Affected: AlmaLinux:9: toolbox, AlmaLinux:9: toolbox-tests

Toolbox is a tool for Linux operating systems, which allows the use of containerized command line environments. It is built on top of Podman and other standard container technologies from OCI.

Security Fix(es):

* go-yaml: Improve heuristics preventing CPU/memory abuse by parsing malicious or large YAML documents (CVE-2022-3064) * golang: html/template: improper handling of JavaScript whitespace (CVE-2023-24540) * net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding (CVE-2022-41723) * golang: net/http, mime/multipart: denial of service from excessive resource consumption (CVE-2022-41725) * golang: net/http, net/textproto: denial of service from excessive memory allocation (CVE-2023-24534) * golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption (CVE-2023-24536) * golang: html/template: backticks not treated as string delimiters (CVE-2023-24538) * golang: html/template: improper sanitization of CSS values (CVE-2023-24539) * golang: html/template: improper handling of empty HTML attributes (CVE-2023-29400) * golang: net/http: insufficient sanitization of Host header (CVE-2023-29406)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References se…

Withdrawn by the publisher.

Affected: CleanStart: cluster-proportional-autoscaler

Package cluster-proportional-autoscaler version 1.7.1-r0 fixes 7 vulnerabilities: CVE-2021-3121, CVE-2022-3064, CVE-2020-8559, CVE-2019-11254, CVE-2019-11250...

Parsing malicious or large YAML documents can consume excessive amounts of CPU or memory.

Affected: Go: gopkg.in/yaml.v2

Parsing malicious or large YAML documents can consume excessive amounts of CPU or memory

Affected: openEuler:20.03-LTS-SP4: etcd

%{expand: Security Fix(es):

Authentication vulnerability found in Etcd-io v.3.4.10 allows remote attackers to escalate privileges via the debug function.(CVE-2021-28235)

Parsing malicious or large YAML documents can consume excessive amounts of CPU or memory.(CVE-2022-3064)

Etcd v3.5.4 allows remote attackers to cause a denial of service via function PageWriter.write in pagewriter.go. NOTE: the vendor's position is that this is not a vulnerability.(CVE-2022-34038)

A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.(CVE-2022-41723)

etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.4.26 and 3.5.9, the LeaseTimeToLive API allows access to key names (not value) associated to a lease when `Keys` parameter is true, even a user doesn't have read permission to the keys. The impact is limited to a cluster which enables auth (RBAC). Versions 3.4.26 and 3.5.9 fix this issue. There are no known workarounds.(CVE-2023-32082)

go-yaml: Improve heuristics preventing CPU/memory abuse by parsing malicious or large YAML documents

Affected: Ubuntu:Pro:16.04:LTS: golang-yaml.v2, Ubuntu:Pro:18.04:LTS: golang-yaml.v2, Ubuntu:Pro:18.04:LTS: singularity-container, Ubuntu:18.04:LTS: webhook, Ubuntu:20.04:LTS: golang-yaml.v2, Ubuntu:20.04:LTS: golang-github-coreos-discovery-etcd-io, Ubuntu:20.04:LTS: webhook, Ubuntu:22.04:LTS: golang-github-coreos-discovery-etcd-io, Ubuntu:22.04:LTS: webhook, Ubuntu:24.04:LTS: golang-github-coreos-discovery-etcd-io and 8 more

Parsing malicious or large YAML documents can consume excessive amounts of CPU or memory.

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Red Hat OpenShift ausnutzen, um einen Denial of Service Angriff durchzuführen.