Most recent entries from all

ALSA-2022:7469 — Moderate: container-tools:4.0 security and bug fix update

Affected: AlmaLinux:8: aardvark-dns, AlmaLinux:8: buildah, AlmaLinux:8: buildah-tests, AlmaLinux:8: cockpit-podman, AlmaLinux:8: conmon, AlmaLinux:8: container-selinux, AlmaLinux:8: containernetworking-plugins, AlmaLinux:8: containers-common, AlmaLinux:8: crit, AlmaLinux:8: criu and 24 more

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

* cri-o: memory exhaustion on the node when access to the kube api (CVE-2022-1708) * golang: crash in a golang.org/x/crypto/ssh server (CVE-2022-27191) * runc: incorrect handling of inheritable capabilities (CVE-2022-29162)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

bdu:2023-05840

certfr-2022-avi-591 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan…

certfr-2022-avi-591

CLEANSTART-2025-ZQ12729 — golang

Affected: CleanStart: coredns

Security vulnerability affects the coredns package. The golang.

EUVD-2026-15199

fkie_cve-2022-27191

The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey.

GHSA-8c26-wmh5-6g9v — golang.org/x/crypto/ssh Denial of service via crafted Signer

Affected: Go: golang.org/x/crypto

The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey.

gsd-2022-27191

openSUSE-SU-2024:0319-1 — Security update for coredns

Security update for coredns

RHSA-2022:1476 — Red Hat Security Advisory: Red Hat Advanced Cluster Management 2.4.3 security updates and bug fixes

cached-path-relative: Prototype Pollution via the cache variable nanoid: Information disclosure via valueOf() function opencontainers: OCI manifest and index parsing confusion golang.org/x/crypto: empty plaintext packet causes panic nodejs-shelljs: improper privilege management follow-redirects: Exposure of Private Personal Information to an Unauthorized Actor node-fetch: exposure of sensitive information to an unauthorized actor follow-redirects: Exposure of Sensitive Information via Authorization Header leak openssl: Infinite loop in BN_mod_sqrt() reachable when parsing certificates nats-server: misusing the "dynamically provisioned sandbox accounts" feature authenticated user can obtain the privileges of the System account imgcrypt: Unauthorized access to encryted container image on a shared system due to missing check in CheckAuthorization() code path golang: crash in a golang.org/x/crypto/ssh server

SUSE-EL-9-CLIENT-TOOLS-2023-2185 — Security update for SUSE Manager Client Tools

Security update for SUSE Manager Client Tools

UBUNTU-CVE-2022-27191

Affected: Ubuntu:Pro:16.04:LTS: golang-go.crypto, Ubuntu:Pro:18.04:LTS: golang-go.crypto, Ubuntu:Pro:20.04:LTS: golang-go.crypto, Ubuntu:Pro:22.04:LTS: golang-go.crypto, Ubuntu:Pro:24.04:LTS: golang-go.crypto, Ubuntu:25.10: golang-go.crypto, Ubuntu:Pro:26.04:LTS: golang-go.crypto

The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey.

WID-SEC-W-2022-0461 — CoreDNS: Mehrere Schwachstellen ermöglichen Denial of Service

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in CoreDNS ausnutzen, um einen Denial of Service Angriff durchzuführen.