Red Hat Security Advisory: buildah security update

Fixed packages 5

Vulnerabilities 2

• Unscored —
  CVE-2023-39326

  Denial of service via chunk extensions in net/http

  A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically rea…

  Go standard library net/http/internal katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Dec 6, 2023
• Unscored —
  CVE-2023-45287

  Before Go 1.20, the RSA based key exchange methods in crypto/tls may exhibit a timing side channel

  Before Go 1.20, the RSA based TLS key exchanges used the math/big library, which is not constant time. RSA blinding was applied to prevent timing attacks, but analysis shows this may not have been fully effective. In particular it appears as if the removal of…

  Go standard library crypto/tls katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Wolfi Go
  Dec 5, 2023

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• article
  https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.4_release_notes/index
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2253193
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2253330
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2245.json
• report
  https://access.redhat.com/security/cve/CVE-2023-39326
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-39326
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-39326
• advisory
  https://pkg.go.dev/vuln/GO-2023-2382
• report
  https://access.redhat.com/security/cve/CVE-2023-45287
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-45287
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-45287
• advisory
  https://pkg.go.dev/vuln/GO-2023-2375