Skip to content
OpenAdvisories
Medium ELSA-2024-3827 3 CVEs

Moderate: buildah security and bug fix update (Oracle Linux 9)

Published Jun 11, 2024 · Updated Jun 11, 2024

Ecosystem: Oracle Linux

Summary

[1.33.7-2.0.1]
- Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117178]

[2:1.33.7-2]
- update to the latest content of https://github.com/containers/buildah/tree/release-1.33
(https://github.com/containers/buildah/commit/997beea)
- Resolves: RHEL-28731

Fixed packages 2

ReleasePackageFixed in
Oracle Linux · 9 buildah 2:1.33.7-2.0.1.el9_4
Oracle Linux · 9 buildah-tests 2:1.33.7-2.0.1.el9_4

Vulnerabilities 3

  • Medium 6.5
    CVE-2023-45290

    Memory exhaustion in multipart form parsing in net/textproto and net/http

    When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile), limits on the total size of the parsed form were not applied to the memory consumed while readi…

    Go standard library net/textproto golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  • Medium 4.9
    CVE-2024-28176

    jose vulnerable to resource exhaustion via specifically crafted JWE with compressed plaintext

    jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS), and more. A vulnerability has been identified in t…

    panva jose sqlpad sqlpad-compat Ubuntu Wolfi npm
  • Medium 4.3
    CVE-2024-28180

    Go JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification)

    Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Th…

    go-jose go-jose zot kubescape Debian Azure Linux Alpine Wolfi Go