Red Hat Security Advisory: toolbox security update

Fixed packages 4

Vulnerabilities 4

• High 7.5
  CVE-2024-24791

  Denial of service due to improper 100-continue handling in net/http

  The net/http HTTP/1.1 client mishandled the case where a server responds to a request with an "Expect: 100-continue" header with a non-informational (200 or higher) status. This mishandling could leave a client connection in an invalid state, where the next r…

  Go standard library net/http katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Jul 2, 2024
• Medium 6.5
  CVE-2023-45290

  Memory exhaustion in multipart form parsing in net/textproto and net/http

  When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile), limits on the total size of the parsed form were not applied to the memory consumed while readi…

  Go standard library net/textproto golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  Mar 5, 2024
• Medium 5.9
  CVE-2024-24788

  Malformed DNS message can cause infinite loop in net

  A malformed DNS message in response to a query can cause the Lookup functions to get stuck in an infinite loop.

  Go standard library net golang go Ubuntu Azure Linux Alpine Wolfi Go
  May 8, 2024
• Medium 5.4
  CVE-2024-24785

  Errors returned from JSON marshaling may break template escaping in html/template

  If errors returned from MarshalJSON methods contain user controlled data, they may be used to break the contextual auto-escaping behavior of the html/template package, allowing for subsequent actions to inject unexpected content into templates.

  Go standard library html/template golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  Mar 5, 2024

References

• article
  https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/9.5_release_notes/index
• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2268017
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2268022
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2279814
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2295310
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_9135.json
• report
  https://access.redhat.com/security/cve/CVE-2023-45290
• advisory
  https://www.cve.org/CVERecord?id=CVE-2023-45290
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2023-45290
• article
  http://www.openwall.com/lists/oss-security/2024/03/08/4
• article
  https://go.dev/cl/569341
• article
  https://go.dev/issue/65383
• article
  https://groups.google.com/g/golang-announce/c/5pwGVUPoMbg
• advisory
  https://pkg.go.dev/vuln/GO-2024-2599
• article
  https://security.netapp.com/advisory/ntap-20240329-0004
• report
  https://access.redhat.com/security/cve/CVE-2024-24785
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-24785
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-24785
• article
  https://go.dev/cl/564196
• article
  https://go.dev/issue/65697
• article
  https://vuln.go.dev/ID/GO-2024-2610.json
• report
  https://access.redhat.com/security/cve/CVE-2024-24788
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-24788
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-24788
• advisory
  https://pkg.go.dev/vuln/GO-2024-2824
• report
  https://access.redhat.com/security/cve/CVE-2024-24791
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-24791
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-24791
• article
  https://go.dev/cl/591255
• article
  https://go.dev/issue/67555
• article
  https://groups.google.com/g/golang-dev/c/t0rK-qHBqzY/m/6MMoAZkMAgAJ