ALSA-2024:8112 Important: buildah security update

The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a...

CVE-2024-8184 vulnerabilities

Vulnerabilities for packages: apache-nifi, confluent-kafka, solr, zookeeper, spark, apache-tika, druid, cloudwatch-exporter, cassandra-reaper, spark-fips, zookeeper-fips, celeborn, kafka, confluent-kafka-jre-bcfips, strimzi-kafka-operator...

ALSA-2024:8039 Important: podman security update

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fixes: go/parser: golang: Calling any of the Parse functions containing deeply nested literals c...

Important: podman security update

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fixes: go/parser: golang: Calling any of the Parse functions containing deeply nested literals c...

Amazon Linux 2023 : openssl, openssl-devel, openssl-libs (ALAS2023-2024-721)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2024-721 advisory. Issue summary: Applications performing certificate name checks e.g., TLSclients checking server certificates may attempt to read an invalid memoryaddress resulting in abnormal termination of the...

RHEL 9 : podman (RHSA-2024:8039)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:8039 advisory. The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use contain...

CVE-2024-47875 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards-fips, argo-workflows...

GO-2024-3167 Golang FIPS OpenSSL has a Use of Uninitialized Variable vulnerability in github.com/golang-fips/openssl

A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted...

CVE-2024-3656 vulnerabilities

Vulnerabilities for packages: keycloak-fips...

openSUSE Security Advisory (SUSE-SU-2024:3546-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

EulerOS 2.0 SP12 : openssl (EulerOS-SA-2024-2512)

According to the versions of the openssl packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Issue summary: Calling the OpenSSL API function SSLselectnextproto with an empty supported client protocols buffer may cause a crash or memory...

SUSE SLES15 / openSUSE 15 Security Update : podman (SUSE-SU-2024:3546-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3546-1 advisory. - CVE-2024-9341: Fixed FIPS Crypto-Policy Directory Mounting Issue in containers/common Go Library bsc1231230 Tenable...

SUSE SLES15 / openSUSE 15 Security Update : buildah (SUSE-SU-2024:3545-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2024:3545-1 advisory. - CVE-2024-9407: Fixed Improper Input Validation in bind-propagation Option of Dockerfile RUN --mount Instruction...

Security update for podman

This update for podman fixes the following issues: CVE-2024-9341: Fixed FIPS Crypto-Policy Directory Mounting Issue in containers/common Go Library bsc1231230 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch"...

SUSE-SU-2024:3546-1 Security update for podman

This update for podman fixes the following issues: - CVE-2024-9341: Fixed FIPS Crypto-Policy Directory Mounting Issue in containers/common Go Library bsc1231230...

Security update for buildah

This update for buildah fixes the following issues: CVE-2024-9407: Fixed Improper Input Validation in bind-propagation Option of Dockerfile RUN --mount Instruction bsc1231208. CVE-2024-9341: Fixed FIPS Crypto-Policy Directory Mounting Issue in containers/common Go Library in cri-o nsc1231230. Pat...

SUSE-SU-2024:3545-1 Security update for buildah

This update for buildah fixes the following issues: - CVE-2024-9407: Fixed Improper Input Validation in bind-propagation Option of Dockerfile RUN --mount Instruction bsc1231208. - CVE-2024-9341: Fixed FIPS Crypto-Policy Directory Mounting Issue in containers/common Go Library in cri-o nsc1231230...

Link Following

github.com/containers/common is vulnerable to Link Following. The vulnerability is due to incorrect handling of symbolic links in FIPS mode, allowing an attacker to exploit symbolic links and mount sensitive host directories inside a container, bypassing the isolation between containers and the...

Use Of Uninitialized Variable

github.com/golang-fips/openssl is vulnerable to Use of Uninitialized Variable. The vulnerability is due to improper handling of uninitialized buffer lengths in FIPS mode, which can result in zeroed buffers being returned. This flaw allows an attacker to force false positive hash matches, send...

AlmaLinux 9 : golang (ALSA-2024:7550)

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2024:7550 advisory. golang-fips: Golang FIPS zeroed buffer CVE-2024-9355 Tenable has extracted the preceding description block directly from the AlmaLinux security advisory. Note that...