Description
A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of data (up to about 1GiB) when a handler fails to read the entire body of a request. Chunk extensions are a little-used HTTP feature which permit including additional metadata in a request or response body sent using the chunked encoding. The net/http chunked encoding reader discards this metadata. A sender can exploit this by inserting a large metadata segment with each byte transferred. The chunk reader now produces an error if the ratio of real body to encoded bytes grows too small.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Go standard library | net/http/internal | < 1.20.12, 1.21.0-0 – < 1.21.5 | 1.20.12 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 12 | golang-1.19 | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | golang-1.20 | 1.20.3-1ubuntu0.1~22.04.1 | USN-6574-1 |
| Ubuntu 22.04 LTS | golang-1.21 | 1.21.1-1~ubuntu22.04.2 | USN-6574-1 |
| Ubuntu 20.04 LTS | golang-1.20 | 1.20.3-1ubuntu0.1~20.04.1 | USN-6574-1 |
| Ubuntu 20.04 LTS | golang-1.21 | 1.21.1-1~ubuntu20.04.2 | USN-6574-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | buildah +1 | 2:1.33.6-2.el9 | RHSA-2024:2245 |
| RHEL 9 | containernetworking-plugins | 1:1.4.0-2.el9_4 | RHSA-2024:2272 |
| RHEL 9 | golang +6 | 1.20.12-1.el9_3 | RHSA-2024:1131 |
| RHEL 9 | podman +4 | 2:4.9.4-0.1.el9 | RHSA-2024:2193 |
| RHEL 9 | skopeo +1 | 2:1.13.3-4.el9_3 | RHSA-2024:1149 |
| RHEL 9 | toolbox +1 | 0.0.99.5-2.el9 | RHSA-2024:2160 |
| RHEL 8 | buildah +1 | 1:1.24.6-7.module+el8.9.0+21242+944321bb | RHSA-2024:2988, RHSA-2024:0748 |
| RHEL 8 | cockpit-podman | 46-1.module+el8.9.0+21242+944321bb | RHSA-2024:2988, RHSA-2024:0748 |
| RHEL 8 | conmon | 2:2.1.4-2.module+el8.9.0+21242+944321bb | RHSA-2024:2988, RHSA-2024:0748 |
| RHEL 8 | container-selinux | 2:2.205.0-3.module+el8.9.0+21242+944321bb | RHSA-2024:2988, RHSA-2024:0748 |
| RHEL 8 | containernetworking-plugins | 1:1.1.1-6.module+el8.9.0+21242+944321bb | RHSA-2024:2988, RHSA-2024:0748 |
| RHEL 8 | containers-common | 2:1-38.module+el8.9.0+21242+944321bb | RHSA-2024:2988, RHSA-2024:0748 |
| RHEL 8 | crit +4 | 3.15-3.module+el8.9.0+21242+944321bb | RHSA-2024:2988, RHSA-2024:0748 |
| RHEL 8 | crun | 1.8.7-1.module+el8.9.0+21242+944321bb | RHSA-2024:2988, RHSA-2024:0748 |
| RHEL 8 | delve | 1.20.2-1.module+el8.9.0+18926+5193682d | RHSA-2024:0887 |
| RHEL 8 | fuse-overlayfs | 1.9-2.module+el8.9.0+21242+944321bb | RHSA-2024:2988, RHSA-2024:0748 |
| RHEL 8 | go-toolset | 1.20.12-1.module+el8.9.0+21033+5795bdf6 | RHSA-2024:0887 |
| RHEL 8 | golang +5 | 1.20.12-2.module+el8.9.0+21033+5795bdf6 | RHSA-2024:0887 |
| RHEL 8 | libslirp +1 | 4.4.0-1.module+el8.9.0+20326+387084d0 | RHSA-2024:2988, RHSA-2024:0748 |
| RHEL 8 | netavark +1 | 2:1.0.1-38.module+el8.9.0+21242+944321bb | RHSA-2024:2988, RHSA-2024:0748 |
| RHEL 8 | oci-seccomp-bpf-hook | 1.2.5-2.module+el8.9.0+21242+944321bb | RHSA-2024:2988, RHSA-2024:0748 |
| RHEL 8 | podman +6 | 2:4.0.2-26.module+el8.9.0+21242+944321bb | RHSA-2024:2988, RHSA-2024:0748 |
| RHEL 8 | python-podman +1 | 4.0.0-2.module+el8.9.0+21242+944321bb | RHSA-2024:2988, RHSA-2024:0748 |
| RHEL 8 | runc | 1:1.1.12-1.module+el8.9.0+21242+944321bb | RHSA-2024:2988, RHSA-2024:0748 |
| RHEL 8 | skopeo +1 | 2:1.6.2-9.module+el8.9.0+21242+944321bb | RHSA-2024:2988, RHSA-2024:0748 |
| RHEL 8 | slirp4netns | 1.1.8-3.module+el8.9.0+21242+944321bb | RHSA-2024:2988, RHSA-2024:0748 |
