RLSA-2024:2988 — Moderate: container-tools:rhel8 security update

Summary

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

* urllib3: urllib3 does not remove the authorization HTTP header when following a cross-origin redirect (CVE-2018-25091)

* golang: math/big.Rat: may cause a panic or an unrecoverable fatal error if passed inputs with very large exponents (CVE-2021-33198)

* golang: crypto/tls: certificate of wrong type is causing TLS client to panic (CVE-2021-34558)

* golang: archive/tar: unbounded memory consumption when reading headers (CVE-2022-2879)

* golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters (CVE-2022-2880)

* golang: regexp/syntax: limit memory used by parsing regexps (CVE-2022-41715)

* golang: crypto/tls: slow verification of certificate chains containing large RSA keys (CVE-2023-29409)

* golang: html/template: improper handling of HTML-like comments within script contexts (CVE-2023-39318)

* golang: html/template: improper handling of special tags within script contexts (CVE-2023-39319)

* golang: crypto/tls: panic when processing post-handshake message on QUIC connections (CVE-2023-39321)

* golang: crypto/tls: lack of a limit on buffered post-handshake (CVE-2023-39322)

* golang: net/http/internal: Denial of Service (DoS) via Resource Consumption via HTTP requests (CVE-2023-39326)

* golang: crypto/tls: Timing Side Channel attack in RSA based TLS key exchanges. (CVE-2023-45287)

* urllib3: Request body not stripped after redirect from 303 status changes request method to GET (CVE-2023-45803)

* ssh: Prefix truncation attack on Binary Packet Protocol (BPP) (CVE-2023-48795)

* moby/buildkit: Possible race condition with accessing subpaths from cache mounts (CVE-2024-23650)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.10 Release Notes linked from the References section.

