Skip to content
OpenAdvisories
High ELSA-2024-6194 3 CVEs

Important: podman security update (Oracle Linux 9)

Published Sep 3, 2024 · Updated Sep 3, 2024

Ecosystem: Oracle Linux

Summary

[4.9.4-10.0.1]
- Fixes issue of podman execvp error while using podmansh [Orabug: 36073625]
- Improved saving remote build context to tarfile in Podman daemon [Orabug: 36495655]
- Add devices on container startup, not on creation
- Backport fast gzip for compression [Orabug: 36420418]
- overlay: Put should ignore ENINVAL for Unmount [Orabug: 36234694]
- Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117404]

[4:4.9.4-10]
- update to the latest content of https://github.com/containers/podman/tree/v4.9-rhel
(https://github.com/containers/podman/commit/6b45bb1)
- Resolves: RHEL-53250

[4:4.9.4-9]
- update to the latest content of https://github.com/containers/podman/tree/v4.9-rhel
(https://github.com/containers/podman/commit/1a2d8e3)
- Resolves: RHEL-50507

[4:4.9.4-8]
- update to the latest content of https://github.com/containers/podman/tree/v4.9-rhel
(https://github.com/containers/podman/commit/affa589)
- Resolves: RHEL-45916

[4:4.9.4-7]
- update to the latest content of https://github.com/containers/podman/tree/v4.9-rhel
(https://github.com/containers/podman/commit/8fa0c76)
- Resolves: RHEL-40804

Fixed packages 5

ReleasePackageFixed in
Oracle Linux · 9 podman 4:4.9.4-10.0.1.el9_4
Oracle Linux · 9 podman-docker 4:4.9.4-10.0.1.el9_4
Oracle Linux · 9 podman-plugins 4:4.9.4-10.0.1.el9_4
Oracle Linux · 9 podman-remote 4:4.9.4-10.0.1.el9_4
Oracle Linux · 9 podman-tests 4:4.9.4-10.0.1.el9_4

Vulnerabilities 3

  • High 7.5
    CVE-2024-37298

    Potential memory exhaustion attack due to sparse slice deserialization

    gorilla/schema converts structs to and from form values. Prior to version 1.4.1 Running `schema.Decoder.Decode()` on a struct that has a field of type `[]struct{...}` opens it up to malicious attacks regarding memory allocations, taking advantage of the spars…

    gorilla schema zot telegraf Debian Ubuntu Azure Linux Wolfi Go
  • Medium 6.0
    CVE-2024-6104

    go-retryablehttp can leak basic auth credentials to log files

    go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability, CVE-2024-6104, was fixed in go-retryablehttp 0.7.7.

    HashiCorp Shared library zot kubescape Debian Ubuntu Azure Linux Wolfi Go
  • Medium 5.9
    CVE-2024-24783

    Verify panics on certificates with an unknown public key algorithm in crypto/x509

    Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic. This affects all crypto/tls clients, and servers that set Config.ClientAuth to VerifyClientCertIfGiven or RequireAndVerifyC…

    Go standard library crypto/x509 golang go Debian Ubuntu Azure Linux Alpine Wolfi Go