Summary
[2:4.6.1-7.0.1]
- Rebuild for following CVEs:
CVE-2023-39318 CVE-2023-39319 CVE-2023-39321 CVE-2023-39322 CVE-2023-29409
- Resolves: #2228743
- Resolves: #2237773
- Resolves: #2237776
- Resolves: #2237777
- Resolves: #2237778
[2:4.6.1-6.0.1]
- Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117404]
[2:4.6.1-6]
- update to the latest content of https://github.com/containers/podman/tree/v4.6.1-rhel
(https://github.com/containers/podman/commit/68e7ae0)
- Related: Jira:RHEL-2112
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | podman | 2:4.6.1-7.0.1.el9_3 |
| Oracle Linux · 9 | podman-docker | 2:4.6.1-7.0.1.el9_3 |
| Oracle Linux · 9 | podman-gvproxy | 2:4.6.1-7.0.1.el9_3 |
| Oracle Linux · 9 | podman-plugins | 2:4.6.1-7.0.1.el9_3 |
| Oracle Linux · 9 | podman-remote | 2:4.6.1-7.0.1.el9_3 |
| Oracle Linux · 9 | podman-tests | 2:4.6.1-7.0.1.el9_3 |
Vulnerabilities 5
-
Unscored —CVE-2023-29409 Public exploit
Large RSA keys can cause high CPU usage in crypto/tls
Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the size of RSA keys transmitted during handshakes is restricted to <= 8192 bits. Based on a survey of publicly trusted RSA…
-
Unscored —
Improper handling of HTML-like comments in script contexts in html/template
The html/template package does not properly handle HTML-like "" comment tokens, nor hashbang "#!" comment tokens, in <script> contexts. This may cause the template parser to improperly interpret the contents of <script> contexts, causing actions to be imprope…
-
Unscored —
Improper handling of special tags within script contexts in html/template
The html/template package does not apply the proper rules for handling occurrences of "<script", "<!--", and "</script" within JS literals in <script> contexts. This may cause the template parser to improperly consider script contexts to be terminated early, …
-
Unscored —
Panic when processing post-handshake message on QUIC connections in crypto/tls
Processing an incomplete post-handshake message for a QUIC connection can cause a panic.
-
Unscored —
Memory exhaustion in QUIC connection handling in crypto/tls
QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now consistently reject messages larger than 65KiB in …