Fixed packages 85

Release	Package	Fixed in
Rocky Linux · 8	aardvark-dns	2:1.10.0-1.module+el8.10.0+1815+5fe7415e
Rocky Linux · 8	aardvark-dns	2:1.10.0-1.module+el8.10.0+1825+623b0c20
Rocky Linux · 8	aardvark-dns	2:1.10.0-1.module+el8.10.0+1843+6892ab28
Rocky Linux · 8	aardvark-dns	2:1.10.0-1.module+el8.10.0+1872+2e18eb19
Rocky Linux · 8	cockpit-podman	0:84.1-1.module+el8.10.0+1815+5fe7415e
Rocky Linux · 8	cockpit-podman	0:84.1-1.module+el8.10.0+1825+623b0c20
Rocky Linux · 8	cockpit-podman	0:84.1-1.module+el8.10.0+1843+6892ab28
Rocky Linux · 8	cockpit-podman	0:84.1-1.module+el8.10.0+1872+2e18eb19
Rocky Linux · 8	cockpit-podman	0:84.1-1.module+el8.10.0+1874+ce489889
Rocky Linux · 8	cockpit-podman	0:84.1-1.module+el8.10.0+1880+8e896d1b
Rocky Linux · 8	cockpit-podman	0:84.1-1.module+el8.10.0+1896+b18fa106
Rocky Linux · 8	cockpit-podman	0:84.1-1.module+el8.10.0+1948+4b5cd4a9
Rocky Linux · 8	conmon	3:2.1.10-1.module+el8.10.0+1896+b18fa106
Rocky Linux · 8	conmon	3:2.1.10-1.module+el8.10.0+1815+5fe7415e
Rocky Linux · 8	conmon	3:2.1.10-1.module+el8.10.0+1843+6892ab28
Rocky Linux · 8	conmon	3:2.1.10-1.module+el8.10.0+1872+2e18eb19
Rocky Linux · 8	conmon	3:2.1.10-1.module+el8.10.0+1874+ce489889
Rocky Linux · 8	conmon	3:2.1.10-1.module+el8.10.0+1880+8e896d1b
Rocky Linux · 8	conmon	3:2.1.10-1.module+el8.10.0+1948+4b5cd4a9
Rocky Linux · 8	container-selinux	2:2.229.0-2.module+el8.10.0+1815+5fe7415e
Rocky Linux · 8	container-selinux	2:2.229.0-2.module+el8.10.0+1825+623b0c20
Rocky Linux · 8	container-selinux	2:2.229.0-2.module+el8.10.0+1843+6892ab28
Rocky Linux · 8	container-selinux	2:2.229.0-2.module+el8.10.0+1872+2e18eb19
Rocky Linux · 8	container-selinux	2:2.229.0-2.module+el8.10.0+1874+ce489889
Rocky Linux · 8	container-selinux	2:2.229.0-2.module+el8.10.0+1880+8e896d1b
Rocky Linux · 8	container-selinux	2:2.229.0-2.module+el8.10.0+1896+b18fa106
Rocky Linux · 8	container-selinux	2:2.229.0-2.module+el8.10.0+1948+4b5cd4a9
Rocky Linux · 8	containernetworking-plugins	1:1.4.0-2.module+el8.10.0+1815+5fe7415e
Rocky Linux · 8	containernetworking-plugins	1:1.4.0-2.module+el8.10.0+1825+623b0c20
Rocky Linux · 8	containers-common	2:1-81.module+el8.10.0+1815+5fe7415e
Rocky Linux · 8	containers-common	2:1-81.module+el8.10.0+1825+623b0c20
Rocky Linux · 8	crun	0:1.14.3-2.module+el8.10.0+1815+5fe7415e
Rocky Linux · 8	crun	0:1.14.3-2.module+el8.10.0+1825+623b0c20
Rocky Linux · 8	crun	0:1.14.3-2.module+el8.10.0+1843+6892ab28
Rocky Linux · 8	crun	0:1.14.3-2.module+el8.10.0+1872+2e18eb19
Rocky Linux · 8	crun	0:1.14.3-2.module+el8.10.0+1874+ce489889
Rocky Linux · 8	crun	0:1.14.3-2.module+el8.10.0+1880+8e896d1b
Rocky Linux · 8	crun	0:1.14.3-2.module+el8.10.0+1896+b18fa106
Rocky Linux · 8	crun	0:1.14.3-2.module+el8.10.0+1948+4b5cd4a9
Rocky Linux · 8	fuse-overlayfs	0:1.13-1.module+el8.10.0+1874+ce489889
Rocky Linux · 8	fuse-overlayfs	0:1.13-1.module+el8.10.0+1880+8e896d1b
Rocky Linux · 8	fuse-overlayfs	0:1.13-1.module+el8.10.0+1896+b18fa106
Rocky Linux · 8	fuse-overlayfs	0:1.13-1.module+el8.10.0+1948+4b5cd4a9
Rocky Linux · 8	fuse-overlayfs	0:1.13-1.module+el8.10.0+1815+5fe7415e
Rocky Linux · 8	fuse-overlayfs	0:1.13-1.module+el8.10.0+1825+623b0c20
Rocky Linux · 8	fuse-overlayfs	0:1.13-1.module+el8.10.0+1843+6892ab28
Rocky Linux · 8	fuse-overlayfs	0:1.13-1.module+el8.10.0+1872+2e18eb19
Rocky Linux · 8	libslirp	0:4.4.0-1.module+el8.9.0+1445+07728297
Rocky Linux · 8	netavark	2:1.10.3-1.module+el8.10.0+1815+5fe7415e
Rocky Linux · 8	netavark	2:1.10.3-1.module+el8.10.0+1825+623b0c20
Rocky Linux · 8	netavark	2:1.10.3-1.module+el8.10.0+1843+6892ab28
Rocky Linux · 8	netavark	2:1.10.3-1.module+el8.10.0+1872+2e18eb19
Rocky Linux · 8	netavark	2:1.10.3-1.module+el8.10.0+1874+ce489889
Rocky Linux · 8	netavark	2:1.10.3-1.module+el8.10.0+1880+8e896d1b
Rocky Linux · 8	netavark	2:1.10.3-1.module+el8.10.0+1896+b18fa106
Rocky Linux · 8	netavark	2:1.10.3-1.module+el8.10.0+1948+4b5cd4a9
Rocky Linux · 8	oci-seccomp-bpf-hook	0:1.2.10-1.module+el8.10.0+1815+5fe7415e
Rocky Linux · 8	oci-seccomp-bpf-hook	0:1.2.10-1.module+el8.10.0+1825+623b0c20
Rocky Linux · 8	oci-seccomp-bpf-hook	0:1.2.10-1.module+el8.10.0+1843+6892ab28
Rocky Linux · 8	oci-seccomp-bpf-hook	0:1.2.10-1.module+el8.10.0+1872+2e18eb19
Rocky Linux · 8	oci-seccomp-bpf-hook	0:1.2.10-1.module+el8.10.0+1874+ce489889
Rocky Linux · 8	oci-seccomp-bpf-hook	0:1.2.10-1.module+el8.10.0+1880+8e896d1b
Rocky Linux · 8	oci-seccomp-bpf-hook	0:1.2.10-1.module+el8.10.0+1896+b18fa106
Rocky Linux · 8	oci-seccomp-bpf-hook	0:1.2.10-1.module+el8.10.0+1948+4b5cd4a9
Rocky Linux · 8	python-podman	0:4.9.0-1.module+el8.10.0+1815+5fe7415e
Rocky Linux · 8	python-podman	0:4.9.0-1.module+el8.10.0+1825+623b0c20
Rocky Linux · 8	runc	1:1.1.12-1.module+el8.10.0+1815+5fe7415e
Rocky Linux · 8	runc	1:1.1.12-1.module+el8.10.0+1825+623b0c20
Rocky Linux · 8	slirp4netns	0:1.2.3-1.module+el8.10.0+1815+5fe7415e
Rocky Linux · 8	slirp4netns	0:1.2.3-1.module+el8.10.0+1825+623b0c20
Rocky Linux · 8	slirp4netns	0:1.2.3-1.module+el8.10.0+1843+6892ab28
Rocky Linux · 8	slirp4netns	0:1.2.3-1.module+el8.10.0+1872+2e18eb19
Rocky Linux · 8	slirp4netns	0:1.2.3-1.module+el8.10.0+1874+ce489889
Rocky Linux · 8	slirp4netns	0:1.2.3-1.module+el8.10.0+1880+8e896d1b
Rocky Linux · 8	slirp4netns	0:1.2.3-1.module+el8.10.0+1896+b18fa106
Rocky Linux · 8	slirp4netns	0:1.2.3-1.module+el8.10.0+1948+4b5cd4a9
Rocky Linux · 8	toolbox	0:0.0.99.5-2.module+el8.10.0+1815+5fe7415e.rocky.0.2.rocky.0.2
Rocky Linux · 8	toolbox	0:0.0.99.5-2.module+el8.10.0+1825+623b0c20.rocky.0.2
Rocky Linux · 8	toolbox	0:0.0.99.5-2.module+el8.10.0+1829+9bb2696f.rocky.0.2
Rocky Linux · 8	toolbox	0:0.0.99.5-2.module+el8.10.0+1843+6892ab28.rocky.0.2
Rocky Linux · 8	toolbox	0:0.0.99.5-2.module+el8.10.0+1872+2e18eb19.rocky.0.2
Rocky Linux · 8	toolbox	0:0.0.99.5-2.module+el8.10.0+1874+ce489889.rocky.0.2
Rocky Linux · 8	toolbox	0:0.0.99.5-2.module+el8.10.0+1880+8e896d1b.rocky.0.2
Rocky Linux · 8	toolbox	0:0.0.99.5-2.module+el8.10.0+1896+b18fa106.rocky.0.2
Rocky Linux · 8	toolbox	0:0.0.99.5-2.module+el8.10.0+1948+4b5cd4a9.rocky.0.2