| RHEL 8 | toolbox +1 | 0.0.99.4-5.module+el8.9.0+21242+944321bb | RHSA-2024:2988, RHSA-2024:0748 |
| RHEL 8 | udica | 0.2.6-4.module+el8.9.0+21242+944321bb | RHSA-2024:2988, RHSA-2024:0748 |
| RHEL 7 | rhc-worker-script | 0.6-1.el7_9 | RHSA-2024:1244 |
Show 8 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Serverless 1 | openshift-serverless-clients | 1.10.0-6.el8 | RHSA-2024:0880 |
| Red Hat OpenStack 17 | collectd-sensubility | 0.2.1-3.el8ost | RHSA-2024:2767, RHSA-2024:2730 |
| Red Hat OpenStack 17 | etcd | 3.4.26-8.el9ost | RHSA-2024:2729 |
| Red Hat OpenStack 16 | etcd | 3.3.23-16.el8ost | RHSA-2024:3467, RHSA-2024:3352 |
| Red Hat OpenShift 4 | buildah +1 | 1:1.29.1-20.2.rhaos4.15.el8 | RHSA-2023:7201 |
| Red Hat OpenShift 4 | butane +1 | 0.20.0-1.rhaos4.15.el8 | RHSA-2023:7201 |
| Red Hat OpenShift 4 | containernetworking-plugins | 1:1.4.0-1.1.rhaos4.15.el8 | RHSA-2023:7201 |
| Red Hat OpenShift 4 | cri-o | 1.28.3-14.rhaos4.15.git33aabd8.el8 | RHSA-2023:7201 |
| Red Hat OpenShift 4 | cri-tools | 1.28.0-3.el8 | RHSA-2023:7201 |
| Red Hat OpenShift 4 | ignition +1 | 2.16.2-2.rhaos4.15.el9 | RHSA-2023:7201 |
| Red Hat OpenShift 4 | microshift +5 | 4.15.0-202402260721.p0.g799289b.assembly.4.15.0.el9 | RHSA-2023:7200 |
| Red Hat OpenShift 4 | openshift +1 | 4.15.0-202402142009.p0.g6216ea1.assembly.stream.el8 | RHSA-2023:7201 |
| Red Hat OpenShift 4 | openshift-clients +1 | 4.15.0-202402070507.p0.g48dcf59.assembly.stream.el8 | RHSA-2023:7201 |
| Red Hat OpenShift 4 | podman +6 | 3:4.4.1-21.rhaos4.15.el8 | RHSA-2023:7201 |
| Red Hat OpenShift 4 | runc | 4:1.1.12-1.rhaos4.15.el8 | RHSA-2023:7201 |
| Red Hat OpenShift 4 | skopeo +1 | 2:1.11.2-21.1.rhaos4.15.el8 | RHSA-2023:7201 |
| Red Hat Devtools 2023 | go-toolset-1.19-golang +6 | 1.19.13-5.el7_9 | RHSA-2024:1041 |
| Red Hat Ansible Automation Platform Inside 2 | receptor +1 | 1.4.5-1.el8ap | RHSA-2024:1640 |
| Red Hat Ansible Automation Platform Developer 2 | receptor +1 | 1.4.5-1.el8ap | RHSA-2024:1640 |
| Red Hat Ansible Automation Platform 2 | automation-controller-venv-tower | 4.5.5-2.el8ap | RHSA-2024:1640 |
| Red Hat Ansible Automation Platform 2 | python-aiohttp +1 | 3.9.3-1.el9ap | RHSA-2024:1640 |
| Red Hat Ansible Automation Platform 2 | python-django +1 | 4.2.11-1.el9ap | RHSA-2024:1640 |
| Red Hat Ansible Automation Platform 2 | python39-aiohttp +1 | 3.9.3-1.el8ap | RHSA-2024:1640 |
| Red Hat Ansible Automation Platform 2 | python39-django +1 | 4.2.11-1.el8ap | RHSA-2024:1640 |
| Red Hat Ansible Automation Platform 2 | receptor +1 | 1.4.5-1.el8ap | RHSA-2024:1640 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | buildah +1 | 2:1.33.6-2.el9 | ALSA-2024:2245 |
| AlmaLinux 9 | containernetworking-plugins | 1:1.4.0-2.el9_4 | ALSA-2024:2272 |
| AlmaLinux 9 | golang +6 | 1.20.12-1.el9_3 | ALSA-2024:1131 |
| AlmaLinux 9 | podman +4 | 2:4.9.4-0.1.el9 | ALSA-2024:2193 |
| AlmaLinux 9 | skopeo +1 | 2:1.13.3-4.el9_3 | ALSA-2024:1149 |
| AlmaLinux 9 | toolbox +1 | 0.0.99.5-2.el9 | ALSA-2024:2160 |
| AlmaLinux 8 | buildah +1 | 1:1.24.6-7.module_el8.9.0+3627+db8ec155 | ALSA-2024:0748 |
| AlmaLinux 8 | cockpit-podman | 46-1.module_el8.7.0+3344+5bcd850f | ALSA-2024:0748 |
| AlmaLinux 8 | conmon | 2:2.1.4-2.module_el8.9.0+3627+db8ec155 | ALSA-2024:0748 |
| AlmaLinux 8 | container-selinux | 2:2.205.0-3.module_el8.9.0+3627+db8ec155 | ALSA-2024:0748 |
| AlmaLinux 8 | containernetworking-plugins | 1:1.1.1-6.module_el8.9.0+3711+04fcca5e | ALSA-2024:0748 |
