Summary
Toolbox is a tool for Linux operating systems, which allows the use of containerized command line environments. It is built on top of Podman and other standard container technologies from OCI.
Security Fix(es):
* golang: net/http: handle server errors after sending GOAWAY (CVE-2022-27664)
* golang: net/http: An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests (CVE-2022-41717)
* golang: math/big: decoding big.Float and big.Rat types can panic if the encoded message is too short, potentially allowing a denial of service (CVE-2022-32189)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 9 | toolbox | 0.0.99.3-9.el9 |
| AlmaLinux · 9 | toolbox-tests | 0.0.99.3-9.el9 |
Vulnerabilities 3
-
High 7.5
golang.org/x/net/http2 Denial of Service vulnerability
In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error.
-
Medium 5.3CVE-2022-41717 Public exploit
Excessive memory growth in net/http and golang.org/x/net/http2
An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large…
-
Unscored —
Panic when decoding Float and Rat types in math/big
A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go before 1.17.13 and 1.18.5, potentially allowing a denial of service.
References
-
report
https://access.redhat.com/security/cve/CVE-2022-27664
-
report
https://access.redhat.com/security/cve/CVE-2022-32189
-
report
https://access.redhat.com/security/cve/CVE-2022-41717
-
report
https://bugzilla.redhat.com/2113814
-
report
https://bugzilla.redhat.com/2124669
-
report
https://bugzilla.redhat.com/2161274
-
advisory
https://errata.almalinux.org/9/ALSA-2023-2236.html