Red Hat Security Advisory: podman security update

Fixed packages 9

Vulnerabilities 4

• High 8.3
  CVE-2024-3727

  Containers/image: digest type does not guarantee valid type

  A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks.

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine Wolfi Go
  May 9, 2024
• High 7.5
  CVE-2024-24791

  Denial of service due to improper 100-continue handling in net/http

  The net/http HTTP/1.1 client mishandled the case where a server responds to a request with an "Expect: 100-continue" header with a non-informational (200 or higher) status. This mishandling could leave a client connection in an invalid state, where the next r…

  Go standard library net/http katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Jul 2, 2024
• Medium 5.3
  CVE-2022-4122

  Buildah (as part of Podman) vulnerable to Link Following

  A vulnerability was found in buildah. Incorrect following of symlinks while reading .containerignore and .dockerignore results in information disclosure.

  podman github.com/containers/podman/v4 github.com/containers/podman/v3 github.com/containers/podman/v2 Debian Ubuntu Azure Linux Go
  Dec 8, 2022
• Medium 5.3
  CVE-2024-24789

  Mishandling of corrupt central directory record in archive/zip

  The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations. This misalignment could be exploited to create an zip file with contents that vary depending on the implementation reading the file…

  Go standard library archive/zip golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  Jun 5, 2024

References

• article
  https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/9.5_release_notes/index
• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2144983
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2274767
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2292668
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2295310
• article
  https://issues.redhat.com/browse/RHEL-17776
• article
  https://issues.redhat.com/browse/RHEL-18987
• article
  https://issues.redhat.com/browse/RHEL-24333
• article
  https://issues.redhat.com/browse/RHEL-27171
• article
  https://issues.redhat.com/browse/RHEL-28803
• article
  https://issues.redhat.com/browse/RHEL-29763
• article
  https://issues.redhat.com/browse/RHEL-3092
• article
  https://issues.redhat.com/browse/RHEL-32599
• article
  https://issues.redhat.com/browse/RHEL-40811
• article
  https://issues.redhat.com/browse/RHEL-45979
• article
  https://issues.redhat.com/browse/RHEL-48760
• article
  https://issues.redhat.com/browse/RHEL-48917
• article
  https://issues.redhat.com/browse/RHEL-54361
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_9102.json
• report
  https://access.redhat.com/security/cve/CVE-2022-4122
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-4122
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-4122
• article
  https://github.com/containers/podman/pull/16315
• report
  https://access.redhat.com/security/cve/CVE-2024-3727
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-3727
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-3727
• report
  https://access.redhat.com/security/cve/CVE-2024-24789
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-24789
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-24789
• report
  https://access.redhat.com/security/cve/CVE-2024-24791
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-24791
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-24791
• article
  https://go.dev/cl/591255
• article
  https://go.dev/issue/67555
• article
  https://groups.google.com/g/golang-dev/c/t0rK-qHBqzY/m/6MMoAZkMAgAJ