| AlmaLinux 8 | containers-common | 2:1-38.module_el8.9.0+3627+db8ec155 | ALSA-2024:0748 |
| AlmaLinux 8 | crit +4 | 3.15-3.module_el8.6.0+2877+8e437bf5 | ALSA-2024:0748 |
| AlmaLinux 8 | crun | 1.8.7-1.module_el8.9.0+3683+33eb0feb | ALSA-2024:0748 |
| AlmaLinux 8 | delve | 1.20.2-1.module_el8.9.0+3642+43318da8 | ALSA-2024:0887 |
| AlmaLinux 8 | fuse-overlayfs | 1.9-2.module_el8.9.0+3627+db8ec155 | ALSA-2024:0748 |
| AlmaLinux 8 | go-toolset | 1.20.12-1.module_el8.9.0+3728+f1d47c6f | ALSA-2024:0887 |
| AlmaLinux 8 | golang +5 | 1.20.12-2.module_el8.9.0+3728+f1d47c6f | ALSA-2024:0887 |
| AlmaLinux 8 | libslirp +1 | 4.4.0-1.module_el8.6.0+2877+8e437bf5 | ALSA-2024:0748 |
| AlmaLinux 8 | netavark +1 | 2:1.0.1-38.module_el8.9.0+3627+db8ec155 | ALSA-2024:0748 |
| AlmaLinux 8 | oci-seccomp-bpf-hook | 1.2.5-2.module_el8.8.0+3468+16b86c82 | ALSA-2024:0748 |
| AlmaLinux 8 | podman +6 | 2:4.0.2-26.module_el8.9.0+3722+7fd8ab2b.alma.1 | ALSA-2024:0748 |
| AlmaLinux 8 | python3-podman | 4.0.0-2.module_el8.9.0+3711+04fcca5e | ALSA-2024:0748 |
| AlmaLinux 8 | runc | 1:1.1.12-1.module_el8.9.0+3722+7fd8ab2b | ALSA-2024:0748 |
| AlmaLinux 8 | skopeo +1 | 2:1.6.2-9.module_el8.9.0+3687+dcd7ef8f.alma.1 | ALSA-2024:0748 |
| AlmaLinux 8 | slirp4netns | 1.1.8-3.module_el8.9.0+3627+db8ec155 | ALSA-2024:0748 |
| AlmaLinux 8 | toolbox +1 | 0.0.99.4-5.module_el8.9.0+3627+db8ec155 | ALSA-2024:0748 |
| AlmaLinux 8 | udica | 0.2.6-4.module_el8.9.0+3627+db8ec155 | ALSA-2024:0748 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | aardvark-dns | 2:1.10.0-1.module+el8.10.0+1815+5fe7415e | RLSA-2024:2988 |
| Rocky Linux 8 | buildah | 1:1.24.6-7.module+el8.9.0+1445+07728297 | RLSA-2024:0748 |
| Rocky Linux 8 | cockpit-podman | 46-1.module+el8.9.0+1445+07728297 | RLSA-2024:2988, RLSA-2024:0748 |
| Rocky Linux 8 | conmon | 2:2.1.4-2.module+el8.9.0+1445+07728297 | RLSA-2024:2988, RLSA-2024:0748 |
| Rocky Linux 8 | container-selinux | 2:2.205.0-3.module+el8.9.0+1445+07728297 | RLSA-2024:2988, RLSA-2024:0748 |
| Rocky Linux 8 | containernetworking-plugins | 1:1.4.0-2.module+el8.10.0+1815+5fe7415e | RLSA-2024:2988 |
| Rocky Linux 8 | containers-common | 2:1-38.module+el8.9.0+1445+07728297 | RLSA-2024:2988, RLSA-2024:0748 |
| Rocky Linux 8 | criu | 3.15-3.module+el8.9.0+1445+07728297 | RLSA-2024:0748 |
| Rocky Linux 8 | crun | 1.14.3-2.module+el8.10.0+1815+5fe7415e | RLSA-2024:2988 |
| Rocky Linux 8 | fuse-overlayfs | 1.9-2.module+el8.9.0+1445+07728297 | RLSA-2024:2988, RLSA-2024:0748 |
| Rocky Linux 8 | libslirp | 4.4.0-1.module+el8.9.0+1445+07728297 | RLSA-2024:2988, RLSA-2024:0748 |
| Rocky Linux 8 | netavark | 2:1.10.3-1.module+el8.10.0+1815+5fe7415e | RLSA-2024:2988 |
| Rocky Linux 8 | oci-seccomp-bpf-hook | 1.2.5-2.module+el8.9.0+1445+07728297 | RLSA-2024:2988, RLSA-2024:0748 |
| Rocky Linux 8 | python-podman | 4.0.0-2.module+el8.9.0+1445+07728297 | RLSA-2024:2988, RLSA-2024:0748 |
| Rocky Linux 8 | runc | 1:1.1.12-1.module+el8.10.0+1815+5fe7415e | RLSA-2024:2988, RLSA-2024:0748 |
| Rocky Linux 8 | skopeo | 2:1.6.2-9.module+el8.9.0+1578+aa900b44 | RLSA-2024:0748 |
| Rocky Linux 8 | slirp4netns | 1.1.8-3.module+el8.9.0+1445+07728297 | RLSA-2024:2988, RLSA-2024:0748 |
| Rocky Linux 8 | toolbox | 0.0.99.5-2.module+el8.10.0+1815+5fe7415e.rocky.0.2.rocky.0.2 | RLSA-2024:2988 |
| Rocky Linux 8 | udica | 0.2.6-4.module+el8.9.0+1445+07728297 | RLSA-2024:0748 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP5 | go1.20 | 1.20.12-150000.1.35.1 | SUSE-SU-2023:4708-1 |
