Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · RHEL 9 enterprise_linux:9::appstream | containernetworking-plugins | 1:1.4.0-2.el9_4 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | containernetworking-plugins-debuginfo | 1:1.4.0-2.el9_4 |
| Red Hat · RHEL 9 enterprise_linux:9::appstream | containernetworking-plugins-debugsource | 1:1.4.0-2.el9_4 |
Vulnerabilities 2
-
Unscored —
Denial of service via chunk extensions in net/http
A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically rea…
-
Unscored —
Before Go 1.20, the RSA based key exchange methods in crypto/tls may exhibit a timing side channel
Before Go 1.20, the RSA based TLS key exchanges used the math/big library, which is not constant time. RSA blinding was applied to prevent timing attacks, but analysis shows this may not have been fully effective. In particular it appears as if the removal of…
References
-
article
https://access.redhat.com/security/updates/classification/#moderate
-
article
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.4_release_notes/index
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2253193
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2253330
-
article
https://issues.redhat.com/browse/RHEL-3140
-
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2272.json
-
report
https://access.redhat.com/security/cve/CVE-2023-39326
-
advisory
https://www.cve.org/CVERecord?id=CVE-2023-39326
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-39326
-
advisory
https://pkg.go.dev/vuln/GO-2023-2382
-
report
https://access.redhat.com/security/cve/CVE-2023-45287
-
advisory
https://www.cve.org/CVERecord?id=CVE-2023-45287
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-45287
-
advisory
https://pkg.go.dev/vuln/GO-2023-2375