Summary
The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.
Security Fix(es):
* podman: jose-go: improper handling of highly compressed data (CVE-2024-28180)
* buildah: jose-go: improper handling of highly compressed data (CVE-2024-28180)
* podman: jose-go: resource exhaustion (CVE-2024-28176)
* buildah: jose-go: resource exhaustion (CVE-2024-28176)
* skopeo: jose-go: resource exhaustion (CVE-2024-28176)
Additional Changes:
For detailed information on changes in this release, see the Rocky Linux 8 Release Notes linked from the References section.
Fixed packages 20
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 8 | aardvark-dns | 2:1.10.0-1.module+el8.10.0+1815+5fe7415e |
| Rocky Linux · 8 | buildah | 2:1.33.7-2.module+el8.10.0+1829+9bb2696f |
| Rocky Linux · 8 | cockpit-podman | 0:84.1-1.module+el8.10.0+1815+5fe7415e |
| Rocky Linux · 8 | conmon | 3:2.1.10-1.module+el8.10.0+1815+5fe7415e |
| Rocky Linux · 8 | container-selinux | 2:2.229.0-2.module+el8.10.0+1815+5fe7415e |
| Rocky Linux · 8 | containernetworking-plugins | 1:1.4.0-2.module+el8.10.0+1815+5fe7415e |
| Rocky Linux · 8 | containers-common | 2:1-81.module+el8.10.0+1815+5fe7415e |
| Rocky Linux · 8 | criu | 0:3.18-5.module+el8.10.0+1815+5fe7415e |
| Rocky Linux · 8 | crun | 0:1.14.3-2.module+el8.10.0+1815+5fe7415e |
| Rocky Linux · 8 | fuse-overlayfs | 0:1.13-1.module+el8.10.0+1815+5fe7415e |
| Rocky Linux · 8 | libslirp | 0:4.4.0-2.module+el8.10.0+1815+5fe7415e |
| Rocky Linux · 8 | netavark | 2:1.10.3-1.module+el8.10.0+1815+5fe7415e |
| Rocky Linux · 8 | oci-seccomp-bpf-hook | 0:1.2.10-1.module+el8.10.0+1815+5fe7415e |
| Rocky Linux · 8 | podman | 4:4.9.4-3.module+el8.10.0+1829+9bb2696f |
| Rocky Linux · 8 | python-podman | 0:4.9.0-1.module+el8.10.0+1815+5fe7415e |
| Rocky Linux · 8 | runc | 1:1.1.12-1.module+el8.10.0+1815+5fe7415e |
| Rocky Linux · 8 | skopeo | 2:1.14.3-2.module+el8.10.0+1815+5fe7415e |
| Rocky Linux · 8 | slirp4netns | 0:1.2.3-1.module+el8.10.0+1815+5fe7415e |
| Rocky Linux · 8 | toolbox | 0:0.0.99.5-2.module+el8.10.0+1815+5fe7415e.rocky.0.2.rocky.0.2 |
| Rocky Linux · 8 | udica | 0:0.2.6-21.module+el8.10.0+1815+5fe7415e |
Vulnerabilities 2
-
Medium 4.9
jose vulnerable to resource exhaustion via specifically crafted JWE with compressed plaintext
jose is JavaScript module for JSON Object Signing and Encryption, providing support for JSON Web Tokens (JWT), JSON Web Signature (JWS), JSON Web Encryption (JWE), JSON Web Key (JWK), JSON Web Key Set (JWKS), and more. A vulnerability has been identified in t…
-
Medium 4.3
Go JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification)
Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Th…