| SLES 15 SP5 | go1.20-openssl | 1.20.12.1-150000.1.17.1 | SUSE-SU-2023:4930-1 |
| SLES 15 SP5 | go1.21 | 1.21.5-150000.1.18.1 | SUSE-SU-2023:4709-1 |
| SLES 15 SP5 | go1.21-openssl | 1.21.5.1-150000.1.8.1 | SUSE-SU-2023:4931-1 |
| SLES 15 SP4 | go1.20 | 1.20.12-150000.1.35.1 | SUSE-SU-2023:4708-1 |
| SLES 15 SP4 | go1.20-openssl | 1.20.12.1-150000.1.17.1 | SUSE-SU-2023:4930-1 |
| SLES 15 SP4 | go1.21 | 1.21.5-150000.1.18.1 | SUSE-SU-2023:4709-1 |
| SLES 15 SP4 | go1.21-openssl | 1.21.5.1-150000.1.8.1 | SUSE-SU-2023:4931-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | go1.20 | 1.20.12-1.1 | openSUSE-SU-2024:13491-1 |
| openSUSE Tumbleweed | go1.21 | 1.21.5-1.1 | openSUSE-SU-2024:13492-1 |
| openSUSE Leap 15.5 | go1.20 | 1.20.12-150000.1.35.1 | SUSE-SU-2023:4708-1 |
| openSUSE Leap 15.5 | go1.20-openssl | 1.20.12.1-150000.1.17.1 | SUSE-SU-2023:4930-1 |
| openSUSE Leap 15.5 | go1.21 | 1.21.5-150000.1.18.1 | SUSE-SU-2023:4709-1 |
| openSUSE Leap 15.5 | go1.21-openssl | 1.21.5.1-150000.1.8.1 | SUSE-SU-2023:4931-1 |
| openSUSE Leap 15.4 | go1.20 | 1.20.12-150000.1.35.1 | SUSE-SU-2023:4708-1 |
| openSUSE Leap 15.4 | go1.20-openssl | 1.20.12.1-150000.1.17.1 | SUSE-SU-2023:4930-1 |
| openSUSE Leap 15.4 | go1.21 | 1.21.5-150000.1.18.1 | SUSE-SU-2023:4709-1 |
| openSUSE Leap 15.4 | go1.21-openssl | 1.21.5.1-150000.1.8.1 | SUSE-SU-2023:4931-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | go | 1.21.5-r0 | — |
| Alpine v3.23 | go | 1.21.5-r0 | — |
| Alpine v3.22 | go | 1.21.5-r0 | — |
| Alpine v3.21 | go | 1.21.5-r0 | — |
| Alpine v3.20 | go | 1.21.5-r0 | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | go | 1.21.5-r0 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | amazon-cloudwatch-agent | 1.300032.3-1.amzn2023 | ALAS2023-2024-498 |
| Amazon Linux 2023 | amazon-ecr-credential-helper | 0.7.1-4.amzn2023 | ALAS2023-2024-631 |
| Amazon Linux 2023 | amazon-ssm-agent | 3.2.2222.0-1.amzn2023 | ALAS2023-2024-526 |
| Amazon Linux 2023 | cni-plugins | 1.2.0-1.amzn2023.0.4 | ALAS2023-2024-618 |
| Amazon Linux 2023 | containerd +1 | 1.7.11-1.amzn2023.0.1 | ALAS2023-2024-499 |
| Amazon Linux 2023 | docker | 25.0.3-1.amzn2023.0.1 | ALAS2023-2024-542 |
| Amazon Linux 2023 | ecs-init | 1.80.0-1.amzn2023 | ALAS2023-2024-619 |
| Amazon Linux 2023 | golang +6 | 1.20.12-1.amzn2023.0.1 | ALAS2023-2024-477 |
| Amazon Linux 2023 | nerdctl | 1.7.2-1.amzn2023.0.1 | ALAS2023-2024-529 |
| Amazon Linux 2023 | oci-add-hooks | 0-0.1.20200504git268e3bb.amzn2023.0.3 | ALAS2023-2024-632 |
| Amazon Linux 2023 | runc | 1.1.11-1.amzn2023.0.1 | ALAS2023-2024-501 |
| Amazon Linux 2 | amazon-cloudwatch-agent | 1.300032.3-1.amzn2 | ALAS2-2024-2424 |
| Amazon Linux 2 | amazon-ssm-agent | 3.2.2222.0-1.amzn2 | ALAS2-2024-2458 |
| Amazon Linux 2 | cni-plugins | 1.2.0-1.amzn2.0.5 | ALAS2-2024-2543 |
| Amazon Linux 2 | cri-tools | 1.29.0-1.amzn2.0.1 | ALAS2-2024-2446 |
| Amazon Linux 2 | golang +6 | 1.20.12-1.amzn2.0.1 | ALAS2-2024-2388 |
| Amazon Linux 2 | golist | 0.10.1-10.amzn2.0.5 | ALAS2-2024-2556 |
| Amazon Linux 2 | nerdctl | 1.7.6-1.amzn2.0.1 | ALAS2-2024-2618 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | golang | No fix yet | — |
| Azure Linux 2 (CBL-Mariner) | golang +1 | 1.21.5-1 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | buildah +1 | 2:1.33.6-2.0.1.el9 | ELSA-2024-2245 |
| Oracle Linux 9 | conmon | 3:2.1.3-8.el9 | ELSA-2024-12225 |
| Oracle Linux 9 | containernetworking-plugins | 1:1.4.0-2.el9_4 | ELSA-2024-2272 |
