Moderate: runc security update

2023-12-1200:00:00

Google

osv.dev

runc

security update

container runtime

golang

crypto/tls

cve-2023-29409

cve-2023-39321

cve-2023-39322

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

6.6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

38.0%

JSON

The runC tool is a lightweight, portable implementation of the Open Container Format (OCF) that provides container runtime.

Security Fix(es):

golang: crypto/tls: slow verification of certificate chains containing large RSA keys (CVE-2023-29409)
golang: crypto/tls: panic when processing post-handshake message on QUIC connections (CVE-2023-39321)
golang: crypto/tls: lack of a limit on buffered post-handshake (CVE-2023-39322)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.