Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · RHEL 8 enterprise_linux:8::appstream | git-lfs | 0:3.4.1-1.el8 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | git-lfs-debuginfo | 0:3.4.1-1.el8 |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | git-lfs-debugsource | 0:3.4.1-1.el8 |
Vulnerabilities 1
-
Unscored —CVE-2023-29406 Public exploit
Insufficient sanitization of Host header in net/http
The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send requests containing an invalid Request.Host or Reque…
References
-
article
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.10_release_notes/index
-
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhba-2024_3053.json
-
report
https://access.redhat.com/security/cve/CVE-2023-29406
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2222167
-
advisory
https://www.cve.org/CVERecord?id=CVE-2023-29406
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-29406
-
article
https://groups.google.com/g/golang-announce/c/2q13H6LEEx0