RHSA-2024:2988 — Red Hat Security Advisory: container-tools:rhel8 security update

Fixed packages 65

Release	Package	Fixed in
Red Hat · RHEL 8 enterprise_linux:8::appstream	aardvark-dns	2:1.10.0-1.module+el8.10.0+21209+52deeb51
Red Hat · RHEL 8 enterprise_linux:8::appstream	buildah	2:1.33.6-2.module+el8.10.0+21371+46937ece
Red Hat · RHEL 8 enterprise_linux:8::appstream	buildah-debuginfo	2:1.33.6-2.module+el8.10.0+21371+46937ece
Red Hat · RHEL 8 enterprise_linux:8::appstream	buildah-debugsource	2:1.33.6-2.module+el8.10.0+21371+46937ece
Red Hat · RHEL 8 enterprise_linux:8::appstream	buildah-tests	2:1.33.6-2.module+el8.10.0+21371+46937ece
Red Hat · RHEL 8 enterprise_linux:8::appstream	buildah-tests-debuginfo	2:1.33.6-2.module+el8.10.0+21371+46937ece
Red Hat · RHEL 8 enterprise_linux:8::appstream	cockpit-podman	0:84.1-1.module+el8.10.0+21373+0d273fdf
Red Hat · RHEL 8 enterprise_linux:8::appstream	conmon	3:2.1.10-1.module+el8.10.0+21077+98b84d8a
Red Hat · RHEL 8 enterprise_linux:8::appstream	conmon-debuginfo	3:2.1.10-1.module+el8.10.0+21077+98b84d8a
Red Hat · RHEL 8 enterprise_linux:8::appstream	conmon-debugsource	3:2.1.10-1.module+el8.10.0+21077+98b84d8a
Red Hat · RHEL 8 enterprise_linux:8::appstream	container-selinux	2:2.229.0-2.module+el8.10.0+21196+3f0abbca
Red Hat · RHEL 8 enterprise_linux:8::appstream	containernetworking-plugins	1:1.4.0-2.module+el8.10.0+21366+f9cb49f8
Red Hat · RHEL 8 enterprise_linux:8::appstream	containernetworking-plugins-debuginfo	1:1.4.0-2.module+el8.10.0+21366+f9cb49f8
Red Hat · RHEL 8 enterprise_linux:8::appstream	containernetworking-plugins-debugsource	1:1.4.0-2.module+el8.10.0+21366+f9cb49f8
Red Hat · RHEL 8 enterprise_linux:8::appstream	containers-common	2:1-81.module+el8.10.0+21340+c6c7475a
Red Hat · RHEL 8 enterprise_linux:8::appstream	crit	0:3.18-4.module+el8.9.0+20326+387084d0
Red Hat · RHEL 8 enterprise_linux:8::appstream	criu	0:3.18-4.module+el8.9.0+20326+387084d0
Red Hat · RHEL 8 enterprise_linux:8::appstream	criu-debuginfo	0:3.18-4.module+el8.9.0+20326+387084d0
Red Hat · RHEL 8 enterprise_linux:8::appstream	criu-debugsource	0:3.18-4.module+el8.9.0+20326+387084d0
Red Hat · RHEL 8 enterprise_linux:8::appstream	criu-devel	0:3.18-4.module+el8.9.0+20326+387084d0
Red Hat · RHEL 8 enterprise_linux:8::appstream	criu-libs	0:3.18-4.module+el8.9.0+20326+387084d0
Red Hat · RHEL 8 enterprise_linux:8::appstream	criu-libs-debuginfo	0:3.18-4.module+el8.9.0+20326+387084d0
Red Hat · RHEL 8 enterprise_linux:8::appstream	crun	0:1.14.3-2.module+el8.10.0+21340+c6c7475a
Red Hat · RHEL 8 enterprise_linux:8::appstream	crun-debuginfo	0:1.14.3-2.module+el8.10.0+21340+c6c7475a
Red Hat · RHEL 8 enterprise_linux:8::appstream	crun-debugsource	0:1.14.3-2.module+el8.10.0+21340+c6c7475a
Red Hat · RHEL 8 enterprise_linux:8::appstream	fuse-overlayfs	0:1.13-1.module+el8.10.0+20412+95ee28e2
Red Hat · RHEL 8 enterprise_linux:8::appstream	fuse-overlayfs-debuginfo	0:1.13-1.module+el8.10.0+20412+95ee28e2
Red Hat · RHEL 8 enterprise_linux:8::appstream	fuse-overlayfs-debugsource	0:1.13-1.module+el8.10.0+20412+95ee28e2
Red Hat · RHEL 8 enterprise_linux:8::appstream	libslirp	0:4.4.0-1.module+el8.9.0+20326+387084d0
Red Hat · RHEL 8 enterprise_linux:8::appstream	libslirp-debuginfo	0:4.4.0-1.module+el8.9.0+20326+387084d0
Red Hat · RHEL 8 enterprise_linux:8::appstream	libslirp-debugsource	0:4.4.0-1.module+el8.9.0+20326+387084d0
Red Hat · RHEL 8 enterprise_linux:8::appstream	libslirp-devel	0:4.4.0-1.module+el8.9.0+20326+387084d0
