Skip to content
OpenAdvisories
Medium RHSA-2024:3827 3 CVEs

Red Hat Security Advisory: buildah security and bug fix update

Published Oct 2, 2024 · Updated Oct 16, 2026

Ecosystem: Red Hat

Fixed packages 5

ReleasePackageFixed in
Red Hat · RHEL 9 enterprise_linux:9::appstream buildah 2:1.33.7-2.el9_4
Red Hat · RHEL 9 enterprise_linux:9::appstream buildah-debuginfo 2:1.33.7-2.el9_4
Red Hat · RHEL 9 enterprise_linux:9::appstream buildah-debugsource 2:1.33.7-2.el9_4
Red Hat · RHEL 9 enterprise_linux:9::appstream buildah-tests 2:1.33.7-2.el9_4
Red Hat · RHEL 9 enterprise_linux:9::appstream buildah-tests-debuginfo 2:1.33.7-2.el9_4

Vulnerabilities 3

  • Medium 6.5
    CVE-2023-45290

    Memory exhaustion in multipart form parsing in net/textproto and net/http

    When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile), limits on the total size of the parsed form were not applied to the memory consumed while readi…

    Go standard library net/textproto golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  • Medium 4.9
    CVE-2024-28176

    jose vulnerable to resource exhaustion via specifically crafted JWE with compressed plaintext

    jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS), and more. A vulnerability has been identified in t…

    panva jose sqlpad sqlpad-compat Ubuntu Wolfi npm
  • Medium 4.3
    CVE-2024-28180

    Go JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification)

    Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Th…

    go-jose go-jose zot kubescape Debian Azure Linux Alpine Wolfi Go

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2268017
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2268820
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2268854
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_3827.json
  • report
    https://access.redhat.com/security/cve/CVE-2023-45290
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-45290
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-45290
  • article
    http://www.openwall.com/lists/oss-security/2024/03/08/4
  • article
    https://go.dev/cl/569341
  • article
    https://go.dev/issue/65383
  • article
    https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg
  • advisory
    https://pkg.go.dev/vuln/GO-2024-2599
  • article
    https://security.netapp.com/advisory/ntap-20240329-0004
  • report
    https://access.redhat.com/security/cve/CVE-2024-28176
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2024-28176
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2024-28176
  • article
    https://github.com/panva/jose/security/advisories/GHSA-hhhv-q57g-882q
  • report
    https://access.redhat.com/security/cve/CVE-2024-28180
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2024-28180
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2024-28180
  • article
    https://github.com/go-jose/go-jose/security/advisories/GHSA-c5q2-7r4c-mv6g