| Oracle Linux 9 | cri-o | 1.26.4-1.el9 | ELSA-2024-12225 |
| Oracle Linux 9 | cri-tools | 1.26.1-4.el9 | ELSA-2024-12225 |
| Oracle Linux 9 | etcd | 3.5.9-3.el9 | ELSA-2024-12225 |
| Oracle Linux 9 | flannel-cni-plugin | 1.2.0-3.el9 | ELSA-2024-12225 |
| Oracle Linux 9 | golang +6 | 1.20.12-1.el9_3 | ELSA-2024-1131 |
| Oracle Linux 9 | helm | 3.12.0-4.el9 | ELSA-2024-12225 |
| Oracle Linux 9 | istio +1 | 1.17.8-2.el9 | ELSA-2024-12225 |
| Oracle Linux 9 | kata | 1.12.1-17.el9 | ELSA-2024-12225 |
| Oracle Linux 9 | kata-image | 1.12.1-11.11.ol9_202312212316 | ELSA-2024-12225 |
| Oracle Linux 9 | kata-shim +4 | 1.12.1-11.el9 | ELSA-2024-12225 |
| Oracle Linux 9 | kubeadm +2 | 1.26.10-3.el9 | ELSA-2024-12225 |
| Oracle Linux 9 | kubernetes-cni | 1.1.2-4.el9 | ELSA-2024-12225 |
| Oracle Linux 9 | kubernetes-cni-plugins | 1.2.0-6.el9 | ELSA-2024-12225 |
| Oracle Linux 9 | olcnectl +15 | 1.7.6-5.el9 | ELSA-2024-12262, ELSA-2024-12261, ELSA-2024-12225 |
| Oracle Linux 9 | podman +4 | 2:4.9.4-0.1.0.1.el9 | ELSA-2024-2193 |
| Oracle Linux 9 | skopeo +1 | 2:1.13.3-4.el9_3 | ELSA-2024-1149 |
| Oracle Linux 9 | virtctl | 0.58.0-5.el9 | ELSA-2024-12225 |
| Oracle Linux 9 | yq | 4.34.1-4.el9 | ELSA-2024-12225 |
| Oracle Linux 8 | buildah +1 | 1:1.24.6-7.module+el8.9.0+90165+ead7974e | ELSA-2024-12191, ELSA-2024-2988 |
| Oracle Linux 8 | cockpit-podman | 46-1.module+el8.9.0+90165+ead7974e | ELSA-2024-12191, ELSA-2024-2988 |
| Oracle Linux 8 | conmon | 2:2.1.4-2.module+el8.9.0+90165+ead7974e | ELSA-2024-12226, ELSA-2024-12191, ELSA-2024-12190 |
| Oracle Linux 8 | container-selinux | 2:2.205.0-3.module+el8.9.0+90165+ead7974e | ELSA-2024-12191, ELSA-2024-2988 |
| Oracle Linux 8 | containernetworking-plugins | 1:1.1.1-6.module+el8.9.0+90165+ead7974e | ELSA-2024-12191, ELSA-2024-2988 |
| Oracle Linux 8 | containers-common | 2:1-38.0.1.module+el8.9.0+90165+ead7974e | ELSA-2024-12191, ELSA-2024-2988 |
| Oracle Linux 8 | cri-o | 1.25.5-1.el8 | ELSA-2024-12226, ELSA-2024-12190 |
| Oracle Linux 8 | cri-tools | 1.25.0-3.el8 | ELSA-2024-12226, ELSA-2024-12190 |
| Oracle Linux 8 | crit +4 | 3.15-3.module+el8.9.0+90165+ead7974e | ELSA-2024-12191, ELSA-2024-2988 |
| Oracle Linux 8 | crun | 1.8.7-1.module+el8.9.0+90165+ead7974e | ELSA-2024-12191, ELSA-2024-2988 |
| Oracle Linux 8 | delve | 1.20.2-1.0.1.module+el8.9.0+90001+52c302fe | ELSA-2024-0887 |
| Oracle Linux 8 | etcd | 3.5.9-3.el8 | ELSA-2024-12226 |
| Oracle Linux 8 | fuse-overlayfs | 1.9-2.module+el8.9.0+90165+ead7974e | ELSA-2024-12191, ELSA-2024-2988 |
| Oracle Linux 8 | golang +6 | 1.20.12-1.module+el8.9.0+90156+2bd6b1a8 | ELSA-2024-0887 |
| Oracle Linux 8 | helm | 3.11.1-3.el8 | ELSA-2024-12226, ELSA-2024-12190 |
| Oracle Linux 8 | istio +1 | 1.16.7-3.el8 | ELSA-2024-12226, ELSA-2024-12190 |
| Oracle Linux 8 | kata | 1.12.1-17.el8 | ELSA-2024-12226, ELSA-2024-12190 |
| Oracle Linux 8 | kata-image | 1.12.1-11.11.ol8_202312212317 | ELSA-2024-12226, ELSA-2024-12190 |
| Oracle Linux 8 | kata-shim +4 | 1.12.1-11.el8 | ELSA-2024-12226, ELSA-2024-12190 |
| Oracle Linux 8 | kubeadm +2 | 1.25.15-2.el8 | ELSA-2024-12226, ELSA-2024-12190 |
| Oracle Linux 8 | kubernetes-cni +1 | 1.0.1-4.el8 | ELSA-2024-12226, ELSA-2024-12190 |
| Oracle Linux 8 | kubernetes-cni-plugins | 1.0.1-5.el8 | ELSA-2024-12226, ELSA-2024-12190 |
| Oracle Linux 8 | libslirp +1 | 4.4.0-1.module+el8.9.0+90147+a4870853 | ELSA-2024-12191, ELSA-2024-2988 |
