Summary
Toolbox is a tool for Linux operating systems, which allows the use of containerized command line environments. It is built on top of Podman and other standard container technologies from OCI.
Security Fix(es):
* go-yaml: Improve heuristics preventing CPU/memory abuse by parsing malicious or large YAML documents (CVE-2022-3064)
* golang: html/template: improper handling of JavaScript whitespace (CVE-2023-24540)
* net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding (CVE-2022-41723)
* golang: net/http, mime/multipart: denial of service from excessive resource consumption (CVE-2022-41725)
* golang: net/http, net/textproto: denial of service from excessive memory allocation (CVE-2023-24534)
* golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption (CVE-2023-24536)
* golang: html/template: backticks not treated as string delimiters (CVE-2023-24538)
* golang: html/template: improper sanitization of CSS values (CVE-2023-24539)
* golang: html/template: improper handling of empty HTML attributes (CVE-2023-29400)
* golang: net/http: insufficient sanitization of Host header (CVE-2023-29406)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 9 | toolbox | 0.0.99.4-6.el9_3 |
| AlmaLinux · 9 | toolbox-tests | 0.0.99.4-6.el9_3 |
Vulnerabilities 10
-
Critical 9.8CVE-2023-24538 Public exploit
Backticks not treated as string delimiters in html/template
Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them as expected. Backticks are used, since ES6, for JS template literals. If a template contains a Go template action within a Javascript template literal, th…
-
Critical 9.8
Improper handling of JavaScript whitespace in html/template
Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the character set "\t\n\f\r\u0020\u2028\u2029" in JavaScript contexts that also contain actions may not be properly sanitized…
-
High 7.5
Excessive resource consumption in gopkg.in/yaml.v2
Parsing malicious or large YAML documents can consume excessive amounts of CPU or memory.
-
High 7.5
Denial of service via crafted HTTP/2 stream in net/http and golang.org/x/net
A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.
-
High 7.5
Excessive memory allocation in net/http and net/textproto
HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of service. Certain unusual patterns of input data can cause the common function used to parse HTTP and MIME headers to allocate…
-
High 7.5
Excessive resource consumption in net/http, net/textproto and mime/multipart
Multipart form parsing can consume large amounts of CPU and memory when processing form inputs containing very large numbers of parts. This stems from several causes: 1. mime/multipart.Reader.ReadForm limits the total memory a parsed multipart form can consum…
-
High 7.3
Improper sanitization of CSS values in html/template
Angle brackets (<>) are not considered dangerous characters when inserted into CSS contexts. Templates containing multiple actions separated by a '/' character can result in unexpectedly closing the CSS context and allowing for injection of unexpected HTML, i…
-
High 7.3
Improper handling of empty HTML attributes in html/template
Templates containing actions in unquoted HTML attributes (e.g. "attr={{.}}") executed with empty input can result in output with unexpected results when parsed due to HTML normalization rules. This may allow injection of arbitrary attributes into tags.
-
Unscored —
Excessive resource consumption in mime/multipart
A denial of service is possible from excessive resource consumption in net/http and mime/multipart. Multipart form parsing with mime/multipart.Reader.ReadForm can consume largely unlimited amounts of memory and disk files. This also affects form parsing in th…
-
Unscored —CVE-2023-29406 Public exploit
Insufficient sanitization of Host header in net/http
The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send requests containing an invalid Request.Host or Reque…
References
-
report
https://access.redhat.com/security/cve/CVE-2022-3064
-
report
https://access.redhat.com/security/cve/CVE-2022-41723
-
report
https://access.redhat.com/security/cve/CVE-2022-41725
-
report
https://access.redhat.com/security/cve/CVE-2023-24534
-
report
https://access.redhat.com/security/cve/CVE-2023-24536
-
report
https://access.redhat.com/security/cve/CVE-2023-24538
-
report
https://access.redhat.com/security/cve/CVE-2023-24539
-
report
https://access.redhat.com/security/cve/CVE-2023-24540
-
report
https://access.redhat.com/security/cve/CVE-2023-29400
-
report
https://access.redhat.com/security/cve/CVE-2023-29406
-
report
https://bugzilla.redhat.com/2163037
-
report
https://bugzilla.redhat.com/2178358
-
report
https://bugzilla.redhat.com/2178488
-
report
https://bugzilla.redhat.com/2184481
-
report
https://bugzilla.redhat.com/2184482
-
report
https://bugzilla.redhat.com/2184483
-
report
https://bugzilla.redhat.com/2196026
-
report
https://bugzilla.redhat.com/2196027
-
report
https://bugzilla.redhat.com/2196029
-
report
https://bugzilla.redhat.com/2222167
-
advisory
https://errata.almalinux.org/9/ALSA-2023-6346.html