RHSA-2024:5258 — Security Advisory

An update for the container-tools:rhel8 module is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

• golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads (CVE-2024-1394)

• golang: net/http: memory exhaustion in Request.ParseMultipartForm (CVE-2023-45290)

• golang: crypto/x509: Verify panics on certificates with an unknown public key algorithm (CVE-2024-24783)

• golang: net/mail: comments in display names are incorrectly handled (CVE-2024-24784)

• containers/image: digest type does not guarantee valid type (CVE-2024-3727)

• golang: archive/zip: Incorrect handling of certain ZIP files (CVE-2024-24789)

• go-retryablehttp: url might write sensitive information to log file (CVE-2024-6104)

• gorilla/schema: Potential memory exhaustion attack due to sparse slice deserialization (CVE-2024-37298)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.