Fixed packages 4
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · RHEL 9 enterprise_linux:9::appstream | skopeo | 2:1.14.3-0.1.el9 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | skopeo-debuginfo | 2:1.14.3-0.1.el9 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | skopeo-debugsource | 2:1.14.3-0.1.el9 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | skopeo-tests | 2:1.14.3-0.1.el9 |
Vulnerabilities 1
-
Unscored —
Before Go 1.20, the RSA based key exchange methods in crypto/tls may exhibit a timing side channel
Before Go 1.20, the RSA based TLS key exchanges used the math/big library, which is not constant time. RSA blinding was applied to prevent timing attacks, but analysis shows this may not have been fully effective. In particular it appears as if the removal of…
References
-
article
https://access.redhat.com/security/updates/classification/#moderate
-
article
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.4_release_notes/index
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2253193
-
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2239.json
-
report
https://access.redhat.com/security/cve/CVE-2023-45287
-
advisory
https://www.cve.org/CVERecord?id=CVE-2023-45287
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-45287
-
advisory
https://pkg.go.dev/vuln/GO-2023-2375