Red Hat · RHEL 8 enterprise_linux:8::appstream	netavark	2:1.10.3-1.module+el8.10.0+21306+6be40ce7
Red Hat · RHEL 8 enterprise_linux:8::appstream	oci-seccomp-bpf-hook	0:1.2.10-1.module+el8.10.0+20565+a40ba0e5
Red Hat · RHEL 8 enterprise_linux:8::appstream	oci-seccomp-bpf-hook-debuginfo	0:1.2.10-1.module+el8.10.0+20565+a40ba0e5
Red Hat · RHEL 8 enterprise_linux:8::appstream	oci-seccomp-bpf-hook-debugsource	0:1.2.10-1.module+el8.10.0+20565+a40ba0e5
Red Hat · RHEL 8 enterprise_linux:8::appstream	podman	3:4.9.4-0.1.module+el8.10.0+21350+ea09fba1
Red Hat · RHEL 8 enterprise_linux:8::appstream	podman-catatonit	3:4.9.4-0.1.module+el8.10.0+21350+ea09fba1
Red Hat · RHEL 8 enterprise_linux:8::appstream	podman-catatonit-debuginfo	3:4.9.4-0.1.module+el8.10.0+21350+ea09fba1
Red Hat · RHEL 8 enterprise_linux:8::appstream	podman-debuginfo	3:4.9.4-0.1.module+el8.10.0+21350+ea09fba1
Red Hat · RHEL 8 enterprise_linux:8::appstream	podman-debugsource	3:4.9.4-0.1.module+el8.10.0+21350+ea09fba1
Red Hat · RHEL 8 enterprise_linux:8::appstream	podman-docker	3:4.9.4-0.1.module+el8.10.0+21350+ea09fba1
Red Hat · RHEL 8 enterprise_linux:8::appstream	podman-gvproxy	3:4.9.4-0.1.module+el8.10.0+21350+ea09fba1
Red Hat · RHEL 8 enterprise_linux:8::appstream	podman-gvproxy-debuginfo	3:4.9.4-0.1.module+el8.10.0+21350+ea09fba1
Red Hat · RHEL 8 enterprise_linux:8::appstream	podman-plugins	3:4.9.4-0.1.module+el8.10.0+21350+ea09fba1
Red Hat · RHEL 8 enterprise_linux:8::appstream	podman-plugins-debuginfo	3:4.9.4-0.1.module+el8.10.0+21350+ea09fba1
Red Hat · RHEL 8 enterprise_linux:8::appstream	podman-remote	3:4.9.4-0.1.module+el8.10.0+21350+ea09fba1
Red Hat · RHEL 8 enterprise_linux:8::appstream	podman-remote-debuginfo	3:4.9.4-0.1.module+el8.10.0+21350+ea09fba1
Red Hat · RHEL 8 enterprise_linux:8::appstream	podman-tests	3:4.9.4-0.1.module+el8.10.0+21350+ea09fba1
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-podman	0:4.9.0-1.module+el8.10.0+21196+3f0abbca
Red Hat · RHEL 8 enterprise_linux:8::appstream	python3-criu	0:3.18-4.module+el8.9.0+20326+387084d0
Red Hat · RHEL 8 enterprise_linux:8::appstream	python3-podman	0:4.9.0-1.module+el8.10.0+21196+3f0abbca
Red Hat · RHEL 8 enterprise_linux:8::appstream	runc	1:1.1.12-1.module+el8.10.0+21251+62b7388c
Red Hat · RHEL 8 enterprise_linux:8::appstream	runc-debuginfo	1:1.1.12-1.module+el8.10.0+21251+62b7388c
Red Hat · RHEL 8 enterprise_linux:8::appstream	runc-debugsource	1:1.1.12-1.module+el8.10.0+21251+62b7388c
Red Hat · RHEL 8 enterprise_linux:8::appstream	skopeo	2:1.14.3-0.1.module+el8.10.0+21251+62b7388c
Red Hat · RHEL 8 enterprise_linux:8::appstream	skopeo-tests	2:1.14.3-0.1.module+el8.10.0+21251+62b7388c
Red Hat · RHEL 8 enterprise_linux:8::appstream	slirp4netns	0:1.2.3-1.module+el8.10.0+21306+6be40ce7
Red Hat · RHEL 8 enterprise_linux:8::appstream	slirp4netns-debuginfo	0:1.2.3-1.module+el8.10.0+21306+6be40ce7
Red Hat · RHEL 8 enterprise_linux:8::appstream	slirp4netns-debugsource	0:1.2.3-1.module+el8.10.0+21306+6be40ce7
Red Hat · RHEL 8 enterprise_linux:8::appstream	toolbox	0:0.0.99.5-2.module+el8.10.0+21341+ff0b5f89
Red Hat · RHEL 8 enterprise_linux:8::appstream	toolbox-debuginfo	0:0.0.99.5-2.module+el8.10.0+21341+ff0b5f89
Red Hat · RHEL 8 enterprise_linux:8::appstream	toolbox-debugsource	0:0.0.99.5-2.module+el8.10.0+21341+ff0b5f89
Red Hat · RHEL 8 enterprise_linux:8::appstream	toolbox-tests	0:0.0.99.5-2.module+el8.10.0+21341+ff0b5f89
Red Hat · RHEL 8 enterprise_linux:8::appstream	udica	0:0.2.6-20.module+el8.9.0+20326+387084d0

