ALSA-2023:6938
- Source
- https://errata.almalinux.org/8/ALSA-2023-6938.html
- Import Source
- https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2023:6938.json
- Related
- Published
- 2023-11-14T00:00:00Z
- Modified
- 2023-11-24T13:34:19Z
- Details
-
The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.
Security Fix(es):
- go-yaml: Improve heuristics preventing CPU/memory abuse by parsing malicious or large YAML documents (CVE-2022-3064)
- golang: html/template: improper handling of JavaScript whitespace (CVE-2023-24540)
- net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding (CVE-2022-41723)
- golang: crypto/tls: large handshake records may cause panics (CVE-2022-41724)
- golang: net/http, mime/multipart: denial of service from excessive resource consumption (CVE-2022-41725)
- golang.org/x/net/html: Cross site scripting (CVE-2023-3978)
- golang: net/http, net/textproto: denial of service from excessive memory allocation (CVE-2023-24534)
- golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption (CVE-2023-24536)
- golang: go/parser: Infinite loop in parsing (CVE-2023-24537)
- golang: html/template: backticks not treated as string delimiters (CVE-2023-24538)
- golang: html/template: improper sanitization of CSS values (CVE-2023-24539)
- runc: Rootless runc makes
/sys/fs/cgroupwritable (CVE-2023-25809) - runc: volume mount race condition (regression of CVE-2019-19921) (CVE-2023-27561)
- runc: AppArmor can be bypassed when
/procinside the container is symlinked with a specific mount configuration (CVE-2023-28642) - golang: html/template: improper handling of empty HTML attributes (CVE-2023-29400)
- golang: net/http: insufficient sanitization of Host header (CVE-2023-29406)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
- References
-
- https://access.redhat.com/errata/RHSA-2023:6938
- https://access.redhat.com/security/cve/CVE-2022-3064
- https://access.redhat.com/security/cve/CVE-2022-41723
- https://access.redhat.com/security/cve/CVE-2022-41724
- https://access.redhat.com/security/cve/CVE-2022-41725
- https://access.redhat.com/security/cve/CVE-2023-24534
- https://access.redhat.com/security/cve/CVE-2023-24536
- https://access.redhat.com/security/cve/CVE-2023-24537
- https://access.redhat.com/security/cve/CVE-2023-24538
- https://access.redhat.com/security/cve/CVE-2023-24539
- https://access.redhat.com/security/cve/CVE-2023-24540
- https://access.redhat.com/security/cve/CVE-2023-25809
- https://access.redhat.com/security/cve/CVE-2023-27561
- https://access.redhat.com/security/cve/CVE-2023-28642
- https://access.redhat.com/security/cve/CVE-2023-29400
- https://access.redhat.com/security/cve/CVE-2023-29406
- https://access.redhat.com/security/cve/CVE-2023-3978
- https://bugzilla.redhat.com/2163037
- https://bugzilla.redhat.com/2175721
- https://bugzilla.redhat.com/2178358
- https://bugzilla.redhat.com/2178488
- https://bugzilla.redhat.com/2178492
- https://bugzilla.redhat.com/2182883
- https://bugzilla.redhat.com/2182884
- https://bugzilla.redhat.com/2184481
- https://bugzilla.redhat.com/2184482
- https://bugzilla.redhat.com/2184483
- https://bugzilla.redhat.com/2184484
- https://bugzilla.redhat.com/2196026
- https://bugzilla.redhat.com/2196027
- https://bugzilla.redhat.com/2196029
- https://bugzilla.redhat.com/2222167
- https://bugzilla.redhat.com/2228689
- https://errata.almalinux.org/8/ALSA-2023-6938.html
Affected packages
AlmaLinux:8 / aardvark-dns
Package
- Name
- aardvark-dns
AlmaLinux:8 / buildah
Package
- Name
- buildah
AlmaLinux:8 / buildah-tests
Package
- Name
- buildah-tests
AlmaLinux:8 / cockpit-podman
Package
- Name
- cockpit-podman
AlmaLinux:8 / conmon
Package
- Name
- conmon
AlmaLinux:8 / container-selinux
Package
- Name
- container-selinux
AlmaLinux:8 / containernetworking-plugins
Package
- Name
- containernetworking-plugins
AlmaLinux:8 / containers-common
Package
- Name
- containers-common
AlmaLinux:8 / crit
Package
- Name
- crit
AlmaLinux:8 / crit
Package
- Name
- crit
AlmaLinux:8 / criu
Package
- Name
- criu
AlmaLinux:8 / criu
Package
- Name
- criu
AlmaLinux:8 / criu-devel
Package
- Name
- criu-devel
AlmaLinux:8 / criu-devel
Package
- Name
- criu-devel
AlmaLinux:8 / criu-libs
Package
- Name
- criu-libs
AlmaLinux:8 / criu-libs
Package
- Name
- criu-libs
AlmaLinux:8 / crun
Package
- Name
- crun
AlmaLinux:8 / fuse-overlayfs
Package
- Name
- fuse-overlayfs
AlmaLinux:8 / libslirp
Package
- Name
- libslirp
AlmaLinux:8 / libslirp
Package
- Name
- libslirp
AlmaLinux:8 / libslirp-devel
Package
- Name
- libslirp-devel
AlmaLinux:8 / libslirp-devel
Package
- Name
- libslirp-devel
AlmaLinux:8 / netavark
Package
- Name
- netavark
AlmaLinux:8 / oci-seccomp-bpf-hook
Package
- Name
- oci-seccomp-bpf-hook
AlmaLinux:8 / podman
Package
- Name
- podman
AlmaLinux:8 / podman-catatonit
Package
- Name
- podman-catatonit
AlmaLinux:8 / podman-docker
Package
- Name
- podman-docker
AlmaLinux:8 / podman-gvproxy
Package
- Name
- podman-gvproxy
AlmaLinux:8 / podman-plugins
Package
- Name
- podman-plugins
AlmaLinux:8 / podman-remote
Package
- Name
- podman-remote
AlmaLinux:8 / podman-tests
Package
- Name
- podman-tests
AlmaLinux:8 / python3-criu
Package
- Name
- python3-criu
AlmaLinux:8 / python3-criu
Package
- Name
- python3-criu
AlmaLinux:8 / python3-podman
Package
- Name
- python3-podman
AlmaLinux:8 / runc
Package
- Name
- runc
AlmaLinux:8 / skopeo
Package
- Name
- skopeo
AlmaLinux:8 / skopeo-tests
Package
- Name
- skopeo-tests
AlmaLinux:8 / slirp4netns
Package
- Name
- slirp4netns
AlmaLinux:8 / toolbox
Package
- Name
- toolbox
AlmaLinux:8 / toolbox-tests
Package
- Name
- toolbox-tests