RLSA-2024:6969 — Moderate: container-tools:rhel8 security update

Summary

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

* golang: net/http: memory exhaustion in Request.ParseMultipartForm (CVE-2023-45290)

* golang: crypto/x509: Verify panics on certificates with an unknown public key algorithm (CVE-2024-24783)

* golang: net/mail: comments in display names are incorrectly handled (CVE-2024-24784)

* golang: net: malformed DNS message can cause infinite loop (CVE-2024-24788)

* net/http: Denial of service due to improper 100-continue handling in net/http (CVE-2024-24791)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 129

Release	Package	Fixed in
Rocky Linux · 8	aardvark-dns	2:1.10.0-1.module+el8.10.0+1815+5fe7415e
Rocky Linux · 8	aardvark-dns	2:1.10.0-1.module+el8.10.0+1825+623b0c20
Rocky Linux · 8	aardvark-dns	2:1.10.0-1.module+el8.10.0+1843+6892ab28
Rocky Linux · 8	aardvark-dns	2:1.10.0-1.module+el8.10.0+1872+2e18eb19
Rocky Linux · 8	buildah	2:1.33.8-4.module+el8.10.0+1843+6892ab28
Rocky Linux · 8	buildah	2:1.33.8-4.module+el8.10.0+1872+2e18eb19
Rocky Linux · 8	buildah	2:1.33.8-4.module+el8.10.0+1874+ce489889
Rocky Linux · 8	cockpit-podman	0:84.1-1.module+el8.10.0+1815+5fe7415e
Rocky Linux · 8	cockpit-podman	0:84.1-1.module+el8.10.0+1825+623b0c20
Rocky Linux · 8	cockpit-podman	0:84.1-1.module+el8.10.0+1843+6892ab28
Rocky Linux · 8	cockpit-podman	0:84.1-1.module+el8.10.0+1872+2e18eb19
Rocky Linux · 8	cockpit-podman	0:84.1-1.module+el8.10.0+1874+ce489889
Rocky Linux · 8	cockpit-podman	0:84.1-1.module+el8.10.0+1880+8e896d1b
Rocky Linux · 8	cockpit-podman	0:84.1-1.module+el8.10.0+1896+b18fa106
Rocky Linux · 8	cockpit-podman	0:84.1-1.module+el8.10.0+1948+4b5cd4a9
Rocky Linux · 8	conmon	3:2.1.10-1.module+el8.10.0+1815+5fe7415e
Rocky Linux · 8	conmon	3:2.1.10-1.module+el8.10.0+1843+6892ab28
Rocky Linux · 8	conmon	3:2.1.10-1.module+el8.10.0+1872+2e18eb19
Rocky Linux · 8	conmon	3:2.1.10-1.module+el8.10.0+1874+ce489889
Rocky Linux · 8	conmon	3:2.1.10-1.module+el8.10.0+1880+8e896d1b
Rocky Linux · 8	conmon	3:2.1.10-1.module+el8.10.0+1896+b18fa106
Rocky Linux · 8	conmon	3:2.1.10-1.module+el8.10.0+1948+4b5cd4a9
Rocky Linux · 8	container-selinux	2:2.229.0-2.module+el8.10.0+1815+5fe7415e
Rocky Linux · 8	container-selinux	2:2.229.0-2.module+el8.10.0+1825+623b0c20
Rocky Linux · 8	container-selinux	2:2.229.0-2.module+el8.10.0+1843+6892ab28
Rocky Linux · 8	container-selinux	2:2.229.0-2.module+el8.10.0+1872+2e18eb19
Rocky Linux · 8	container-selinux	2:2.229.0-2.module+el8.10.0+1874+ce489889
Rocky Linux · 8	container-selinux	2:2.229.0-2.module+el8.10.0+1880+8e896d1b
Rocky Linux · 8	container-selinux	2:2.229.0-2.module+el8.10.0+1896+b18fa106
Rocky Linux · 8	container-selinux	2:2.229.0-2.module+el8.10.0+1948+4b5cd4a9
Rocky Linux · 8	containernetworking-plugins	1:1.4.0-5.module+el8.10.0+1872+2e18eb19
Rocky Linux · 8	containernetworking-plugins	1:1.4.0-5.module+el8.10.0+1874+ce489889
Rocky Linux · 8	containernetworking-plugins	1:1.4.0-5.module+el8.10.0+1880+8e896d1b
Rocky Linux · 8	containernetworking-plugins	1:1.4.0-5.module+el8.10.0+1896+b18fa106
Rocky Linux · 8	containernetworking-plugins	1:1.4.0-5.module+el8.10.0+1948+4b5cd4a9
