Package: lxc Version: 1:2.0.7-2+deb9u2 Severity: grave Tags: security Justification: user security hole
Dear Maintainer, *** Reporter, please consider answering these questions, where appropriate *** when lxc-net and netfilter/iptables-persistent are installed the start-up script in lxc-net uses iptables-commands while iptables-restore is used by netfilter-persistent. this is an unstable situation which sometimes causes iptables-restore to fail on COMMIT. thus the iptables rules are not being loaded leaving the server vulnerable. this should be solved within the service-files of systemd. if netfilter-persistent.service only runs after lxc-net.service the conflict should be avoided. at least it helped on my server. *** End of the template - remove these template lines *** -- System Information: Debian Release: 9.13 APT prefers oldstable-updates APT policy: (500, 'oldstable-updates'), (500, 'oldstable') Architecture: amd64 (x86_64) Kernel: Linux 4.9.0-14-amd64 (SMP w/6 CPU cores) Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=en_US.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Init: systemd (via /run/systemd/system) Versions of packages lxc depends on: ii init-system-helpers 1.48 ii libapparmor1 2.11.0-3+deb9u2 ii libc6 2.24-11+deb9u4 ii libcap2 1:2.25-1 ii libgnutls30 3.5.8-5+deb9u5 ii liblxc1 1:2.0.7-2+deb9u2 ii libseccomp2 2.3.1-2.1+deb9u1 ii libselinux1 2.6-3+b3 ii lsb-base 9.20161125 ii python3 3.5.3-1 ii python3-lxc 1:2.0.7-2+deb9u2 Versions of packages lxc recommends: ii bridge-utils 1.5-13+deb9u1 ii debootstrap 1.0.89 ii dirmngr 2.1.18-8~deb9u4 ii dnsmasq-base 2.76-5+deb9u2 ii gnupg 2.1.18-8~deb9u4 ii iptables 1.6.0+snapshot20161117-6 ii libpam-cgfs 2.0.7-1+deb9u1 ii lxcfs 2.0.7-1+deb9u1 ii openssl 1.1.0l-1~deb9u1 ii rsync 3.1.2-1+deb9u2 ii uidmap 1:4.4-4.1 Versions of packages lxc suggests: pn apparmor <none> pn btrfs-tools <none> pn lvm2 <none> -- no debconf information