Vulnerabilities 16

Medium 6.1

CVE-2018-25091

Authorization Header forwarded on redirect

urllib3 before 1.24.2 does not remove the authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the authorization header to be exposed to unintended hosts o…

python-pip urllib3 python-urllib3 python-urllib3 Debian Ubuntu PyPI

Oct 15, 2023
Medium 5.9

CVE-2023-48795 Public exploit Scanner template EPSS 94%

Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server…

zot kubescape kots k3d Debian Ubuntu Azure Linux Alpine Wolfi PyPI Go crates.io

Dec 18, 2023
Medium 5.3

CVE-2024-23650

BuildKit possible panic when incorrect parameters sent from frontend

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic. The issue has been f…

moby BuildKit zot kubescape Ubuntu Azure Linux Alpine Wolfi Go

Jan 31, 2024
Medium 4.2

CVE-2023-45803

Request body not stripped after redirect in urllib3

urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn't remove the HTTP request body when an HTTP redirect response using status 301, 302, or 303 after the request had its method changed from one that could accept a request body…

urllib3 urllib3 katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi PyPI

Oct 17, 2023
Unscored —

CVE-2021-33198

Panic on inputs with large exponents in math/big

In Go before 1.15.13 and 1.16.x before 1.16.5, there can be a panic for a large exponent to the math/big.Rat SetString or UnmarshalText method.

go stdlib golang-1.8 golang-1.16 Debian Ubuntu Alpine Go

Aug 2, 2021
Unscored —

CVE-2021-34558 Public exploit

Panic on certain certificates in crypto/tls

The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS server to cause a TLS client to panic.

golang go stdlib golang-1.8 Debian Ubuntu Azure Linux Alpine Go

Jul 15, 2021
Unscored —

CVE-2022-2879

Unbounded memory consumption when reading headers in archive/tar

Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of …

Go standard library archive/tar katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go

Oct 14, 2022
Unscored —

CVE-2022-2880

Incorrect sanitization of forwarded query parameters in net/http/httputil

Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy forwards a parameter with an unparsable value. Afte…

Go standard library net/http/httputil katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go

Oct 14, 2022
Unscored —

CVE-2022-41715

Memory exhaustion when compiling regular expressions in regexp/syntax

Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed regexp representation is linear in the size of the input, but in some cases the constant factor can be as high as 40,000,…

Go standard library regexp/syntax katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go

Oct 14, 2022
Unscored —

CVE-2023-29409 Public exploit

Large RSA keys can cause high CPU usage in crypto/tls

Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the size of RSA keys transmitted during handshakes is restricted to <= 8192 bits. Based on a survey of publicly trusted RSA…

Go standard library crypto/tls katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go

Aug 2, 2023
Unscored —

CVE-2023-39318

Improper handling of HTML-like comments in script contexts in html/template

The html/template package does not properly handle HTML-like "" comment tokens, nor hashbang "#!" comment tokens, in <script> contexts. This may cause the template parser to improperly interpret the contents of <script> contexts, causing actions to be imprope…

Go standard library html/template katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go

Sep 8, 2023
Unscored —

CVE-2023-39319

Improper handling of special tags within script contexts in html/template

The html/template package does not apply the proper rules for handling occurrences of "<script", "<!--", and "</script" within JS literals in <script> contexts. This may cause the template parser to improperly consider script contexts to be terminated early, …

Go standard library html/template katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go

Sep 8, 2023
Unscored —

CVE-2023-39321

Panic when processing post-handshake message on QUIC connections in crypto/tls

Processing an incomplete post-handshake message for a QUIC connection can cause a panic.

