Before Go 1.20, the RSA based TLS key exchanges used the math/big library, which is not constant time. RSA blinding was applied to prevent timing attacks, but analysis shows this may not have been fully effective. In particular it appears as if the removal of PKCS#1 padding may leak timing information, which in turn could be used to recover session key bits. In Go 1.20, the crypto/tls library switched to a fully constant time RSA implementation, which we do not believe exhibits any timing side channels.

ELSA-2024-2239: skopeo security update (MODERATE)

ALT-PU-2023-8671: package `golang` update to version 1.20.2-alt1

Security update for runc

Security update for runc

Security update for runc

Security update for runc

Important: container-tools:rhel8 security update

runc vulnerable to container breakout through process.cwd trickery and leaked fds

ELSA-2024-17931: runc security update (IMPORTANT)

ELSA-2024-12148: runc security update (IMPORTANT)

ELSA-2024-0752: container-tools:ol8 security update (IMPORTANT)

ELSA-2024-0670: runc security update (IMPORTANT)

Уязвимость инструмента для запуска изолированных контейнеров Runc связана с недостатками разграничений контролируемой области системы, позволяющая нарушителю выполнить произвольный код

Множественные уязвимости golang

ALT-PU-2023-7813: package `golang` update to version 1.21.5-alt1

ALT-PU-2023-7811: package `golang` update to version 1.20.12-alt1

ALT-PU-2023-8672: package `golang` update to version 1.21.0-alt1

Security update for crun

Уязвимость runc