Skip to content
OpenAdvisories
Medium RHSA-2024:3968 2 CVEs

Red Hat Security Advisory: container-tools:rhel8 bug fix and enhancement update

Published Oct 22, 2024 · Updated Oct 16, 2026

Ecosystem: Red Hat

Fixed packages 65

ReleasePackageFixed in
Red Hat · RHEL 8 enterprise_linux:8::appstream aardvark-dns 2:1.10.0-1.module+el8.10.0+21962+8143777b
Red Hat · RHEL 8 enterprise_linux:8::appstream buildah 2:1.33.7-2.module+el8.10.0+21962+8143777b
Red Hat · RHEL 8 enterprise_linux:8::appstream buildah-debuginfo 2:1.33.7-2.module+el8.10.0+21962+8143777b
Red Hat · RHEL 8 enterprise_linux:8::appstream buildah-debugsource 2:1.33.7-2.module+el8.10.0+21962+8143777b
Red Hat · RHEL 8 enterprise_linux:8::appstream buildah-tests 2:1.33.7-2.module+el8.10.0+21962+8143777b
Red Hat · RHEL 8 enterprise_linux:8::appstream buildah-tests-debuginfo 2:1.33.7-2.module+el8.10.0+21962+8143777b
Red Hat · RHEL 8 enterprise_linux:8::appstream cockpit-podman 0:84.1-1.module+el8.10.0+21962+8143777b
Red Hat · RHEL 8 enterprise_linux:8::appstream conmon 3:2.1.10-1.module+el8.10.0+21962+8143777b
Red Hat · RHEL 8 enterprise_linux:8::appstream conmon-debuginfo 3:2.1.10-1.module+el8.10.0+21962+8143777b
Red Hat · RHEL 8 enterprise_linux:8::appstream conmon-debugsource 3:2.1.10-1.module+el8.10.0+21962+8143777b
Red Hat · RHEL 8 enterprise_linux:8::appstream container-selinux 2:2.229.0-2.module+el8.10.0+21962+8143777b
Red Hat · RHEL 8 enterprise_linux:8::appstream containernetworking-plugins 1:1.4.0-2.module+el8.10.0+21962+8143777b
Red Hat · RHEL 8 enterprise_linux:8::appstream containernetworking-plugins-debuginfo 1:1.4.0-2.module+el8.10.0+21962+8143777b
Red Hat · RHEL 8 enterprise_linux:8::appstream containernetworking-plugins-debugsource 1:1.4.0-2.module+el8.10.0+21962+8143777b
Red Hat · RHEL 8 enterprise_linux:8::appstream containers-common 2:1-81.module+el8.10.0+21962+8143777b
Red Hat · RHEL 8 enterprise_linux:8::appstream crit 0:3.18-5.module+el8.10.0+21962+8143777b
Red Hat · RHEL 8 enterprise_linux:8::appstream criu 0:3.18-5.module+el8.10.0+21962+8143777b
Red Hat · RHEL 8 enterprise_linux:8::appstream criu-debuginfo 0:3.18-5.module+el8.10.0+21962+8143777b
Red Hat · RHEL 8 enterprise_linux:8::appstream criu-debugsource 0:3.18-5.module+el8.10.0+21962+8143777b
Red Hat · RHEL 8 enterprise_linux:8::appstream criu-devel 0:3.18-5.module+el8.10.0+21962+8143777b
Red Hat · RHEL 8 enterprise_linux:8::appstream criu-libs 0:3.18-5.module+el8.10.0+21962+8143777b
Red Hat · RHEL 8 enterprise_linux:8::appstream criu-libs-debuginfo 0:3.18-5.module+el8.10.0+21962+8143777b
Red Hat · RHEL 8 enterprise_linux:8::appstream crun 0:1.14.3-2.module+el8.10.0+21962+8143777b
Red Hat · RHEL 8 enterprise_linux:8::appstream crun-debuginfo 0:1.14.3-2.module+el8.10.0+21962+8143777b
Red Hat · RHEL 8 enterprise_linux:8::appstream crun-debugsource 0:1.14.3-2.module+el8.10.0+21962+8143777b
Red Hat · RHEL 8 enterprise_linux:8::appstream fuse-overlayfs 0:1.13-1.module+el8.10.0+21962+8143777b
Red Hat · RHEL 8 enterprise_linux:8::appstream fuse-overlayfs-debuginfo 0:1.13-1.module+el8.10.0+21962+8143777b
Red Hat · RHEL 8 enterprise_linux:8::appstream fuse-overlayfs-debugsource 0:1.13-1.module+el8.10.0+21962+8143777b
Red Hat · RHEL 8 enterprise_linux:8::appstream libslirp 0:4.4.0-2.module+el8.10.0+21962+8143777b
Red Hat · RHEL 8 enterprise_linux:8::appstream libslirp-debuginfo 0:4.4.0-2.module+el8.10.0+21962+8143777b
Red Hat · RHEL 8 enterprise_linux:8::appstream libslirp-debugsource 0:4.4.0-2.module+el8.10.0+21962+8143777b
Red Hat · RHEL 8 enterprise_linux:8::appstream libslirp-devel 0:4.4.0-2.module+el8.10.0+21962+8143777b
Red Hat · RHEL 8 enterprise_linux:8::appstream netavark 2:1.10.3-1.module+el8.10.0+21962+8143777b
Red Hat · RHEL 8 enterprise_linux:8::appstream oci-seccomp-bpf-hook 0:1.2.10-1.module+el8.10.0+21962+8143777b
Red Hat · RHEL 8 enterprise_linux:8::appstream oci-seccomp-bpf-hook-debuginfo 0:1.2.10-1.module+el8.10.0+21962+8143777b
Red Hat · RHEL 8 enterprise_linux:8::appstream oci-seccomp-bpf-hook-debugsource 0:1.2.10-1.module+el8.10.0+21962+8143777b
Red Hat · RHEL 8 enterprise_linux:8::appstream podman 4:4.9.4-3.module+el8.10.0+21974+acd2159c
Red Hat · RHEL 8 enterprise_linux:8::appstream podman-catatonit 4:4.9.4-3.module+el8.10.0+21974+acd2159c
