Important: container-tools:rhel8 security update

2024-08-1300:00:00

errata.almalinux.org

container-tools

rhel8

security fix

memory leaks

memory exhaustion

cve-2024-1394

cve-2023-45290

cve-2024-24783

cve-2024-24784

cve-2024-3727

cve-2024-24789

cve-2024-6104

cve-2024-37298

references

unix

CVSS3

8.3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

AI Score

7.3

Confidence

High

EPSS

0.001

Percentile

30.9%

JSON

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads (CVE-2024-1394)
golang: net/http: memory exhaustion in Request.ParseMultipartForm (CVE-2023-45290)
golang: crypto/x509: Verify panics on certificates with an unknown public key algorithm (CVE-2024-24783)
golang: net/mail: comments in display names are incorrectly handled (CVE-2024-24784)
containers/image: digest type does not guarantee valid type (CVE-2024-3727)
golang: archive/zip: Incorrect handling of certain ZIP files (CVE-2024-24789)
go-retryablehttp: url might write sensitive information to log file (CVE-2024-6104)
gorilla/schema: Potential memory exhaustion attack due to sparse slice deserialization (CVE-2024-37298)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

OSVersionArchitecturePackageVersionFilename
almalinux8noarchpodman-docker< 4.9.4-12.module_el8.10.0+3876+e55593a8podman-docker-4.9.4-12.module_el8.10.0+3876+e55593a8.noarch.rpm
almalinux8noarchpython3-podman< 4.9.0-2.module_el8.10.0+3876+e55593a8python3-podman-4.9.0-2.module_el8.10.0+3876+e55593a8.noarch.rpm
almalinux8noarchcontainer-selinux< 2.229.0-2.module_el8.10.0+3876+e55593a8container-selinux-2.229.0-2.module_el8.10.0+3876+e55593a8.noarch.rpm
almalinux8noarchcockpit-podman< 84.1-1.module_el8.10.0+3858+6ad51f9fcockpit-podman-84.1-1.module_el8.10.0+3858+6ad51f9f.noarch.rpm
almalinux8noarchudica< 0.2.6-21.module_el8.10.0+3858+6ad51f9fudica-0.2.6-21.module_el8.10.0+3858+6ad51f9f.noarch.rpm
almalinux8x86_64slirp4netns< 1.2.3-1.module_el8.10.0+3845+87b84552slirp4netns-1.2.3-1.module_el8.10.0+3845+87b84552.x86_64.rpm
almalinux8x86_64criu-devel< 3.18-5.module_el8.10.0+3876+e55593a8criu-devel-3.18-5.module_el8.10.0+3876+e55593a8.x86_64.rpm
almalinux8x86_64podman-tests< 4.9.4-12.module_el8.10.0+3876+e55593a8podman-tests-4.9.4-12.module_el8.10.0+3876+e55593a8.x86_64.rpm
almalinux8x86_64libslirp-devel< 4.4.0-2.module_el8.10.0+3876+e55593a8libslirp-devel-4.4.0-2.module_el8.10.0+3876+e55593a8.x86_64.rpm
almalinux8x86_64toolbox< 0.0.99.5-2.module_el8.10.0+3845+87b84552toolbox-0.0.99.5-2.module_el8.10.0+3845+87b84552.x86_64.rpm

OS	Version	Architecture	Package	Version	Filename
almalinux	8	noarch	podman-docker	< 4.9.4-12.module_el8.10.0+3876+e55593a8	podman-docker-4.9.4-12.module_el8.10.0+3876+e55593a8.noarch.rpm
almalinux	8	noarch	python3-podman	< 4.9.0-2.module_el8.10.0+3876+e55593a8	python3-podman-4.9.0-2.module_el8.10.0+3876+e55593a8.noarch.rpm
almalinux	8	noarch	container-selinux	< 2.229.0-2.module_el8.10.0+3876+e55593a8	container-selinux-2.229.0-2.module_el8.10.0+3876+e55593a8.noarch.rpm
almalinux	8	noarch	cockpit-podman	< 84.1-1.module_el8.10.0+3858+6ad51f9f	cockpit-podman-84.1-1.module_el8.10.0+3858+6ad51f9f.noarch.rpm
almalinux	8	noarch	udica	< 0.2.6-21.module_el8.10.0+3858+6ad51f9f	udica-0.2.6-21.module_el8.10.0+3858+6ad51f9f.noarch.rpm
almalinux	8	x86_64	slirp4netns	< 1.2.3-1.module_el8.10.0+3845+87b84552	slirp4netns-1.2.3-1.module_el8.10.0+3845+87b84552.x86_64.rpm
almalinux	8	x86_64	criu-devel	< 3.18-5.module_el8.10.0+3876+e55593a8	criu-devel-3.18-5.module_el8.10.0+3876+e55593a8.x86_64.rpm
almalinux	8	x86_64	podman-tests	< 4.9.4-12.module_el8.10.0+3876+e55593a8	podman-tests-4.9.4-12.module_el8.10.0+3876+e55593a8.x86_64.rpm
almalinux	8	x86_64	libslirp-devel	< 4.4.0-2.module_el8.10.0+3876+e55593a8	libslirp-devel-4.4.0-2.module_el8.10.0+3876+e55593a8.x86_64.rpm
almalinux	8	x86_64	toolbox	< 0.0.99.5-2.module_el8.10.0+3845+87b84552	toolbox-0.0.99.5-2.module_el8.10.0+3845+87b84552.x86_64.rpm