Lucene search
AlmaLinuxALSA-2023:7763HistoryDec 12, 2023 - 12:00 a.m.
Moderate: runc security update
2023-12-1200:00:00
errata.almalinux.org
20
runc
security
update
golang
crypto/tls
vulnerabilities
open container format
cvss
cve
ocf
CVSS3
7.5
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS
0.001
Percentile
50.8%
The runC tool is a lightweight, portable implementation of the Open Container Format (OCF) that provides container runtime.
Security Fix(es):
- golang: crypto/tls: slow verification of certificate chains containing large RSA keys (CVE-2023-29409)
- golang: crypto/tls: panic when processing post-handshake message on QUIC connections (CVE-2023-39321)
- golang: crypto/tls: lack of a limit on buffered post-handshake (CVE-2023-39322)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| almalinux | 9 | x86_64 | runc | < 1.1.9-2.el9_3 | runc-1.1.9-2.el9_3.x86_64.rpm |
| almalinux | 9 | aarch64 | runc | < 1.1.9-2.el9_3 | runc-1.1.9-2.el9_3.aarch64.rpm |
| almalinux | 9 | ppc64le | runc | < 1.1.9-2.el9_3 | runc-1.1.9-2.el9_3.ppc64le.rpm |
| almalinux | 9 | s390x | runc | < 1.1.9-2.el9_3 | runc-1.1.9-2.el9_3.s390x.rpm |
References
Related
redhat
redhat
(RHSA-2023:7763) Moderate: runc security update
2023-12-12 16:42:28
(RHSA-2023:7517) Moderate: Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update
2023-11-27 19:20:27
(RHSA-2023:7762) Moderate: skopeo security update
2023-12-12 16:42:25
nessus
nessus
Oracle Linux 9 : runc (ELSA-2023-7763)
2023-12-15 00:00:00
AlmaLinux 9 : runc (ALSA-2023:7763)
2023-12-14 00:00:00
RHEL 9 : runc (RHSA-2023:7763)
2023-12-12 00:00:00
osv
osv
Moderate: runc security update
2023-12-12 00:00:00
Moderate: buildah security update
2023-12-12 00:00:00
Moderate: skopeo security update
2023-12-12 00:00:00
oraclelinux
oraclelinux
runc security update
2023-12-14 00:00:00
buildah security update
2023-12-14 00:00:00
skopeo security update
2023-12-13 00:00:00
almalinux
almalinux
Moderate: buildah security update
2023-12-12 00:00:00
Moderate: containernetworking-plugins security update
2023-12-12 00:00:00
Moderate: skopeo security update
2023-12-12 00:00:00
ibm
ibm
redhatcve
redhatcve
prion
prion
Code injection
2023-09-08 17:15:00
Design/Logic Flaw
2023-09-08 17:15:00
Code injection
2023-08-02 20:15:00
openvas
openvas
openSUSE: Security Advisory for go1.21 (SUSE-SU-2023:3701-1)
2024-03-04 00:00:00
SUSE: Security Advisory (SUSE-SU-2023:3888-1)
2023-09-29 00:00:00
Huawei EulerOS: Security Advisory for golang (EulerOS-SA-2023-2896)
2023-10-09 00:00:00
freebsd
freebsd
go -- multiple vulnerabilities
2023-09-06 00:00:00
cvelist
cvelist
debiancve
debiancve
nvd
nvd
alpinelinux
alpinelinux
ubuntucve
ubuntucve
cve
cve
vulnrichment
vulnrichment
cgr
cgr
CVE-2023-39321 vulnerabilities
2024-05-19 03:07:16
CVE-2023-39322 vulnerabilities
2024-05-19 03:07:16
CVE-2023-29409 vulnerabilities
2024-05-19 03:07:16
veracode
veracode
Denial Of Service (DoS)
2023-10-02 20:14:46
Insufficient Information
2023-10-02 20:14:41
Denial Of Service (DoS)
2023-08-04 03:29:08
wolfi
wolfi
CVE-2023-39322 vulnerabilities
2024-10-01 21:13:23
CVE-2023-39321 vulnerabilities
2024-10-01 21:13:23
CVE-2023-29409 vulnerabilities
2024-10-01 21:13:23
amazon
amazon
Medium: nerdctl
2023-08-17 11:58:00
Medium: cri-tools
2023-08-31 22:28:00
Medium: amazon-cloudwatch-agent
2023-08-17 11:58:00
cbl_mariner
cbl_mariner
CVE-2023-29409 affecting package msft-golang for versions less than 1.20.7-1
2024-10-01 22:11:53
CVE-2023-29409 affecting package golang for versions less than 1.20.7-1
2024-10-01 22:11:53
CVE-2023-29409 affecting package golang for versions less than 1.20.7-1
2024-10-01 22:11:46
githubexploit
githubexploit
Exploit for Uncontrolled Resource Consumption in Golang Go
2023-08-21 15:59:26
redos
redos
ROS-20241001-02
2024-10-01 00:00:00
CVSS3
7.5
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS
0.001
Percentile
50.8%
Related for ALSA-2023:7763