Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

rocky логотип

RLSA-2023:7202

Опубликовано: 28 нояб. 2023
Источник: rocky
Оценка: Moderate

Описание

Moderate: container-tools:4.0 security and bug fix update

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

  • golang: net/http: insufficient sanitization of Host header (CVE-2023-29406)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

  • could not find symbol criu_set_lsm_mount_context in libcriu.so (BZ#2242871)

Затронутые продукты

  • Rocky Linux 8

НаименованиеАрхитектураРелизRPM
aardvark-dnsx86_6438.module+el8.9.0+1445+07728297aardvark-dns-1.0.1-38.module+el8.9.0+1445+07728297.x86_64.rpm
buildahx86_647.module+el8.9.0+1445+07728297buildah-1.24.6-7.module+el8.9.0+1445+07728297.x86_64.rpm
buildah-testsx86_647.module+el8.9.0+1445+07728297buildah-tests-1.24.6-7.module+el8.9.0+1445+07728297.x86_64.rpm
cockpit-podmannoarch1.module+el8.9.0+1445+07728297cockpit-podman-46-1.module+el8.9.0+1445+07728297.noarch.rpm
cockpit-podmannoarch1.module+el8.9.0+1445+07728297cockpit-podman-46-1.module+el8.9.0+1445+07728297.noarch.rpm
conmonx86_642.module+el8.9.0+1445+07728297conmon-2.1.4-2.module+el8.9.0+1445+07728297.x86_64.rpm
containernetworking-pluginsx86_645.module+el8.9.0+1445+07728297containernetworking-plugins-1.1.1-5.module+el8.9.0+1445+07728297.x86_64.rpm
containers-commonx86_6438.module+el8.9.0+1445+07728297containers-common-1-38.module+el8.9.0+1445+07728297.x86_64.rpm
container-selinuxnoarch3.module+el8.9.0+1445+07728297container-selinux-2.205.0-3.module+el8.9.0+1445+07728297.noarch.rpm
container-selinuxnoarch3.module+el8.9.0+1445+07728297container-selinux-2.205.0-3.module+el8.9.0+1445+07728297.noarch.rpm

Показывать по

Связанные CVE

CVE-2023-29406

Ссылки на источники

Исправления

Связанные уязвимости

ubuntu логотип

CVE-2023-29406

CVSS3: 6.5
ubuntu
больше 2 лет назад

The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send requests containing an invalid Request.Host or Request.URL.Host value.

redhat логотип

CVE-2023-29406

CVSS3: 6.5
redhat
больше 2 лет назад

The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send requests containing an invalid Request.Host or Request.URL.Host value.

nvd логотип

CVE-2023-29406

CVSS3: 6.5
nvd
больше 2 лет назад

The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers or entire requests. With fix, the HTTP/1 client now refuses to send requests containing an invalid Request.Host or Request.URL.Host value.

msrc логотип

CVE-2023-29406

CVSS3: 6.5
msrc
3 месяца назад

Insufficient sanitization of Host header in net/http

debian логотип

CVE-2023-29406

CVSS3: 6.5
debian
больше 2 лет назад

The HTTP/1 client does not fully validate the contents of the Host hea ...