Vulnerabilities 16

Medium 6.1

CVE-2018-25091

Authorization Header forwarded on redirect

urllib3 before 1.24.2 does not remove the authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the authorization header to be exposed to unintended hosts o…

python-pip urllib3 python-urllib3 python-urllib3 Debian Ubuntu PyPI

Oct 15, 2023
Medium 5.9

CVE-2023-48795 Public exploit Scanner template EPSS 94%

Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server…

zot kubescape kots k3d Debian Ubuntu Azure Linux Alpine Wolfi PyPI Go crates.io

Dec 18, 2023
Medium 5.3

CVE-2024-23650

BuildKit possible panic when incorrect parameters sent from frontend

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. A malicious BuildKit client or frontend could craft a request that could lead to BuildKit daemon crashing with a panic. The issue has been f…

moby BuildKit zot kubescape Ubuntu Azure Linux Alpine Wolfi Go

Jan 31, 2024
Medium 4.2

CVE-2023-45803

Request body not stripped after redirect in urllib3

urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn't remove the HTTP request body when an HTTP redirect response using status 301, 302, or 303 after the request had its method changed from one that could accept a request body…

urllib3 urllib3 katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi PyPI

Oct 17, 2023
Unscored —

CVE-2021-33198

Panic on inputs with large exponents in math/big

In Go before 1.15.13 and 1.16.x before 1.16.5, there can be a panic for a large exponent to the math/big.Rat SetString or UnmarshalText method.

go stdlib golang-1.8 golang-1.16 Debian Ubuntu Alpine Go

Aug 2, 2021
Unscored —

CVE-2021-34558 Public exploit

Panic on certain certificates in crypto/tls

The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS server to cause a TLS client to panic.

golang go stdlib golang-1.8 Debian Ubuntu Azure Linux Alpine Go

Jul 15, 2021
Unscored —

CVE-2022-2879

Unbounded memory consumption when reading headers in archive/tar

Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of …

Go standard library archive/tar katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go

Oct 14, 2022
Unscored —

CVE-2022-2880

Incorrect sanitization of forwarded query parameters in net/http/httputil

Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy forwards a parameter with an unparsable value. Afte…

Go standard library net/http/httputil katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go

