Поиск уязвимостей

An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request's headers exceed MaxHeaderBytes, no memory is allocated to store the excess headers, but they are still parsed. This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the receiver to decode than for an attacker to send. The fix sets a limit on the amount of excess header frames we will process before closing a connection.

An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of ...

Moderate: container-tools security update

Moderate: buildah bug fix update

Golang protojson.Unmarshal function infinite loop when unmarshaling certain forms of invalid JSON

ELSA-2024-4246: container-tools security update (MODERATE)

ELSA-2024-2550: buildah bug fix update (MODERATE)

Уязвимость функции protojson.Unmarshal() пакета golang-google-protobuf языка программирования Golang, связанная с циклом с недостижимым условием выхода, позволяющая нарушителю вызвать отказ в обслуживании

Security update for buildah

Security update for ignition

Security update for kubernetes1.26

Security update for containerd

Security update for go1.21

Security update for go1.22

Security update for go1.21

Security update for go1.22

Important: git-lfs security update

Important: go-toolset:rhel8 security update

net/http, x/net/http2: close connections when receiving too many headers