Summary
The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images.
Security Fix(es):
* golang: net/http: memory exhaustion in Request.ParseMultipartForm (CVE-2023-45290)
* jose-go: improper handling of highly compressed data (CVE-2024-28180)
* buildah: jose: resource exhaustion (CVE-2024-28176)
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 9 | buildah | 2:1.33.7-2.el9_4 |
Vulnerabilities 3
-
Medium 6.5
Memory exhaustion in multipart form parsing in net/textproto and net/http
When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile), limits on the total size of the parsed form were not applied to the memory consumed while readi…
-
Medium 4.9
jose vulnerable to resource exhaustion via specifically crafted JWE with compressed plaintext
jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS), and more. A vulnerability has been identified in t…
-
Medium 4.3
Go JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification)
Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Th…