(RHSA-2024:2988) Moderate: container-tools:rhel8 security update

2024-05-2206:35:17

access.redhat.com

container-tools rhel8 security urllib3 golang crypto/tls podman buildah skopeo runc cvss red hat enterprise linux 8.10 release notes references unix

6.7 Medium

AI Score

Confidence

High

0.963 High

EPSS

Percentile

99.5%

JSON

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

urllib3: urllib3 does not remove the authorization HTTP header when following a cross-origin redirect (CVE-2018-25091)
golang: math/big.Rat: may cause a panic or an unrecoverable fatal error if passed inputs with very large exponents (CVE-2021-33198)
golang: crypto/tls: certificate of wrong type is causing TLS client to panic (CVE-2021-34558)
golang: archive/tar: unbounded memory consumption when reading headers (CVE-2022-2879)
golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters (CVE-2022-2880)
golang: regexp/syntax: limit memory used by parsing regexps (CVE-2022-41715)
golang: crypto/tls: slow verification of certificate chains containing large RSA keys (CVE-2023-29409)
golang: html/template: improper handling of HTML-like comments within script contexts (CVE-2023-39318)
golang: html/template: improper handling of special tags within script contexts (CVE-2023-39319)
golang: crypto/tls: panic when processing post-handshake message on QUIC connections (CVE-2023-39321)
golang: crypto/tls: lack of a limit on buffered post-handshake (CVE-2023-39322)
golang: net/http/internal: Denial of Service (DoS) via Resource Consumption via HTTP requests (CVE-2023-39326)
golang: crypto/tls: Timing Side Channel attack in RSA based TLS key exchanges. (CVE-2023-45287)
urllib3: Request body not stripped after redirect from 303 status changes request method to GET (CVE-2023-45803)
ssh: Prefix truncation attack on Binary Packet Protocol (BPP) (CVE-2023-48795)
moby/buildkit: Possible race condition with accessing subpaths from cache mounts (CVE-2024-23650)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.10 Release Notes linked from the References section.

OSVersionArchitecturePackageVersionFilename
RedHatanys390xrunc-debuginfo< 1.1.12-1.module+el8.10.0+21251+62b7388crunc-debuginfo-1.1.12-1.module+el8.10.0+21251+62b7388c.s390x.rpm
RedHatanyaarch64oci-seccomp-bpf-hook-debugsource< 1.2.10-1.module+el8.10.0+20565+a40ba0e5oci-seccomp-bpf-hook-debugsource-1.2.10-1.module+el8.10.0+20565+a40ba0e5.aarch64.rpm
RedHatanyx86_64libslirp-debugsource< 4.4.0-1.module+el8.9.0+20326+387084d0libslirp-debugsource-4.4.0-1.module+el8.9.0+20326+387084d0.x86_64.rpm
RedHatanyx86_64crun< 1.14.3-2.module+el8.10.0+21340+c6c7475acrun-1.14.3-2.module+el8.10.0+21340+c6c7475a.x86_64.rpm
RedHatanyx86_64netavark< 1.10.3-1.module+el8.10.0+21306+6be40ce7netavark-1.10.3-1.module+el8.10.0+21306+6be40ce7.x86_64.rpm
RedHatanyppc64lecriu-libs-debuginfo< 3.18-4.module+el8.9.0+20326+387084d0criu-libs-debuginfo-3.18-4.module+el8.9.0+20326+387084d0.ppc64le.rpm
RedHatanyppc64lenetavark< 1.10.3-1.module+el8.10.0+21306+6be40ce7netavark-1.10.3-1.module+el8.10.0+21306+6be40ce7.ppc64le.rpm
RedHatanyaarch64criu< 3.18-4.module+el8.9.0+20326+387084d0criu-3.18-4.module+el8.9.0+20326+387084d0.aarch64.rpm
RedHatanyaarch64conmon< 2.1.10-1.module+el8.10.0+21077+98b84d8aconmon-2.1.10-1.module+el8.10.0+21077+98b84d8a.aarch64.rpm
RedHatanys390xbuildah-tests< 1.33.6-2.module+el8.10.0+21371+46937ecebuildah-tests-1.33.6-2.module+el8.10.0+21371+46937ece.s390x.rpm

OS	Version	Architecture	Package	Version	Filename
RedHat	any	s390x	runc-debuginfo	< 1.1.12-1.module+el8.10.0+21251+62b7388c	runc-debuginfo-1.1.12-1.module+el8.10.0+21251+62b7388c.s390x.rpm
RedHat	any	aarch64	oci-seccomp-bpf-hook-debugsource	< 1.2.10-1.module+el8.10.0+20565+a40ba0e5	oci-seccomp-bpf-hook-debugsource-1.2.10-1.module+el8.10.0+20565+a40ba0e5.aarch64.rpm
RedHat	any	x86_64	libslirp-debugsource	< 4.4.0-1.module+el8.9.0+20326+387084d0	libslirp-debugsource-4.4.0-1.module+el8.9.0+20326+387084d0.x86_64.rpm
RedHat	any	x86_64	crun	< 1.14.3-2.module+el8.10.0+21340+c6c7475a	crun-1.14.3-2.module+el8.10.0+21340+c6c7475a.x86_64.rpm
RedHat	any	x86_64	netavark	< 1.10.3-1.module+el8.10.0+21306+6be40ce7	netavark-1.10.3-1.module+el8.10.0+21306+6be40ce7.x86_64.rpm
RedHat	any	ppc64le	criu-libs-debuginfo	< 3.18-4.module+el8.9.0+20326+387084d0	criu-libs-debuginfo-3.18-4.module+el8.9.0+20326+387084d0.ppc64le.rpm
RedHat	any	ppc64le	netavark	< 1.10.3-1.module+el8.10.0+21306+6be40ce7	netavark-1.10.3-1.module+el8.10.0+21306+6be40ce7.ppc64le.rpm
RedHat	any	aarch64	criu	< 3.18-4.module+el8.9.0+20326+387084d0	criu-3.18-4.module+el8.9.0+20326+387084d0.aarch64.rpm
RedHat	any	aarch64	conmon	< 2.1.10-1.module+el8.10.0+21077+98b84d8a	conmon-2.1.10-1.module+el8.10.0+21077+98b84d8a.aarch64.rpm
RedHat	any	s390x	buildah-tests	< 1.33.6-2.module+el8.10.0+21371+46937ece	buildah-tests-1.33.6-2.module+el8.10.0+21371+46937ece.s390x.rpm