon Sep 17 00:00:00 2001
From: CentOS Sources <bugs@centos.org>
Date: Apr 28 2020 16:10:27 +0000
Subject: import podman-1.6.4-11.module+el8.2.0+6369+1f4293b4


---

diff --git a/SOURCES/podman-CVE-2020-10696.patch b/SOURCES/podman-CVE-2020-10696.patch
new file mode 100644
index 0000000..b2569a4
--- /dev/null
+++ b/SOURCES/podman-CVE-2020-10696.patch
@@ -0,0 +1,58 @@
+From 840e7dad513b86f454573ad415701c0199f78d30 Mon Sep 17 00:00:00 2001
+From: TomSweeneyRedHat <tsweeney@redhat.com>
+Date: Tue, 24 Mar 2020 20:10:22 -0400
+Subject: [PATCH] Fix potential CVE in tarfile w/ symlink
+
+Stealing @nalind 's workaround to avoid refetching
+content after a file read failure.  Under the right
+circumstances that could be a symlink to a file meant
+to overwrite a good file with bad data.
+
+Testing:
+```
+goodstuff
+
+[1] 14901
+
+127.0.0.1 - - [24/Mar/2020 20:15:50] "GET / HTTP/1.1" 200 -
+127.0.0.1 - - [24/Mar/2020 20:15:50] "GET / HTTP/1.1" 200 -
+no FROM statement found
+
+goodstuff
+```
+
+Signed-off-by: TomSweeneyRedHat <tsweeney@redhat.com>
+---
+ imagebuildah/util.go | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+diff --git a/imagebuildah/util.go b/imagebuildah/util.go
+index 29ea60970..5f14c9883 100644
+--- a/vendor/github.com/containers/buildah/imagebuildah/util.go
++++ b/vendor/github.com/containers/buildah/imagebuildah/util.go
+@@ -14,6 +14,7 @@ import (
+ 
+ 	"github.com/containers/buildah"
+ 	"github.com/containers/storage/pkg/chrootarchive"
++	"github.com/containers/storage/pkg/ioutils"
+ 	"github.com/opencontainers/runtime-spec/specs-go"
+ 	"github.com/pkg/errors"
+ 	"github.com/sirupsen/logrus"
+@@ -57,7 +58,7 @@ func downloadToDirectory(url, dir string) error {
+ 		}
+ 		dockerfile := filepath.Join(dir, "Dockerfile")
+ 		// Assume this is a Dockerfile
+-		if err := ioutil.WriteFile(dockerfile, body, 0600); err != nil {
++		if err := ioutils.AtomicWriteFile(dockerfile, body, 0600); err != nil {
+ 			return errors.Wrapf(err, "Failed to write %q to %q", url, dockerfile)
+ 		}
+ 	}
+@@ -75,7 +76,7 @@ func stdinToDirectory(dir string) error {
+ 	if err := chrootarchive.Untar(reader, dir, nil); err != nil {
+ 		dockerfile := filepath.Join(dir, "Dockerfile")
+ 		// Assume this is a Dockerfile
+-		if err := ioutil.WriteFile(dockerfile, b, 0600); err != nil {
++		if err := ioutils.AtomicWriteFile(dockerfile, b, 0600); err != nil {
+ 			return errors.Wrapf(err, "Failed to write bytes to %q", dockerfile)
+ 		}
+ 	}
diff --git a/SPECS/podman.spec b/SPECS/podman.spec
index 16a1e94..61e274b 100644
--- a/SPECS/podman.spec
+++ b/SPECS/podman.spec
@@ -29,7 +29,7 @@ go build -buildmode pie -compiler gc -tags="rpm_crashtraceback libtrust_openssl 
 
 Name: podman
 Version: 1.6.4
-Release: 10%{?dist}
+Release: 11%{?dist}
 Summary: Manage Pods, Containers and Container Images
 License: ASL 2.0
 URL: https://%{name}.io/
@@ -50,6 +50,9 @@ Patch4: podman-1805212.patch
 # related bug: https://bugzilla.redhat.com/show_bug.cgi?id=1807310
 # patch:       https://github.com/containers/libpod/pull/5349.patch
 Patch5: podman-1807310.patch
+# tracker bug: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10696
+# backported:  https://github.com/containers/buildah/commit/c61925b8936e93a5e900f91b653a846f7ea3a9ed.patch
+Patch6: podman-CVE-2020-10696.patch
 Provides: %{name}-manpages = %{version}-%{release}
 Obsoletes: %{name}-manpages < %{version}-%{release}
 BuildRequires: golang >= 1.12.12-4
@@ -349,6 +352,10 @@ exit 0
 %{_datadir}/%{name}/test
 
 %changelog
+* Wed Apr 01 2020 Jindrich Novy <jnovy@redhat.com> - 1.6.4-11
+- fix "CVE-2020-10696 buildah: crafted input tar file may lead to local file overwriting during image build process"
+- Resolves: #1819391
+
 * Thu Mar 19 2020 Jindrich Novy <jnovy@redhat.com> - 1.6.4-10
 - use the full PR 5348 to fix "no route to host from inside container"
 - Resolves: #1806899