Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
redhatRedHatRHSA-2024:2549
HistoryApr 30, 2024 - 11:38 a.m.

(RHSA-2024:2549) Moderate: skopeo security and bug fix update

2024-04-3011:38:49
access.redhat.com
14
skopeo
security fix
bug fix
image registry
inspection
golang-protobuf
jose-go
cve-2024-24786

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

7.4 High

AI Score

Confidence

Low

0.0005 Low

EPSS

Percentile

17.1%

JSON

The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files.

Security Fix(es):

  • golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON (CVE-2024-24786)

Bug Fix(es):

  • TRIAGE CVE-2024-24786 skopeo: golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON [rhel-9] - RHEL 9.4 0day (JIRA:RHEL-28235)

  • skopeo: jose-go: improper handling of highly compressed data [rhel-9] (JIRA:RHEL-28736)

OSVersionArchitecturePackageVersionFilename
RedHat9x86_64skopeo-debuginfo< 1.14.3-2.el9_4skopeo-debuginfo-1.14.3-2.el9_4.x86_64.rpm
RedHat9s390xskopeo-debuginfo< 1.14.3-2.el9_4skopeo-debuginfo-1.14.3-2.el9_4.s390x.rpm
RedHat9s390xskopeo-debugsource< 1.14.3-2.el9_4skopeo-debugsource-1.14.3-2.el9_4.s390x.rpm
RedHat9x86_64skopeo-debugsource< 1.14.3-2.el9_4skopeo-debugsource-1.14.3-2.el9_4.x86_64.rpm
RedHat9ppc64leskopeo-debuginfo< 1.14.3-2.el9_4skopeo-debuginfo-1.14.3-2.el9_4.ppc64le.rpm
RedHat9ppc64leskopeo-debugsource< 1.14.3-2.el9_4skopeo-debugsource-1.14.3-2.el9_4.ppc64le.rpm
RedHat9x86_64skopeo-tests< 1.14.3-2.el9_4skopeo-tests-1.14.3-2.el9_4.x86_64.rpm
RedHat9s390xskopeo-tests< 1.14.3-2.el9_4skopeo-tests-1.14.3-2.el9_4.s390x.rpm
RedHat9aarch64skopeo< 1.14.3-2.el9_4skopeo-1.14.3-2.el9_4.aarch64.rpm
RedHat9ppc64leskopeo< 1.14.3-2.el9_4skopeo-1.14.3-2.el9_4.ppc64le.rpm
Rows per page:
1-10 of 161

