Summary
The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.
Security Fix(es):
* golang: archive/tar: unbounded memory consumption when reading headers (CVE-2022-2879)
* golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters (CVE-2022-2880)
* golang: net/http: handle server errors after sending GOAWAY (CVE-2022-27664)
* golang: regexp/syntax: limit memory used by parsing regexps (CVE-2022-41715)
* golang: crypto/tls: slow verification of certificate chains containing large RSA keys (CVE-2023-29409)
* golang: html/template: improper handling of HTML-like comments within script contexts (CVE-2023-39318)
* golang: html/template: improper handling of special tags within script contexts (CVE-2023-39319)
* golang: crypto/tls: panic when processing post-handshake message on QUIC connections (CVE-2023-39321)
* golang: crypto/tls: lack of a limit on buffered post-handshake (CVE-2023-39322)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 14
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 8 | buildah | 1:1.24.6-7.module+el8.9.0+1445+07728297 |
| Rocky Linux · 8 | cockpit-podman | 0:46-1.module+el8.9.0+1445+07728297 |
| Rocky Linux · 8 | conmon | 2:2.1.4-2.module+el8.9.0+1445+07728297 |
| Rocky Linux · 8 | container-selinux | 2:2.205.0-3.module+el8.9.0+1445+07728297 |
| Rocky Linux · 8 | containers-common | 2:1-38.module+el8.9.0+1445+07728297 |
| Rocky Linux · 8 | criu | 0:3.15-3.module+el8.9.0+1445+07728297 |
| Rocky Linux · 8 | fuse-overlayfs | 0:1.9-2.module+el8.9.0+1445+07728297 |
| Rocky Linux · 8 | libslirp | 0:4.4.0-1.module+el8.9.0+1445+07728297 |
| Rocky Linux · 8 | oci-seccomp-bpf-hook | 0:1.2.5-2.module+el8.9.0+1445+07728297 |
| Rocky Linux · 8 | python-podman | 0:4.0.0-2.module+el8.9.0+1445+07728297 |
| Rocky Linux · 8 | runc | 1:1.1.5-2.module+el8.9.0+1445+07728297 |
| Rocky Linux · 8 | skopeo | 2:1.6.2-9.module+el8.9.0+1578+aa900b44 |
| Rocky Linux · 8 | slirp4netns | 0:1.1.8-3.module+el8.9.0+1445+07728297 |
| Rocky Linux · 8 | udica | 0:0.2.6-4.module+el8.9.0+1445+07728297 |
Vulnerabilities 9
-
High 7.5
golang.org/x/net/http2 Denial of Service vulnerability
In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error.
-
Unscored —
Unbounded memory consumption when reading headers in archive/tar
Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of …
-
Unscored —
Incorrect sanitization of forwarded query parameters in net/http/httputil
Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy forwards a parameter with an unparsable value. Afte…
-
Unscored —
Memory exhaustion when compiling regular expressions in regexp/syntax
Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed regexp representation is linear in the size of the input, but in some cases the constant factor can be as high as 40,000,…
-
Unscored —CVE-2023-29409 Public exploit
Large RSA keys can cause high CPU usage in crypto/tls
Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the size of RSA keys transmitted during handshakes is restricted to <= 8192 bits. Based on a survey of publicly trusted RSA…
-
Unscored —
Improper handling of HTML-like comments in script contexts in html/template
The html/template package does not properly handle HTML-like "" comment tokens, nor hashbang "#!" comment tokens, in <script> contexts. This may cause the template parser to improperly interpret the contents of <script> contexts, causing actions to be imprope…
-
Unscored —
Improper handling of special tags within script contexts in html/template
The html/template package does not apply the proper rules for handling occurrences of "<script", "<!--", and "</script" within JS literals in <script> contexts. This may cause the template parser to improperly consider script contexts to be terminated early, …
-
Unscored —
Panic when processing post-handshake message on QUIC connections in crypto/tls
Processing an incomplete post-handshake message for a QUIC connection can cause a panic.
-
Unscored —
Memory exhaustion in QUIC connection handling in crypto/tls
QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now consistently reject messages larger than 65KiB in …
References
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2124669
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2132867
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2132868
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2132872
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2228743
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2237773
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2237776
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2237777
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2237778