Oct 14, 2022
Unscored —

CVE-2022-41715

Memory exhaustion when compiling regular expressions in regexp/syntax

Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed regexp representation is linear in the size of the input, but in some cases the constant factor can be as high as 40,000,…

Go standard library regexp/syntax katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go

Oct 14, 2022
Unscored —

CVE-2023-29409 Public exploit

Large RSA keys can cause high CPU usage in crypto/tls

Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the size of RSA keys transmitted during handshakes is restricted to <= 8192 bits. Based on a survey of publicly trusted RSA…

Go standard library crypto/tls katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go

Aug 2, 2023
Unscored —

CVE-2023-39318

Improper handling of HTML-like comments in script contexts in html/template

The html/template package does not properly handle HTML-like "" comment tokens, nor hashbang "#!" comment tokens, in <script> contexts. This may cause the template parser to improperly interpret the contents of <script> contexts, causing actions to be imprope…

Go standard library html/template katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go

Sep 8, 2023
Unscored —

CVE-2023-39319

Improper handling of special tags within script contexts in html/template

The html/template package does not apply the proper rules for handling occurrences of "<script", "<!--", and "</script" within JS literals in <script> contexts. This may cause the template parser to improperly consider script contexts to be terminated early, …

Go standard library html/template katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go

Sep 8, 2023
Unscored —

CVE-2023-39321

Panic when processing post-handshake message on QUIC connections in crypto/tls

Processing an incomplete post-handshake message for a QUIC connection can cause a panic.

Go standard library crypto/tls go stdlib Alpine Wolfi Go

Sep 8, 2023
Unscored —

CVE-2023-39322

Memory exhaustion in QUIC connection handling in crypto/tls

QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now consistently reject messages larger than 65KiB in …

Go standard library crypto/tls go stdlib Alpine Wolfi Go

Sep 8, 2023
Unscored —

CVE-2023-39326

Denial of service via chunk extensions in net/http

A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically rea…

Go standard library net/http/internal katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go

Dec 6, 2023
Unscored —

CVE-2023-45287

Before Go 1.20, the RSA based key exchange methods in crypto/tls may exhibit a timing side channel

Before Go 1.20, the RSA based TLS key exchanges used the math/big library, which is not constant time. RSA blinding was applied to prevent timing attacks, but analysis shows this may not have been fully effective. In particular it appears as if the removal of…

Go standard library crypto/tls katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Wolfi Go

Dec 5, 2023

References

report
https://bugzilla.redhat.com/show_bug.cgi?id=1983596
report
https://bugzilla.redhat.com/show_bug.cgi?id=1989575
report
https://bugzilla.redhat.com/show_bug.cgi?id=2132867
report
https://bugzilla.redhat.com/show_bug.cgi?id=2132868
report
https://bugzilla.redhat.com/show_bug.cgi?id=2132872
report
https://bugzilla.redhat.com/show_bug.cgi?id=2228743
report
https://bugzilla.redhat.com/show_bug.cgi?id=2237773
report
https://bugzilla.redhat.com/show_bug.cgi?id=2237776
report
https://bugzilla.redhat.com/show_bug.cgi?id=2237777
report
https://bugzilla.redhat.com/show_bug.cgi?id=2237778
report
https://bugzilla.redhat.com/show_bug.cgi?id=2244340
report
https://bugzilla.redhat.com/show_bug.cgi?id=2246840
report
https://bugzilla.redhat.com/show_bug.cgi?id=2253193
report
https://bugzilla.redhat.com/show_bug.cgi?id=2253330
report
https://bugzilla.redhat.com/show_bug.cgi?id=2254210
report
https://bugzilla.redhat.com/show_bug.cgi?id=2262272

Moderate: container-tools:rhel8 security update

Summary

Fixed packages 85

Vulnerabilities 16

Authorization Header forwarded on redirect

Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin

BuildKit possible panic when incorrect parameters sent from frontend

Request body not stripped after redirect in urllib3

Panic on inputs with large exponents in math/big

Panic on certain certificates in crypto/tls

Unbounded memory consumption when reading headers in archive/tar

Incorrect sanitization of forwarded query parameters in net/http/httputil

Memory exhaustion when compiling regular expressions in regexp/syntax

Large RSA keys can cause high CPU usage in crypto/tls

Improper handling of HTML-like comments in script contexts in html/template

Improper handling of special tags within script contexts in html/template

Panic when processing post-handshake message on QUIC connections in crypto/tls

Memory exhaustion in QUIC connection handling in crypto/tls

Denial of service via chunk extensions in net/http

Before Go 1.20, the RSA based key exchange methods in crypto/tls may exhibit a timing side channel

References