Rocky Linux · 8	containernetworking-plugins	1:1.4.0-5.module+el8.10.0+1843+6892ab28
Rocky Linux · 8	containers-common	2:1-82.module+el8.10.0+1843+6892ab28
Rocky Linux · 8	containers-common	2:1-82.module+el8.10.0+1872+2e18eb19
Rocky Linux · 8	containers-common	2:1-82.module+el8.10.0+1874+ce489889
Rocky Linux · 8	containers-common	2:1-82.module+el8.10.0+1880+8e896d1b
Rocky Linux · 8	containers-common	2:1-82.module+el8.10.0+1896+b18fa106
Rocky Linux · 8	containers-common	2:1-82.module+el8.10.0+1948+4b5cd4a9
Rocky Linux · 8	criu	0:3.18-5.module+el8.10.0+1815+5fe7415e
Rocky Linux · 8	criu	0:3.18-5.module+el8.10.0+1825+623b0c20
Rocky Linux · 8	criu	0:3.18-5.module+el8.10.0+1843+6892ab28
Rocky Linux · 8	criu	0:3.18-5.module+el8.10.0+1872+2e18eb19
Rocky Linux · 8	criu	0:3.18-5.module+el8.10.0+1874+ce489889
Rocky Linux · 8	criu	0:3.18-5.module+el8.10.0+1880+8e896d1b
Rocky Linux · 8	criu	0:3.18-5.module+el8.10.0+1896+b18fa106
Rocky Linux · 8	criu	0:3.18-5.module+el8.10.0+1948+4b5cd4a9
Rocky Linux · 8	crun	0:1.14.3-2.module+el8.10.0+1815+5fe7415e
Rocky Linux · 8	crun	0:1.14.3-2.module+el8.10.0+1825+623b0c20
Rocky Linux · 8	crun	0:1.14.3-2.module+el8.10.0+1843+6892ab28
Rocky Linux · 8	crun	0:1.14.3-2.module+el8.10.0+1872+2e18eb19
Rocky Linux · 8	crun	0:1.14.3-2.module+el8.10.0+1874+ce489889
Rocky Linux · 8	crun	0:1.14.3-2.module+el8.10.0+1880+8e896d1b
Rocky Linux · 8	crun	0:1.14.3-2.module+el8.10.0+1896+b18fa106
Rocky Linux · 8	crun	0:1.14.3-2.module+el8.10.0+1948+4b5cd4a9
Rocky Linux · 8	fuse-overlayfs	0:1.13-1.module+el8.10.0+1815+5fe7415e
Rocky Linux · 8	fuse-overlayfs	0:1.13-1.module+el8.10.0+1825+623b0c20
Rocky Linux · 8	fuse-overlayfs	0:1.13-1.module+el8.10.0+1843+6892ab28
Rocky Linux · 8	fuse-overlayfs	0:1.13-1.module+el8.10.0+1872+2e18eb19
Rocky Linux · 8	fuse-overlayfs	0:1.13-1.module+el8.10.0+1874+ce489889
Rocky Linux · 8	fuse-overlayfs	0:1.13-1.module+el8.10.0+1880+8e896d1b
Rocky Linux · 8	fuse-overlayfs	0:1.13-1.module+el8.10.0+1896+b18fa106
Rocky Linux · 8	fuse-overlayfs	0:1.13-1.module+el8.10.0+1948+4b5cd4a9
Rocky Linux · 8	libslirp	0:4.4.0-2.module+el8.10.0+1815+5fe7415e
Rocky Linux · 8	libslirp	0:4.4.0-2.module+el8.10.0+1825+623b0c20
Rocky Linux · 8	libslirp	0:4.4.0-2.module+el8.10.0+1843+6892ab28
Rocky Linux · 8	libslirp	0:4.4.0-2.module+el8.10.0+1872+2e18eb19
Rocky Linux · 8	libslirp	0:4.4.0-2.module+el8.10.0+1874+ce489889
Rocky Linux · 8	libslirp	0:4.4.0-2.module+el8.10.0+1880+8e896d1b
Rocky Linux · 8	libslirp	0:4.4.0-2.module+el8.10.0+1896+b18fa106
Rocky Linux · 8	libslirp	0:4.4.0-2.module+el8.10.0+1948+4b5cd4a9
Rocky Linux · 8	netavark	2:1.10.3-1.module+el8.10.0+1815+5fe7415e
Rocky Linux · 8	netavark	2:1.10.3-1.module+el8.10.0+1825+623b0c20
Rocky Linux · 8	netavark	2:1.10.3-1.module+el8.10.0+1843+6892ab28
Rocky Linux · 8	netavark	2:1.10.3-1.module+el8.10.0+1872+2e18eb19
Rocky Linux · 8	netavark	2:1.10.3-1.module+el8.10.0+1874+ce489889
Rocky Linux · 8	netavark	2:1.10.3-1.module+el8.10.0+1880+8e896d1b
Rocky Linux · 8	netavark	2:1.10.3-1.module+el8.10.0+1896+b18fa106
Rocky Linux · 8	netavark	2:1.10.3-1.module+el8.10.0+1948+4b5cd4a9
Rocky Linux · 8	oci-seccomp-bpf-hook	0:1.2.10-1.module+el8.10.0+1815+5fe7415e