| Oracle Linux 8 | netavark +1 | 2:1.0.1-38.0.1.module+el8.9.0+90165+ead7974e | ELSA-2024-12191, ELSA-2024-2988 |
| Oracle Linux 8 | oci-seccomp-bpf-hook | 1.2.5-2.module+el8.9.0+90165+ead7974e | ELSA-2024-12191, ELSA-2024-2988 |
| Oracle Linux 8 | olcne-rook-chart +1 | 1.7.6-5.el8 | ELSA-2024-12264, ELSA-2024-12263, ELSA-2024-12226 |
| Oracle Linux 8 | olcnectl +13 | 1.6.6-3.el8 | ELSA-2024-12264, ELSA-2024-12263, ELSA-2024-12226 |
| Oracle Linux 8 | podman +6 | 2:4.0.2-26.module+el8.9.0+90165+ead7974e | ELSA-2024-12191, ELSA-2024-2988 |
| Oracle Linux 8 | python3-podman | 4.0.0-2.module+el8.9.0+90165+ead7974e | ELSA-2024-12191, ELSA-2024-2988 |
| Oracle Linux 8 | runc | 1:1.1.12-1.module+el8.10.0+90298+77a9814d | ELSA-2024-12191, ELSA-2024-2988 |
| Oracle Linux 8 | skopeo +1 | 2:1.6.2-9.module+el8.9.0+90165+ead7974e | ELSA-2024-12191, ELSA-2024-2988 |
| Oracle Linux 8 | slirp4netns | 1.1.8-3.module+el8.9.0+90165+ead7974e | ELSA-2024-12191, ELSA-2024-2988 |
| Oracle Linux 8 | udica | 0.2.6-4.module+el8.9.0+90165+ead7974e | ELSA-2024-12191, ELSA-2024-2988 |
| Oracle Linux 8 | virtctl | 0.58.0-5.el8 | ELSA-2024-12226 |
| Oracle Linux 8 | yq | 4.34.1-4.el8 | ELSA-2024-12226, ELSA-2024-12190 |
| Oracle Linux 7 | conmon | 3:2.1.3-8.el7 | ELSA-2024-12189 |
| Oracle Linux 7 | cri-o | 1.25.5-1.el7 | ELSA-2024-12189 |
| Oracle Linux 7 | cri-tools | 1.25.0-3.el7 | ELSA-2024-12189 |
| Oracle Linux 7 | helm | 3.11.1-3.el7 | ELSA-2024-12189 |
| Oracle Linux 7 | istio +1 | 1.16.7-3.el7 | ELSA-2024-12189 |
| Oracle Linux 7 | kata | 1.12.1-17.el7 | ELSA-2024-12189 |
| Oracle Linux 7 | kata-image | 1.12.1-11.11.ol7_202312212315 | ELSA-2024-12189 |
| Oracle Linux 7 | kata-shim +4 | 1.12.1-11.el7 | ELSA-2024-12189 |
| Oracle Linux 7 | kubeadm +2 | 1.25.15-2.el7 | ELSA-2024-12189 |
| Oracle Linux 7 | kubernetes-cni +1 | 1.0.1-4.el7 | ELSA-2024-12189 |
| Oracle Linux 7 | kubernetes-cni-plugins | 1.0.1-5.el7 | ELSA-2024-12189 |
| Oracle Linux 7 | olcnectl +13 | 1.6.6-3.el7 | ELSA-2024-12189 |
| Oracle Linux 7 | yq | 4.34.1-4.el7 | ELSA-2024-12189 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | aactl | 0.4.12-r5 | — |
| Wolfi rolling | amass | 4.2.0-r3 | — |
| Wolfi rolling | aws-flb-cloudwatch | 1.9.4-r6 | — |
| Wolfi rolling | aws-flb-firehose | 1.7.2-r6 | — |
| Wolfi rolling | aws-flb-kinesis | 1.10.2-r6 | — |
| Wolfi rolling | cass-operator | 1.18.2-r3 | — |
| Wolfi rolling | cni-plugins | 1.4.0-r1 | — |
| Wolfi rolling | configmap-reload | 0.12.0-r3 | — |
| Wolfi rolling | cortex | 1.16.0-r1 | — |
| Wolfi rolling | ctop | 0.7.7-r10 | — |
| Wolfi rolling | dgraph | 23.1.0-r4 | — |
| Wolfi rolling | docker-cli | 24.0.6-r1 | — |
| Wolfi rolling | docker-credential-ecr-login | 0.7.1-r8 | — |
| Wolfi rolling | flannel-cni-plugin | 1.2.0-r5 | — |
| Wolfi rolling | gke-gcloud-auth-plugin | 0.0.2-r6 | — |
| Wolfi rolling | go-bindata | 3.1.3-r15 | — |
| Wolfi rolling | go-licenses | 1.6.0-r8 | — |
| Wolfi rolling | go-md2man | 2.0.3-r1 | — |
| Wolfi rolling | gobuster | 3.6.0-r4 | — |
| Wolfi rolling | gops | 0.3.28-r4 | — |
| Wolfi rolling | gosu | 1.17-r2 | — |
| Wolfi rolling | grpcurl | 1.8.9-r2 | — |
| Wolfi rolling | helm-push | 0.10.4-r1 | — |
| Wolfi rolling | hey | 0.1.4-r9 | — |
| Wolfi rolling | hubble-ui-backend | 0.13.3-r1 | — |
| Wolfi rolling | influx | 2.7.3-r8 | — |
| Wolfi rolling | ip-masq-agent | 2.9.3-r6 | — |
| Wolfi rolling | k3d | 5.6.0-r5 | — |
| Wolfi rolling | katib-earlystopping +8 | 0.19.0-r31 | — |
