Summary
Toolbox is a tool for Linux operating systems, which allows the use of containerized command line environments. It is built on top of Podman and other standard container technologies from OCI.
Security Fix(es):
* golang: net/[http:](http:) golang: mime/multipart: golang: net/textproto: memory exhaustion in Request.ParseMultipartForm (CVE-2023-45290)
* golang: html/template: errors returned from MarshalJSON methods may break template escaping (CVE-2024-24785)
* golang: net: malformed DNS message can cause infinite loop (CVE-2024-24788)
* net/[http:](http:) Denial of service due to improper 100-continue handling in net/http (CVE-2024-24791)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 9 | toolbox | 0.0.99.5-5.el9 |
| AlmaLinux · 9 | toolbox-tests | 0.0.99.5-5.el9 |
Vulnerabilities 4
-
High 7.5
Denial of service due to improper 100-continue handling in net/http
The net/http HTTP/1.1 client mishandled the case where a server responds to a request with an "Expect: 100-continue" header with a non-informational (200 or higher) status. This mishandling could leave a client connection in an invalid state, where the next r…
-
Medium 6.5
Memory exhaustion in multipart form parsing in net/textproto and net/http
When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile), limits on the total size of the parsed form were not applied to the memory consumed while readi…
-
Medium 5.9
Malformed DNS message can cause infinite loop in net
A malformed DNS message in response to a query can cause the Lookup functions to get stuck in an infinite loop.
-
Medium 5.4
Errors returned from JSON marshaling may break template escaping in html/template
If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing for subsequent actions to inject unexpected content into templates.
References
-
report
https://access.redhat.com/security/cve/CVE-2023-45290
-
report
https://access.redhat.com/security/cve/CVE-2024-24785
-
report
https://access.redhat.com/security/cve/CVE-2024-24788
-
report
https://access.redhat.com/security/cve/CVE-2024-24791
-
report
https://bugzilla.redhat.com/2268017
-
report
https://bugzilla.redhat.com/2268022
-
report
https://bugzilla.redhat.com/2279814
-
report
https://bugzilla.redhat.com/2295310
-
advisory
https://errata.almalinux.org/9/ALSA-2024-9135.html