Important: container-tools:ol8 security update (Oracle Linux 8)

Summary

Fixed packages 32

Vulnerabilities 8

• High 8.3
  CVE-2024-3727

  Containers/image: digest type does not guarantee valid type

  A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks.

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine Wolfi Go
  May 9, 2024
• High 7.5
  CVE-2024-1394

  Golang-fips/openssl: memory leaks in code encrypting and decrypting rsa payloads

  A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled inputs​. The memory leak happens in github.com/golang-fips/openssl/openssl/rsa.go#L113. The objects…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Azure Linux Go
  Mar 21, 2024
• High 7.5
  CVE-2024-24784

  Comments in display names are incorrectly handled in net/mail

  The ParseAddressList function incorrectly handles comments (text within parentheses) within display names. Since this is a misalignment with conforming address parsers, it can result in different trust decisions being made by programs using different parsers.

  Go standard library net/mail golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  Mar 5, 2024
• High 7.5
  CVE-2024-37298

  Potential memory exhaustion attack due to sparse slice deserialization

  gorilla/schema converts structs to and from form values. Prior to version 1.4.1 Running `schema.Decoder.Decode()` on a struct that has a field of type `[]struct{...}` opens it up to malicious attacks regarding memory allocations, taking advantage of the spars…

  gorilla schema zot telegraf Debian Ubuntu Azure Linux Wolfi Go
  Jul 1, 2024
• Medium 6.5
  CVE-2023-45290

  Memory exhaustion in multipart form parsing in net/textproto and net/http

  When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile), limits on the total size of the parsed form were not applied to the memory consumed while readi…

  Go standard library net/textproto golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  Mar 5, 2024
• Medium 6.0
  CVE-2024-6104

  go-retryablehttp can leak basic auth credentials to log files

  go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability, CVE-2024-6104, was fixed in go-retryablehttp 0.7.7.

  HashiCorp Shared library zot kubescape Debian Ubuntu Azure Linux Wolfi Go
  Jun 24, 2024
• Medium 5.9
  CVE-2024-24783

  Verify panics on certificates with an unknown public key algorithm in crypto/x509

  Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic. This affects all crypto/tls clients, and servers that set Config.ClientAuth to VerifyClientCertIfGiven or RequireAndVerifyC…

  Go standard library crypto/x509 golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  Mar 5, 2024
• Medium 5.3
  CVE-2024-24789

  Mishandling of corrupt central directory record in archive/zip

  The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file with contents that vary depending on the implementation reading the file…

  Go standard library archive/zip golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  Jun 5, 2024