Most recent entries from all

ALSA-2024:5258 — Important: container-tools:rhel8 security update

Affected: AlmaLinux:8: aardvark-dns, AlmaLinux:8: buildah, AlmaLinux:8: buildah-tests, AlmaLinux:8: cockpit-podman, AlmaLinux:8: conmon, AlmaLinux:8: container-selinux, AlmaLinux:8: containernetworking-plugins, AlmaLinux:8: containers-common, AlmaLinux:8: crit, AlmaLinux:8: criu and 24 more

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

* golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads (CVE-2024-1394) * golang: net/http: memory exhaustion in Request.ParseMultipartForm (CVE-2023-45290) * golang: crypto/x509: Verify panics on certificates with an unknown public key algorithm (CVE-2024-24783) * golang: net/mail: comments in display names are incorrectly handled (CVE-2024-24784) * containers/image: digest type does not guarantee valid type (CVE-2024-3727) * golang: archive/zip: Incorrect handling of certain ZIP files (CVE-2024-24789) * go-retryablehttp: url might write sensitive information to log file (CVE-2024-6104) * gorilla/schema: Potential memory exhaustion attack due to sparse slice deserialization (CVE-2024-37298)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2024-05780

BELL-CVE-2024-3727

Affected: Alpaquita:23: buildah, Alpaquita:23: podman, Alpaquita:stream: buildah, Alpaquita:stream: podman, Alpaquita:stream: skopeo

certfr-2024-avi-0841 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan…

certfr-2024-avi-0841

CLEANSTART-2024-VD14033 — flaw was found in the github

Affected: CleanStart: buildah

Security vulnerability affects the buildah package. A flaw was found in the github.

EUVD-2026-372468

fkie_cve-2024-3727

A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks.

GHSA-6wvf-f2vw-3425 — github.com/containers/image allows unexpected authenticated registry accesses

Affected: Go: github.com/containers/image, Go: github.com/containers/image/v5

gsd-2024-3727

msrc_CVE-2024-3727 — Containers/image: digest type does not guarantee valid type

msrc_CVE-2024-3727

OESA-2025-2221 — skopeo security update

Affected: openEuler:24.03-LTS-SP2: skopeo

A command line utility that performs various operations on container images and image repositories Security Fix(es):

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE input, Go JOSE could use excessive memory. The code used strings.Split(token, ".") to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of `.` characters. An attacker could exploit this by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service. Version 4.0.5 fixes this issue. As a workaround, applications could pre-validate that payloads passed to Go JOSE do not contain an excessive number of `.` characters.(CVE-2025-27144)

Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that ma…

openSUSE-SU-2024:0244-1 — Security update for apptainer

Security update for apptainer

RHSA-2024:0045 — Red Hat Security Advisory: OpenShift Container Platform 4.16.0 security update

dnspython: denial of service in stub resolver golang: net/http/cookiejar: incorrect forwarding of sensitive headers and cookies on HTTP redirect golang: net/http: golang: mime/multipart: golang: net/textproto: memory exhaustion in Request.ParseMultipartForm containers/image: digest type does not guarantee valid type golang: crypto/x509: Verify panics on certificates with an unknown public key algorithm golang: net/mail: comments in display names are incorrectly handled golang: html/template: errors returned from MarshalJSON methods may break template escaping golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON jose: resource exhaustion

SUSE-SU-2024:1838-1 — Security update for warewulf4

Security update for warewulf4

UBUNTU-CVE-2024-3727

Affected: Ubuntu:18.04:LTS: golang-github-opencontainers-go-digest, Ubuntu:20.04:LTS: golang-github-opencontainers-go-digest, Ubuntu:22.04:LTS: golang-github-opencontainers-go-digest, Ubuntu:24.04:LTS: golang-github-opencontainers-go-digest, Ubuntu:25.10: golang-github-opencontainers-go-digest, Ubuntu:26.04:LTS: golang-github-opencontainers-go-digest

WID-SEC-W-2024-1474 — Red Hat OpenShift Container Platform: Mehrere Schwachstellen

Ein entfernter, anonymer oder lokaler Angreifer kann mehrere Schwachstellen in Red Hat OpenShift ausnutzen, um einen Denial-of-Service-Zustand zu erzeugen, vertrauliche Informationen offenzulegen oder Daten zu manipulieren.