Summary
This update for podman fixes the following issues:
- Added patch to remove using rw as a default mount option (bsc#1239776)
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| openSUSE · Leap 15.6 | podman | 4.9.5-150500.3.43.2 |
| SUSE · SLE HPC 15 SP5 Linux Enterprise High Performance Computing 15 SP5-ESPOS | podman | 4.9.5-150500.3.43.2 |
| SUSE · SLE HPC 15 SP5 Linux Enterprise High Performance Computing 15 SP5-LTSS | podman | 4.9.5-150500.3.43.2 |
| SUSE · SLE Micro 5.5 Linux Enterprise Micro 5.5 | podman | 4.9.5-150500.3.43.2 |
| SUSE · SLES 15 SP6 Linux Enterprise Module for Containers 15 SP6 | podman | 4.9.5-150500.3.43.2 |
| SUSE · SLES 15 SP7 Linux Enterprise Module for Containers 15 SP7 | podman | 4.9.5-150500.3.43.2 |
| SUSE · SLES 15 SP5 Linux Enterprise Server 15 SP5-LTSS | podman | 4.9.5-150500.3.43.2 |
| SUSE · SLES for SAP 15 SP5 Linux Enterprise Server for SAP Applications 15 SP5 | podman | 4.9.5-150500.3.43.2 |
Vulnerabilities 3
-
High 7.5
Potential denial of service in golang.org/x/crypto
SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.
-
Medium 6.6
Go JOSE's Parsing Vulnerable to Denial of Service
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. In versions on the 4.x branch prior to ve…
-
Medium 6.0
go-retryablehttp can leak basic auth credentials to log files
go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability, CVE-2024-6104, was fixed in go-retryablehttp 0.7.7.