Medium ELSA-2023-7763 3 CVEs

Moderate: runc security update (Oracle Linux 9)

Published Dec 14, 2023 · Updated Dec 14, 2023

Ecosystem: Oracle Linux

Summary

[4:1.1.9-2]
- Rebuild for CVEs: CVE-2023-39321 CVE-2023-39322 CVE-2023-29409
- Resolves: #2228743
- Resolves: #2237777
- Resolves: #2237778

Fixed packages 1

Release	Package	Fixed in
Oracle Linux · 9	runc	4:1.1.9-2.el9_3

Vulnerabilities 3

Unscored —

CVE-2023-29409 Public exploit

Large RSA keys can cause high CPU usage in crypto/tls

Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the size of RSA keys transmitted during handshakes is restricted to <= 8192 bits. Based on a survey of publicly trusted RSA…

Go standard library crypto/tls katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go

Aug 2, 2023
Unscored —

CVE-2023-39321

Panic when processing post-handshake message on QUIC connections in crypto/tls

Processing an incomplete post-handshake message for a QUIC connection can cause a panic.

Go standard library crypto/tls go stdlib Alpine Wolfi Go

Sep 8, 2023
Unscored —

CVE-2023-39322

Memory exhaustion in QUIC connection handling in crypto/tls

QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now consistently reject messages larger than 65KiB in …

Go standard library crypto/tls go stdlib Alpine Wolfi Go

Sep 8, 2023