Related

osv 24
oraclelinux 8
nessus 60
rocky 4
redhat 21
cbl_mariner 20
fedora 10
almalinux 6
openvas 16
ubuntu 2
github 2
cvelist 2
redhatcve 2
cve 2
prion 2
debiancve 2
alpinelinux 2
ubuntucve 2
nvd 2
vulnrichment 1
veracode 2
cgr 2
wolfi 2
redos 1
amazon 2
osv
osv
Moderate: skopeo security and bug fix update
2024-04-30 00:00:00
Moderate: skopeo security and bug fix update
2024-05-10 14:32:42
Important: container-tools:rhel8 security update
2024-06-14 13:59:30
oraclelinux
oraclelinux
skopeo security and bug fix update
2024-05-07 00:00:00
container-tools:ol8 security update
2024-05-29 00:00:00
container-tools security update
2024-07-03 00:00:00
nessus
nessus
RHEL 8 / 9 : OpenShift Container Platform 4.13.38 (RHSA-2024:1456)
2024-03-27 00:00:00
Rocky Linux 9 : skopeo (RLSA-2024:2549)
2024-05-14 00:00:00
Oracle Linux 9 : skopeo (ELSA-2024-2549)
2024-05-07 00:00:00
rocky
rocky
skopeo security and bug fix update
2024-05-10 14:32:42
container-tools:rhel8 security update
2024-06-14 13:59:30
buildah bug fix update
2024-05-10 14:32:42
redhat
redhat
(RHSA-2024:1456) Moderate: OpenShift Container Platform 4.13.38 packages and security update
2024-03-27 00:33:06
(RHSA-2024:1574) Important: OpenShift Container Platform 4.12.54 packages and security update
2024-04-03 07:03:16
(RHSA-2024:1563) Important: OpenShift Container Platform 4.15.6 packages and security update
2024-04-02 21:28:17
cbl_mariner
cbl_mariner
CVE-2024-28180 affecting package cri-o for versions less than 1.30.1-1
2024-06-21 09:32:44
CVE-2024-24786 affecting package cri-o for versions less than 1.30.1-1
2024-06-21 09:32:44
CVE-2024-24786 affecting package kata-containers for versions less than 3.2.0.azl2-1
2024-06-12 22:23:00
fedora
fedora
[SECURITY] Fedora 39 Update: prometheus-podman-exporter-1.11.0-1.fc39
2024-03-31 01:13:46
[SECURITY] Fedora 38 Update: kubernetes-1.26.15-1.fc38
2024-03-24 01:36:01
[SECURITY] Fedora 40 Update: prometheus-podman-exporter-1.11.0-1.fc40
2024-03-31 00:18:41
almalinux
almalinux
Important: container-tools:rhel8 security update
2024-05-22 00:00:00
Moderate: buildah bug fix update
2024-04-30 00:00:00
Moderate: container-tools security update
2024-07-02 00:00:00
openvas
openvas
Ubuntu: Security Advisory (USN-6746-1)
2024-04-24 00:00:00
Ubuntu: Security Advisory (USN-6746-2)
2024-06-26 00:00:00
Fedora: Security Advisory for prometheus-podman-exporter (FEDORA-2024-45f0a1df95)
2024-04-03 00:00:00
ubuntu
ubuntu
Google Guest Agent and Google OS Config Agent vulnerability
2024-06-25 00:00:00
Google Guest Agent and Google OS Config Agent vulnerability
2024-04-23 00:00:00
github
github
Golang protojson.Unmarshal function infinite loop when unmarshaling certain forms of invalid JSON
2024-03-06 00:31:27
Go JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification)
2024-03-07 22:54:44
cvelist
cvelist
CVE-2024-24786 Infinite loop in JSON unmarshaling in google.golang.org/protobuf
2024-03-05 22:22:35
CVE-2024-28180 Go JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification)
2024-03-09 00:54:46
redhatcve
redhatcve
CVE-2024-24786
2024-03-06 07:12:54
CVE-2024-28180
2024-03-10 20:42:26
cve
cve
CVE-2024-24786
2024-03-05 23:15:07
CVE-2024-28180
2024-03-09 01:15:07
prion
prion
Code injection
2024-03-09 01:15:00
Design/Logic Flaw
2024-03-05 23:15:00
debiancve
debiancve
CVE-2024-28180
2024-03-09 01:15:07
CVE-2024-24786
2024-03-05 23:15:07
alpinelinux
alpinelinux
CVE-2024-28180
2024-03-09 01:15:07
CVE-2024-24786
2024-03-05 23:15:07
ubuntucve
ubuntucve
CVE-2024-28180
2024-03-09 00:00:00
CVE-2024-24786
2024-03-05 00:00:00
nvd
nvd
CVE-2024-24786
2024-03-05 23:15:07
CVE-2024-28180
2024-03-09 01:15:07
vulnrichment
vulnrichment
CVE-2024-24786 Infinite loop in JSON unmarshaling in google.golang.org/protobuf
2024-03-05 22:22:35
veracode
veracode
Infinite Loop
2024-04-02 06:02:07
Data Amplification
2024-03-08 10:52:31
cgr
cgr
CVE-2024-28180 vulnerabilities
2024-05-19 03:07:16
CVE-2024-24786 vulnerabilities
2024-05-19 03:07:16
wolfi
wolfi
CVE-2024-28180 vulnerabilities
2024-07-05 21:08:40
CVE-2024-24786 vulnerabilities
2024-07-05 21:08:40
redos
redos
ROS-20240522-06
2024-05-22 00:00:00
amazon
amazon
Medium: amazon-cloudwatch-agent
2024-05-23 22:04:00
Medium: cri-tools
2024-06-06 20:17:00

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

7.4 High

AI Score

Confidence

Low

0.0005 Low

EPSS

Percentile

17.1%

JSON
Related for RHSA-2024:2549
osv24oraclelinux8nessus60rocky4redhat21cbl_mariner20fedora10almalinux6openvas16ubuntu2github2cvelist2redhatcve2cve2prion2debiancve2alpinelinux2ubuntucve2nvd2vulnrichment1veracode2cgr2wolfi2redos1amazon2