Rocky Linux · 8	oci-seccomp-bpf-hook	0:1.2.10-1.module+el8.10.0+1825+623b0c20
Rocky Linux · 8	oci-seccomp-bpf-hook	0:1.2.10-1.module+el8.10.0+1843+6892ab28
Rocky Linux · 8	oci-seccomp-bpf-hook	0:1.2.10-1.module+el8.10.0+1872+2e18eb19
Rocky Linux · 8	oci-seccomp-bpf-hook	0:1.2.10-1.module+el8.10.0+1874+ce489889
Rocky Linux · 8	oci-seccomp-bpf-hook	0:1.2.10-1.module+el8.10.0+1880+8e896d1b
Rocky Linux · 8	oci-seccomp-bpf-hook	0:1.2.10-1.module+el8.10.0+1896+b18fa106
Rocky Linux · 8	oci-seccomp-bpf-hook	0:1.2.10-1.module+el8.10.0+1948+4b5cd4a9
Rocky Linux · 8	podman	4:4.9.4-13.module+el8.10.0+1871+e6fa1069
Rocky Linux · 8	podman	4:4.9.4-13.module+el8.10.0+1874+ce489889
Rocky Linux · 8	python-podman	0:4.9.0-2.module+el8.10.0+1843+6892ab28
Rocky Linux · 8	python-podman	0:4.9.0-2.module+el8.10.0+1872+2e18eb19
Rocky Linux · 8	python-podman	0:4.9.0-2.module+el8.10.0+1874+ce489889
Rocky Linux · 8	python-podman	0:4.9.0-2.module+el8.10.0+1880+8e896d1b
Rocky Linux · 8	runc	1:1.1.12-4.module+el8.10.0+1843+6892ab28
Rocky Linux · 8	runc	1:1.1.12-4.module+el8.10.0+1872+2e18eb19
Rocky Linux · 8	skopeo	2:1.14.5-3.module+el8.10.0+1872+2e18eb19
Rocky Linux · 8	skopeo	2:1.14.5-3.module+el8.10.0+1874+ce489889
Rocky Linux · 8	skopeo	2:1.14.5-3.module+el8.10.0+1880+8e896d1b
Rocky Linux · 8	skopeo	2:1.14.5-3.module+el8.10.0+1896+b18fa106
Rocky Linux · 8	skopeo	2:1.14.5-3.module+el8.10.0+1948+4b5cd4a9
Rocky Linux · 8	skopeo	2:1.14.5-3.module+el8.10.0+1843+6892ab28
Rocky Linux · 8	slirp4netns	0:1.2.3-1.module+el8.10.0+1815+5fe7415e
Rocky Linux · 8	slirp4netns	0:1.2.3-1.module+el8.10.0+1825+623b0c20
Rocky Linux · 8	slirp4netns	0:1.2.3-1.module+el8.10.0+1843+6892ab28
Rocky Linux · 8	slirp4netns	0:1.2.3-1.module+el8.10.0+1872+2e18eb19
Rocky Linux · 8	slirp4netns	0:1.2.3-1.module+el8.10.0+1874+ce489889
Rocky Linux · 8	slirp4netns	0:1.2.3-1.module+el8.10.0+1880+8e896d1b
Rocky Linux · 8	slirp4netns	0:1.2.3-1.module+el8.10.0+1896+b18fa106
Rocky Linux · 8	slirp4netns	0:1.2.3-1.module+el8.10.0+1948+4b5cd4a9
Rocky Linux · 8	toolbox	0:0.0.99.5-2.module+el8.10.0+1815+5fe7415e.rocky.0.2.rocky.0.2
Rocky Linux · 8	toolbox	0:0.0.99.5-2.module+el8.10.0+1825+623b0c20.rocky.0.2
Rocky Linux · 8	toolbox	0:0.0.99.5-2.module+el8.10.0+1829+9bb2696f.rocky.0.2
Rocky Linux · 8	toolbox	0:0.0.99.5-2.module+el8.10.0+1843+6892ab28.rocky.0.2
Rocky Linux · 8	toolbox	0:0.0.99.5-2.module+el8.10.0+1872+2e18eb19.rocky.0.2
Rocky Linux · 8	toolbox	0:0.0.99.5-2.module+el8.10.0+1874+ce489889.rocky.0.2
Rocky Linux · 8	toolbox	0:0.0.99.5-2.module+el8.10.0+1880+8e896d1b.rocky.0.2
Rocky Linux · 8	toolbox	0:0.0.99.5-2.module+el8.10.0+1896+b18fa106.rocky.0.2
Rocky Linux · 8	toolbox	0:0.0.99.5-2.module+el8.10.0+1948+4b5cd4a9.rocky.0.2
Rocky Linux · 8	udica	0:0.2.6-21.module+el8.10.0+1872+2e18eb19
Rocky Linux · 8	udica	0:0.2.6-21.module+el8.10.0+1815+5fe7415e
Rocky Linux · 8	udica	0:0.2.6-21.module+el8.10.0+1825+623b0c20
Rocky Linux · 8	udica	0:0.2.6-21.module+el8.10.0+1843+6892ab28
Rocky Linux · 8	udica	0:0.2.6-21.module+el8.10.0+1874+ce489889
Rocky Linux · 8	udica	0:0.2.6-21.module+el8.10.0+1880+8e896d1b
Rocky Linux · 8	udica	0:0.2.6-21.module+el8.10.0+1896+b18fa106
Rocky Linux · 8	udica	0:0.2.6-21.module+el8.10.0+1948+4b5cd4a9