| Wolfi rolling | katib-suggestion-goptuna-compat | 0.19.0-r40 | — |
| Wolfi rolling | kind | 0.21.0-r0 | — |
| Wolfi rolling | kubernetes-dashboard-metrics-scraper +1 | 1.0.9-r10 | — |
| Wolfi rolling | local-path-provisioner | 0.0.26-r2 | — |
| Wolfi rolling | mage | 1.15.0-r4 | — |
| Wolfi rolling | metrics-server | 0.6.4-r8 | — |
| Wolfi rolling | nats | 0.1.1-r4 | — |
| Wolfi rolling | nri-discovery-kubernetes | 1.7.2-r2 | — |
| Wolfi rolling | nsc | 2.8.5-r1 | — |
| Wolfi rolling | oras | 1.1.0-r4 | — |
| Wolfi rolling | petname | 2.11-r3 | — |
| Wolfi rolling | protoc-gen-go-grpc | 1.3.0-r7 | — |
| Wolfi rolling | render-template | 1.0.6-r1 | — |
| Wolfi rolling | sbom-scorecard | 0.0.7-r6 | — |
| Wolfi rolling | scorecard | 4.13.1-r1 | — |
| Wolfi rolling | slsa-verifier | 2.4.1-r1 | — |
| Wolfi rolling | smarter-device-manager | 1.20.11-r3 | — |
| Wolfi rolling | sonobuoy | 0.57.1-r1 | — |
| Wolfi rolling | sops | 3.8.1-r1 | — |
| Wolfi rolling | vertical-pod-autoscaler | 1.0.0-r2 | — |
| Wolfi rolling | wait-for-port | 1.0.7-r1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | stdlib | < 1.20.12 · >= 1.21.0-0, < 1.21.5 | 1.20.12, 1.21.5 | GO-2023-2382 |
Advisories 50
- ALSA-2024:1131 Moderate: golang security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2024:2193 Moderate: podman security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2024:2160 Moderate: toolbox security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2024:2245 Moderate: buildah security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2024:2272 Moderate: containernetworking-plugins security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2024:1149 Moderate: skopeo security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2024:0748 Important: container-tools:4.0 security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2024:0887 Moderate: go-toolset:rhel8 security update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2024:3467 Red Hat Security Advisory: Red Hat OpenStack Platform 16.1 (etcd) security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2024:3352 Red Hat Security Advisory: Red Hat OpenStack Platform 16.2 (etcd) security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2024:2988 Red Hat Security Advisory: container-tools:rhel8 security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2023:7201 Red Hat Security Advisory: OpenShift Container Platform 4.15.0 packages and security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2023:7200 Red Hat Security Advisory: OpenShift Container Platform 4.15.z security update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2024:2730 Red Hat Security Advisory: Red Hat OpenStack Platform 17.1 (collectd-sensubility) security update Red Hat Security Advisories (RHSA) · Oct 18, 2026
- RHSA-2024:2767 Red Hat Security Advisory: Red Hat OpenStack Platform 17.1 (collectd-sensubility) security update Red Hat Security Advisories (RHSA) · Oct 18, 2026
- RHSA-2024:2729 Red Hat Security Advisory: Red Hat OpenStack Platform 17.1 (etcd) security update Red Hat Security Advisories (RHSA) · Oct 18, 2026
- RHSA-2024:2272 Red Hat Security Advisory: containernetworking-plugins security update Red Hat Security Advisories (RHSA) · Oct 18, 2026
- RHSA-2024:2193 Red Hat Security Advisory: podman security update Red Hat Security Advisories (RHSA) · Oct 18, 2026
- RHSA-2024:2245 Red Hat Security Advisory: buildah security update Red Hat Security Advisories (RHSA) · Oct 18, 2026
