Summary
The Container Network Interface (CNI) project consists of a specification and libraries for writing plug-ins for configuring network interfaces in Linux containers, along with a number of supported plug-ins. CNI concerns itself only with network connectivity of containers and removing allocated resources when the container is deleted.
Security Fix(es):
* golang: net: malformed DNS message can cause infinite loop (CVE-2024-24788)
* net/[http:](http:) Denial of service due to improper 100-continue handling in net/http (CVE-2024-24791)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 9 | containernetworking-plugins | 1:1.5.1-2.el9 |
Vulnerabilities 2
-
High 7.5
Denial of service due to improper 100-continue handling in net/http
The net/http HTTP/1.1 client mishandled the case where a server responds to a request with an "Expect: 100-continue" header with a non-informational (200 or higher) status. This mishandling could leave a client connection in an invalid state, where the next r…
-
Medium 5.9
Malformed DNS message can cause infinite loop in net
A malformed DNS message in response to a query can cause the Lookup functions to get stuck in an infinite loop.