RLSA-2024:5258

Описание

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

• golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads (CVE-2024-1394)

• golang: net/http: memory exhaustion in Request.ParseMultipartForm (CVE-2023-45290)

• golang: crypto/x509: Verify panics on certificates with an unknown public key algorithm (CVE-2024-24783)

• golang: net/mail: comments in display names are incorrectly handled (CVE-2024-24784)

• containers/image: digest type does not guarantee valid type (CVE-2024-3727)

• golang: archive/zip: Incorrect handling of certain ZIP files (CVE-2024-24789)

• go-retryablehttp: url might write sensitive information to log file (CVE-2024-6104)

• gorilla/schema: Potential memory exhaustion attack due to sparse slice deserialization (CVE-2024-37298)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.