Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2024:2754-1

Опубликовано: 05 авг. 2024
Источник: suse-cvrf

Описание

Security update for skopeo

This update for skopeo fixes the following issues:

Update to version 1.14.4:

  • CVE-2024-3727: Fixed a vulnerability that allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, resource exhaustion, local path traversal and other attacks. (bsc#1224123)

Список пакетов

Container suse/sle15:15.2
libgpg-error0-1.29-150000.3.3.1
SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS
libgpg-error-devel-1.29-150000.3.3.1
libgpg-error0-1.29-150000.3.3.1
libgpg-error0-32bit-1.29-150000.3.3.1
skopeo-1.14.4-150000.4.26.1
SUSE Linux Enterprise Server 15 SP2-LTSS
libgpg-error-devel-1.29-150000.3.3.1
libgpg-error0-1.29-150000.3.3.1
libgpg-error0-32bit-1.29-150000.3.3.1
skopeo-1.14.4-150000.4.26.1
SUSE Linux Enterprise Server for SAP Applications 15 SP2
libgpg-error-devel-1.29-150000.3.3.1
libgpg-error0-1.29-150000.3.3.1
libgpg-error0-32bit-1.29-150000.3.3.1
skopeo-1.14.4-150000.4.26.1

Ссылки

Описание

Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3.

Затронутые продукты
Container suse/sle15:15.2:libgpg-error0-1.29-150000.3.3.1
SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:libgpg-error-devel-1.29-150000.3.3.1
SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:libgpg-error0-1.29-150000.3.3.1
SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:libgpg-error0-32bit-1.29-150000.3.3.1
Ссылки
Уязвимость SUSE-SU-2024:2754-1