Go standard library crypto/tls go stdlib Alpine Wolfi Go

Sep 8, 2023
Unscored —

CVE-2023-39322

Memory exhaustion in QUIC connection handling in crypto/tls

QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now consistently reject messages larger than 65KiB in …

Go standard library crypto/tls go stdlib Alpine Wolfi Go

Sep 8, 2023
Unscored —

CVE-2023-39326

Denial of service via chunk extensions in net/http

A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically rea…

Go standard library net/http/internal katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go

Dec 6, 2023
Unscored —

CVE-2023-45287

Before Go 1.20, the RSA based key exchange methods in crypto/tls may exhibit a timing side channel

Before Go 1.20, the RSA based TLS key exchanges used the math/big library, which is not constant time. RSA blinding was applied to prevent timing attacks, but analysis shows this may not have been fully effective. In particular it appears as if the removal of…

Go standard library crypto/tls katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Wolfi Go

Dec 5, 2023

References

article
https://access.redhat.com/security/updates/classification/#moderate
article
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.10_release_notes/index
report
https://bugzilla.redhat.com/show_bug.cgi?id=1983596
report
https://bugzilla.redhat.com/show_bug.cgi?id=1989575
report
https://bugzilla.redhat.com/show_bug.cgi?id=2132867
report
https://bugzilla.redhat.com/show_bug.cgi?id=2132868
report
https://bugzilla.redhat.com/show_bug.cgi?id=2132872
report
https://bugzilla.redhat.com/show_bug.cgi?id=2228743
report
https://bugzilla.redhat.com/show_bug.cgi?id=2237773
report
https://bugzilla.redhat.com/show_bug.cgi?id=2237776
report
https://bugzilla.redhat.com/show_bug.cgi?id=2237777
report
https://bugzilla.redhat.com/show_bug.cgi?id=2237778
report
https://bugzilla.redhat.com/show_bug.cgi?id=2244340
report
https://bugzilla.redhat.com/show_bug.cgi?id=2246840
report
https://bugzilla.redhat.com/show_bug.cgi?id=2253193
report
https://bugzilla.redhat.com/show_bug.cgi?id=2253330
report
https://bugzilla.redhat.com/show_bug.cgi?id=2254210
report
https://bugzilla.redhat.com/show_bug.cgi?id=2262272
article
https://issues.redhat.com/browse/RHEL-18150
article
https://issues.redhat.com/browse/RHEL-2598
article
https://issues.redhat.com/browse/RHEL-26594
article
https://issues.redhat.com/browse/RHEL-3088
article
https://issues.redhat.com/browse/RHEL-3093
article
https://issues.redhat.com/browse/RHEL-3146
article
https://issues.redhat.com/browse/RHEL-9836
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2988.json
report
https://access.redhat.com/security/cve/CVE-2018-25091
advisory
https://www.cve.org/CVERecord?id=CVE-2018-25091
advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-25091
article
https://security.snyk.io/vuln/SNYK-PYTHON-URLLIB3-5969479
report
https://access.redhat.com/security/cve/CVE-2021-33198
advisory
https://www.cve.org/CVERecord?id=CVE-2021-33198
advisory
https://nvd.nist.gov/vuln/detail/CVE-2021-33198
article
https://groups.google.com/g/golang-announce/c/RgCMkAEQjSI
report
https://access.redhat.com/security/cve/CVE-2021-34558
advisory
https://www.cve.org/CVERecord?id=CVE-2021-34558
advisory
https://nvd.nist.gov/vuln/detail/CVE-2021-34558
article
https://golang.org/doc/devel/release#go1.15.minor
article
https://golang.org/doc/devel/release#go1.16.minor

Red Hat Security Advisory: container-tools:rhel8 security update

Fixed packages 65

Vulnerabilities 16

Authorization Header forwarded on redirect

Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin

BuildKit possible panic when incorrect parameters sent from frontend

Request body not stripped after redirect in urllib3

Panic on inputs with large exponents in math/big

Panic on certain certificates in crypto/tls

Unbounded memory consumption when reading headers in archive/tar

Incorrect sanitization of forwarded query parameters in net/http/httputil

Memory exhaustion when compiling regular expressions in regexp/syntax

Large RSA keys can cause high CPU usage in crypto/tls

Improper handling of HTML-like comments in script contexts in html/template

Improper handling of special tags within script contexts in html/template

Panic when processing post-handshake message on QUIC connections in crypto/tls

Memory exhaustion in QUIC connection handling in crypto/tls

Denial of service via chunk extensions in net/http

Before Go 1.20, the RSA based key exchange methods in crypto/tls may exhibit a timing side channel

References