Summary
The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files.
Security Fix(es):
* containers/image: digest type does not guarantee valid type (CVE-2024-3727)
* golang: net: malformed DNS message can cause infinite loop (CVE-2024-24788)
* go-retryable[http:](http:) url might write sensitive information to log file (CVE-2024-6104)
* net/[http:](http:) Denial of service due to improper 100-continue handling in net/http (CVE-2024-24791)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 9 | skopeo | 2:1.16.1-1.el9 |
| AlmaLinux · 9 | skopeo-tests | 2:1.16.1-1.el9 |
Vulnerabilities 4
-
High 8.3
Containers/image: digest type does not guarantee valid type
A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks.
-
High 7.5
Denial of service due to improper 100-continue handling in net/http
The net/http HTTP/1.1 client mishandled the case where a server responds to a request with an "Expect: 100-continue" header with a non-informational (200 or higher) status. This mishandling could leave a client connection in an invalid state, where the next r…
-
Medium 6.0
go-retryablehttp can leak basic auth credentials to log files
go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability, CVE-2024-6104, was fixed in go-retryablehttp 0.7.7.
-
Medium 5.9
Malformed DNS message can cause infinite loop in net
A malformed DNS message in response to a query can cause the Lookup functions to get stuck in an infinite loop.
References
-
report
https://access.redhat.com/security/cve/CVE-2024-24788
-
report
https://access.redhat.com/security/cve/CVE-2024-24791
-
report
https://access.redhat.com/security/cve/CVE-2024-3727
-
report
https://access.redhat.com/security/cve/CVE-2024-6104
-
report
https://bugzilla.redhat.com/2274767
-
report
https://bugzilla.redhat.com/2279814
-
report
https://bugzilla.redhat.com/2294000
-
report
https://bugzilla.redhat.com/2295310
-
advisory
https://errata.almalinux.org/9/ALSA-2024-9098.html