Red Hat · RHEL 8 enterprise_linux:8::appstream podman-catatonit-debuginfo 4:4.9.4-3.module+el8.10.0+21974+acd2159c
Red Hat · RHEL 8 enterprise_linux:8::appstream podman-debuginfo 4:4.9.4-3.module+el8.10.0+21974+acd2159c
Red Hat · RHEL 8 enterprise_linux:8::appstream podman-debugsource 4:4.9.4-3.module+el8.10.0+21974+acd2159c
Red Hat · RHEL 8 enterprise_linux:8::appstream podman-docker 4:4.9.4-3.module+el8.10.0+21974+acd2159c
Red Hat · RHEL 8 enterprise_linux:8::appstream podman-gvproxy 4:4.9.4-3.module+el8.10.0+21974+acd2159c
Red Hat · RHEL 8 enterprise_linux:8::appstream podman-gvproxy-debuginfo 4:4.9.4-3.module+el8.10.0+21974+acd2159c
Red Hat · RHEL 8 enterprise_linux:8::appstream podman-plugins 4:4.9.4-3.module+el8.10.0+21974+acd2159c
Red Hat · RHEL 8 enterprise_linux:8::appstream podman-plugins-debuginfo 4:4.9.4-3.module+el8.10.0+21974+acd2159c
Red Hat · RHEL 8 enterprise_linux:8::appstream podman-remote 4:4.9.4-3.module+el8.10.0+21974+acd2159c
Red Hat · RHEL 8 enterprise_linux:8::appstream podman-remote-debuginfo 4:4.9.4-3.module+el8.10.0+21974+acd2159c
Red Hat · RHEL 8 enterprise_linux:8::appstream podman-tests 4:4.9.4-3.module+el8.10.0+21974+acd2159c
Red Hat · RHEL 8 enterprise_linux:8::appstream python-podman 0:4.9.0-1.module+el8.10.0+21962+8143777b
Red Hat · RHEL 8 enterprise_linux:8::appstream python3-criu 0:3.18-5.module+el8.10.0+21962+8143777b
Red Hat · RHEL 8 enterprise_linux:8::appstream python3-podman 0:4.9.0-1.module+el8.10.0+21962+8143777b
Red Hat · RHEL 8 enterprise_linux:8::appstream runc 1:1.1.12-1.module+el8.10.0+21974+acd2159c
Red Hat · RHEL 8 enterprise_linux:8::appstream runc-debuginfo 1:1.1.12-1.module+el8.10.0+21974+acd2159c
Red Hat · RHEL 8 enterprise_linux:8::appstream runc-debugsource 1:1.1.12-1.module+el8.10.0+21974+acd2159c
Red Hat · RHEL 8 enterprise_linux:8::appstream skopeo 2:1.14.3-2.module+el8.10.0+21962+8143777b
Red Hat · RHEL 8 enterprise_linux:8::appstream skopeo-tests 2:1.14.3-2.module+el8.10.0+21962+8143777b
Red Hat · RHEL 8 enterprise_linux:8::appstream slirp4netns 0:1.2.3-1.module+el8.10.0+21962+8143777b
Red Hat · RHEL 8 enterprise_linux:8::appstream slirp4netns-debuginfo 0:1.2.3-1.module+el8.10.0+21962+8143777b
Red Hat · RHEL 8 enterprise_linux:8::appstream slirp4netns-debugsource 0:1.2.3-1.module+el8.10.0+21962+8143777b
Red Hat · RHEL 8 enterprise_linux:8::appstream toolbox 0:0.0.99.5-2.module+el8.10.0+21962+8143777b
Red Hat · RHEL 8 enterprise_linux:8::appstream toolbox-debuginfo 0:0.0.99.5-2.module+el8.10.0+21962+8143777b
Red Hat · RHEL 8 enterprise_linux:8::appstream toolbox-debugsource 0:0.0.99.5-2.module+el8.10.0+21962+8143777b
Red Hat · RHEL 8 enterprise_linux:8::appstream toolbox-tests 0:0.0.99.5-2.module+el8.10.0+21962+8143777b
Red Hat · RHEL 8 enterprise_linux:8::appstream udica 0:0.2.6-21.module+el8.10.0+21962+8143777b

Vulnerabilities 2

  • Medium 4.9
    CVE-2024-28176

    jose vulnerable to resource exhaustion via specifically crafted JWE with compressed plaintext

    jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS), and more. A vulnerability has been identified in t…

    panva jose sqlpad sqlpad-compat Ubuntu Wolfi npm
  • Medium 4.3
    CVE-2024-28180

    Go JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification)

    Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Th…

    go-jose go-jose zot kubescape Debian Azure Linux Alpine Wolfi Go

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2268820
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2268854
  • article
    https://issues.redhat.com/browse/RHEL-39988
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_3968.json
  • report
    https://access.redhat.com/security/cve/CVE-2024-28176
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2024-28176
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2024-28176
  • article
    https://github.com/panva/jose/security/advisories/GHSA-hhhv-q57g-882q
  • report
    https://access.redhat.com/security/cve/CVE-2024-28180
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2024-28180
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2024-28180
  • article
    https://github.com/go-jose/go-jose/security/advisories/GHSA-c5q2-7r4c-mv6g