Summary
The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.
Security Fix(es):
* runc: file descriptor leak ("Leaky Vessels") (CVE-2024-21626)
A Rocky Enterprise Software Foundation Security Bulletin which addresses further details about the Leaky Vessels flaw is available in the References section.
* golang: net/http/internal: Denial of Service (DoS) via Resource Consumption via HTTP requests (CVE-2023-39326)
* golang: crypto/tls: Timing Side Channel attack in RSA based TLS key exchanges. (CVE-2023-45287)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 15
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 8 | buildah | 1:1.24.6-7.module+el8.9.0+1445+07728297 |
| Rocky Linux · 8 | cockpit-podman | 0:46-1.module+el8.9.0+1445+07728297 |
| Rocky Linux · 8 | conmon | 2:2.1.4-2.module+el8.9.0+1445+07728297 |
| Rocky Linux · 8 | container-selinux | 2:2.205.0-3.module+el8.9.0+1445+07728297 |
| Rocky Linux · 8 | containers-common | 2:1-38.module+el8.9.0+1445+07728297 |
| Rocky Linux · 8 | criu | 0:3.15-3.module+el8.9.0+1445+07728297 |
| Rocky Linux · 8 | fuse-overlayfs | 0:1.9-2.module+el8.9.0+1445+07728297 |
| Rocky Linux · 8 | libslirp | 0:4.4.0-1.module+el8.9.0+1445+07728297 |
| Rocky Linux · 8 | oci-seccomp-bpf-hook | 0:1.2.5-2.module+el8.9.0+1445+07728297 |
| Rocky Linux · 8 | python-podman | 0:4.0.0-2.module+el8.9.0+1445+07728297 |
| Rocky Linux · 8 | runc | 1:1.1.12-1.module+el8.10.0+1815+5fe7415e |
| Rocky Linux · 8 | runc | 1:1.1.12-1.module+el8.10.0+1825+623b0c20 |
| Rocky Linux · 8 | skopeo | 2:1.6.2-9.module+el8.9.0+1578+aa900b44 |
| Rocky Linux · 8 | slirp4netns | 0:1.1.8-3.module+el8.9.0+1445+07728297 |
| Rocky Linux · 8 | udica | 0:0.2.6-4.module+el8.9.0+1445+07728297 |
Vulnerabilities 3
-
High 8.6
runc container breakout through process.cwd trickery and leaked fds
runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc 1.1.11 and earlier, due to an internal file descriptor leak, an attacker could cause a newly-spawned container process (from runc exec) to have a worki…
-
Unscored —
Denial of service via chunk extensions in net/http
A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically rea…
-
Unscored —
Before Go 1.20, the RSA based key exchange methods in crypto/tls may exhibit a timing side channel
Before Go 1.20, the RSA based TLS key exchanges used the math/big library, which is not constant time. RSA blinding was applied to prevent timing attacks, but analysis shows this may not have been fully effective. In particular it appears as if the removal of…