Fixed packages 65
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · RHEL 8 enterprise_linux:8::appstream | aardvark-dns | 2:1.10.0-1.module+el8.10.0+22283+6d6d094a |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | buildah | 2:1.33.8-4.module+el8.10.0+22283+6d6d094a |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | buildah-debuginfo | 2:1.33.8-4.module+el8.10.0+22283+6d6d094a |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | buildah-debugsource | 2:1.33.8-4.module+el8.10.0+22283+6d6d094a |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | buildah-tests | 2:1.33.8-4.module+el8.10.0+22283+6d6d094a |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | buildah-tests-debuginfo | 2:1.33.8-4.module+el8.10.0+22283+6d6d094a |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | cockpit-podman | 0:84.1-1.module+el8.10.0+22283+6d6d094a |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | conmon | 3:2.1.10-1.module+el8.10.0+22283+6d6d094a |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | conmon-debuginfo | 3:2.1.10-1.module+el8.10.0+22283+6d6d094a |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | conmon-debugsource | 3:2.1.10-1.module+el8.10.0+22283+6d6d094a |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | container-selinux | 2:2.229.0-2.module+el8.10.0+22283+6d6d094a |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | containernetworking-plugins | 1:1.4.0-5.module+el8.10.0+22283+6d6d094a |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | containernetworking-plugins-debuginfo | 1:1.4.0-5.module+el8.10.0+22283+6d6d094a |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | containernetworking-plugins-debugsource | 1:1.4.0-5.module+el8.10.0+22283+6d6d094a |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | containers-common | 2:1-82.module+el8.10.0+22283+6d6d094a |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | crit | 0:3.18-5.module+el8.10.0+22283+6d6d094a |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | criu | 0:3.18-5.module+el8.10.0+22283+6d6d094a |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | criu-debuginfo | 0:3.18-5.module+el8.10.0+22283+6d6d094a |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | criu-debugsource | 0:3.18-5.module+el8.10.0+22283+6d6d094a |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | criu-devel | 0:3.18-5.module+el8.10.0+22283+6d6d094a |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | criu-libs | 0:3.18-5.module+el8.10.0+22283+6d6d094a |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | criu-libs-debuginfo | 0:3.18-5.module+el8.10.0+22283+6d6d094a |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | crun | 0:1.14.3-2.module+el8.10.0+22283+6d6d094a |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | crun-debuginfo | 0:1.14.3-2.module+el8.10.0+22283+6d6d094a |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | crun-debugsource | 0:1.14.3-2.module+el8.10.0+22283+6d6d094a |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | fuse-overlayfs | 0:1.13-1.module+el8.10.0+22283+6d6d094a |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | fuse-overlayfs-debuginfo | 0:1.13-1.module+el8.10.0+22283+6d6d094a |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | fuse-overlayfs-debugsource | 0:1.13-1.module+el8.10.0+22283+6d6d094a |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | libslirp | 0:4.4.0-2.module+el8.10.0+22283+6d6d094a |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | libslirp-debuginfo | 0:4.4.0-2.module+el8.10.0+22283+6d6d094a |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | libslirp-debugsource | 0:4.4.0-2.module+el8.10.0+22283+6d6d094a |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | libslirp-devel | 0:4.4.0-2.module+el8.10.0+22283+6d6d094a |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | netavark | 2:1.10.3-1.module+el8.10.0+22283+6d6d094a |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | oci-seccomp-bpf-hook | 0:1.2.10-1.module+el8.10.0+22283+6d6d094a |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | oci-seccomp-bpf-hook-debuginfo | 0:1.2.10-1.module+el8.10.0+22283+6d6d094a |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | oci-seccomp-bpf-hook-debugsource | 0:1.2.10-1.module+el8.10.0+22283+6d6d094a |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | podman | 4:4.9.4-13.module+el8.10.0+22283+6d6d094a |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | podman-catatonit | 4:4.9.4-13.module+el8.10.0+22283+6d6d094a |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | podman-catatonit-debuginfo | 4:4.9.4-13.module+el8.10.0+22283+6d6d094a |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | podman-debuginfo | 4:4.9.4-13.module+el8.10.0+22283+6d6d094a |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | podman-debugsource | 4:4.9.4-13.module+el8.10.0+22283+6d6d094a |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | podman-docker | 4:4.9.4-13.module+el8.10.0+22283+6d6d094a |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | podman-gvproxy | 4:4.9.4-13.module+el8.10.0+22283+6d6d094a |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | podman-gvproxy-debuginfo | 4:4.9.4-13.module+el8.10.0+22283+6d6d094a |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | podman-plugins | 4:4.9.4-13.module+el8.10.0+22283+6d6d094a |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | podman-plugins-debuginfo | 4:4.9.4-13.module+el8.10.0+22283+6d6d094a |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | podman-remote | 4:4.9.4-13.module+el8.10.0+22283+6d6d094a |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | podman-remote-debuginfo | 4:4.9.4-13.module+el8.10.0+22283+6d6d094a |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | podman-tests | 4:4.9.4-13.module+el8.10.0+22283+6d6d094a |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | python-podman | 0:4.9.0-2.module+el8.10.0+22283+6d6d094a |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | python3-criu | 0:3.18-5.module+el8.10.0+22283+6d6d094a |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | python3-podman | 0:4.9.0-2.module+el8.10.0+22283+6d6d094a |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | runc | 1:1.1.12-4.module+el8.10.0+22283+6d6d094a |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | runc-debuginfo | 1:1.1.12-4.module+el8.10.0+22283+6d6d094a |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | runc-debugsource | 1:1.1.12-4.module+el8.10.0+22283+6d6d094a |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | skopeo | 2:1.14.5-3.module+el8.10.0+22283+6d6d094a |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | skopeo-tests | 2:1.14.5-3.module+el8.10.0+22283+6d6d094a |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | slirp4netns | 0:1.2.3-1.module+el8.10.0+22283+6d6d094a |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | slirp4netns-debuginfo | 0:1.2.3-1.module+el8.10.0+22283+6d6d094a |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | slirp4netns-debugsource | 0:1.2.3-1.module+el8.10.0+22283+6d6d094a |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | toolbox | 0:0.0.99.5-2.module+el8.10.0+22283+6d6d094a |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | toolbox-debuginfo | 0:0.0.99.5-2.module+el8.10.0+22283+6d6d094a |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | toolbox-debugsource | 0:0.0.99.5-2.module+el8.10.0+22283+6d6d094a |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | toolbox-tests | 0:0.0.99.5-2.module+el8.10.0+22283+6d6d094a |
| Red Hat · RHEL 8 enterprise_linux:8::appstream | udica | 0:0.2.6-21.module+el8.10.0+22283+6d6d094a |
Vulnerabilities 5
-
High 7.5
Comments in display names are incorrectly handled in net/mail
The ParseAddressList function incorrectly handles comments (text within parentheses) within display names. Since this is a misalignment with conforming address parsers, it can result in different trust decisions being made by programs using different parsers.
-
High 7.5
Denial of service due to improper 100-continue handling in net/http
The net/http HTTP/1.1 client mishandled the case where a server responds to a request with an "Expect: 100-continue" header with a non-informational (200 or higher) status. This mishandling could leave a client connection in an invalid state, where the next r…
-
Medium 6.5
Memory exhaustion in multipart form parsing in net/textproto and net/http
When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile), limits on the total size of the parsed form were not applied to the memory consumed while readi…
-
Medium 5.9
Verify panics on certificates with an unknown public key algorithm in crypto/x509
Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic. This affects all crypto/tls clients, and servers that set Config.ClientAuth to VerifyClientCertIfGiven or RequireAndVerifyC…
-
Medium 5.9
Malformed DNS message can cause infinite loop in net
A malformed DNS message in response to a query can cause the Lookup functions to get stuck in an infinite loop.
References
-
article
https://access.redhat.com/security/updates/classification/#moderate
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2268017
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2268019
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2268021
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2279814
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2295310
-
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_6969.json
-
report
https://access.redhat.com/security/cve/CVE-2023-45290
-
advisory
https://www.cve.org/CVERecord?id=CVE-2023-45290
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-45290
-
article
http://www.openwall.com/lists/oss-security/2024/03/08/4
-
article
https://go.dev/cl/569341
-
article
https://go.dev/issue/65383
-
article
https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg
-
advisory
https://pkg.go.dev/vuln/GO-2024-2599
-
article
https://security.netapp.com/advisory/ntap-20240329-0004
-
report
https://access.redhat.com/security/cve/CVE-2024-24783
-
advisory
https://www.cve.org/CVERecord?id=CVE-2024-24783
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-24783
-
advisory
https://github.com/advisories/GHSA-3q2c-pvp5-3cqp
-
article
https://go.dev/cl/569339
-
article
https://go.dev/issue/65390
-
advisory
https://pkg.go.dev/vuln/GO-2024-2598
-
article
https://security.netapp.com/advisory/ntap-20240329-0005
-
report
https://access.redhat.com/security/cve/CVE-2024-24784
-
advisory
https://www.cve.org/CVERecord?id=CVE-2024-24784
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-24784
-
report
https://access.redhat.com/security/cve/CVE-2024-24788
-
advisory
https://www.cve.org/CVERecord?id=CVE-2024-24788
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-24788
-
advisory
https://pkg.go.dev/vuln/GO-2024-2824
-
report
https://access.redhat.com/security/cve/CVE-2024-24791
-
advisory
https://www.cve.org/CVERecord?id=CVE-2024-24791
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-24791
-
article
https://go.dev/cl/591255
-
article
https://go.dev/issue/67555
-
article
https://groups.google.com/g/golang-dev/c/t0rK-qHBqzY/m/6MMoAZkMAgAJ