Vulnerabilities 5

High 7.5

CVE-2024-24784

Comments in display names are incorrectly handled in net/mail

The ParseAddressList function incorrectly handles comments (text within parentheses) within display names. Since this is a misalignment with conforming address parsers, it can result in different trust decisions being made by programs using different parsers.

Go standard library net/mail golang go Debian Ubuntu Azure Linux Alpine Wolfi Go

Mar 5, 2024
High 7.5

CVE-2024-24791

Denial of service due to improper 100-continue handling in net/http

The net/http HTTP/1.1 client mishandled the case where a server responds to a request with an "Expect: 100-continue" header with a non-informational (200 or higher) status. This mishandling could leave a client connection in an invalid state, where the next r…

Go standard library net/http katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go

Jul 2, 2024
Medium 6.5

CVE-2023-45290

Memory exhaustion in multipart form parsing in net/textproto and net/http

When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile), limits on the total size of the parsed form were not applied to the memory consumed while readi…

Go standard library net/textproto golang go Debian Ubuntu Azure Linux Alpine Wolfi Go

Mar 5, 2024
Medium 5.9

CVE-2024-24783

Verify panics on certificates with an unknown public key algorithm in crypto/x509

Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic. This affects all crypto/tls clients, and servers that set Config.ClientAuth to VerifyClientCertIfGiven or RequireAndVerifyC…

Go standard library crypto/x509 golang go Debian Ubuntu Azure Linux Alpine Wolfi Go

Mar 5, 2024
Medium 5.9

CVE-2024-24788

Malformed DNS message can cause infinite loop in net

A malformed DNS message in response to a query can cause the Lookup functions to get stuck in an infinite loop.

Go standard library net golang go Ubuntu Azure Linux Alpine Wolfi Go

May 8, 2024

References

report
https://bugzilla.redhat.com/show_bug.cgi?id=2268017
report
https://bugzilla.redhat.com/show_bug.cgi?id=2268019
report
https://bugzilla.redhat.com/show_bug.cgi?id=2268021
report
https://bugzilla.redhat.com/show_bug.cgi?id=2279814
report
https://bugzilla.redhat.com/show_bug.cgi?id=2295310

Moderate: container-tools:rhel8 security update

Summary

Fixed packages 129

Vulnerabilities 5

Comments in display names are incorrectly handled in net/mail

Denial of service due to improper 100-continue handling in net/http

Memory exhaustion in multipart form parsing in net/textproto and net/http

Verify panics on certificates with an unknown public key algorithm in crypto/x509

Malformed DNS message can cause infinite loop in net

References