- RHSA-2024:2160 Red Hat Security Advisory: toolbox security update Red Hat Security Advisories (RHSA) · Oct 18, 2026
- RHSA-2024:1640 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update Red Hat Security Advisories (RHSA) · Oct 18, 2026
- RHSA-2024:1244 Red Hat Security Advisory: rhc-worker-script security update Red Hat Security Advisories (RHSA) · Oct 18, 2026
- RHSA-2024:1149 Red Hat Security Advisory: skopeo security update Red Hat Security Advisories (RHSA) · Oct 18, 2026
- RHSA-2024:1131 Red Hat Security Advisory: golang security update Red Hat Security Advisories (RHSA) · Oct 18, 2026
- RHSA-2024:1041 Red Hat Security Advisory: go-toolset-1.19-golang security update Red Hat Security Advisories (RHSA) · Oct 18, 2026
- RHSA-2024:0887 Red Hat Security Advisory: go-toolset:rhel8 security update Red Hat Security Advisories (RHSA) · Oct 18, 2026
- RHSA-2024:0748 Red Hat Security Advisory: container-tools:4.0 security update Red Hat Security Advisories (RHSA) · Oct 18, 2026
- RHSA-2024:0880 Red Hat Security Advisory: Release of OpenShift Serverless Client kn 1.31.1 security update Red Hat Security Advisories (RHSA) · Oct 18, 2026
- WID-SEC-2024-3054 Splunk Add-on for Amazon Web Services: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 28, 2026
- WID-SEC-2024-1226 Red Hat OpenShift: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 11, 2026
- USN-6574-1 Go vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- WID-SEC-2024-1228 Red Hat OpenStack: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 15, 2026
- openSUSE-SU-2024:13492-1 go1.21-1.21.5-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:4709-1 Security update for go1.21 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:4931-1 Security update for go1.21-openssl SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:13491-1 go1.20-1.20.12-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:4930-1 Security update for go1.20-openssl SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:4708-1 Security update for go1.20 SUSE / openSUSE Security Updates · Feb 4, 2026
- RLSA-2024:2988 Moderate: container-tools:rhel8 security update Rocky Linux Security Advisories · May 7, 2025
- RLSA-2024:0748 Important: container-tools:4.0 security update Rocky Linux Security Advisories · May 7, 2025
- WID-SEC-2024-1248 Xerox FreeFlow Print Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 21, 2024
- WID-SEC-2023-3038 Golang Go: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff BSI CERT-Bund (WID) · Oct 14, 2024
- ALAS2023-2024-542 Important: docker security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Aug 28, 2024
- ALAS2-2024-2618 Moderate: nerdctl security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Aug 28, 2024
- ALAS2023-2024-499 Moderate: containerd security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Aug 9, 2024
- ALAS2-2024-2556 Moderate: golist security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · May 29, 2024
- ALAS2023-2024-631 Moderate: amazon-ecr-credential-helper security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · May 28, 2024
- ALAS2023-2024-632 Moderate: oci-add-hooks security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · May 28, 2024
- ELSA-2024-2988 Moderate: container-tools:ol8 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · May 24, 2024
- ALAS2023-2024-618 Moderate: cni-plugins security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · May 15, 2024