Summary
Image Builder is a service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood.
Security Fix(es):
* golang: archive/tar: unbounded memory consumption when reading headers (CVE-2022-2879)
* golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters (CVE-2022-2880)
* golang: net/http: handle server errors after sending GOAWAY (CVE-2022-27664)
* golang: regexp/syntax: limit memory used by parsing regexps (CVE-2022-41715)
* golang: net/http: An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests (CVE-2022-41717)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 9 | osbuild-composer | 76-2.el9_2.alma |
| AlmaLinux · 9 | osbuild-composer-core | 76-2.el9_2.alma |
| AlmaLinux · 9 | osbuild-composer-dnf-json | 76-2.el9_2.alma |
| AlmaLinux · 9 | osbuild-composer-worker | 76-2.el9_2.alma |
| AlmaLinux · 9 | weldr-client | 35.9-1.el9 |
Vulnerabilities 5
-
High 7.5
golang.org/x/net/http2 Denial of Service vulnerability
In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error.
-
Medium 5.3CVE-2022-41717 Public exploit
Excessive memory growth in net/http and golang.org/x/net/http2
An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large…
-
Unscored —
Unbounded memory consumption when reading headers in archive/tar
Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of …
-
Unscored —
Incorrect sanitization of forwarded query parameters in net/http/httputil
Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy forwards a parameter with an unparsable value. Afte…
-
Unscored —
Memory exhaustion when compiling regular expressions in regexp/syntax
Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed regexp representation is linear in the size of the input, but in some cases the constant factor can be as high as 40,000,…
References
-
report
https://access.redhat.com/security/cve/CVE-2022-27664
-
report
https://access.redhat.com/security/cve/CVE-2022-2879
-
report
https://access.redhat.com/security/cve/CVE-2022-2880
-
report
https://access.redhat.com/security/cve/CVE-2022-41715
-
report
https://access.redhat.com/security/cve/CVE-2022-41717
-
report
https://bugzilla.redhat.com/2124669
-
report
https://bugzilla.redhat.com/2132867
-
report
https://bugzilla.redhat.com/2132868
-
report
https://bugzilla.redhat.com/2132872
-
report
https://bugzilla.redhat.com/2161274
-
advisory
https://errata.almalinux.org/9/ALSA-2023-2204.html