https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 16:53:24 +0000 https://cve.radiocsirt.org/vuln/alsa-2024:5258 <p><strong>Affected:</strong> AlmaLinux:8: aardvark-dns, AlmaLinux:8: buildah, AlmaLinux:8: buildah-tests, AlmaLinux:8: cockpit-podman, AlmaLinux:8: conmon, AlmaLinux:8: container-selinux, AlmaLinux:8: containernetworking-plugins, AlmaLinux:8: containers-common, AlmaLinux:8: crit, AlmaLinux:8: criu and 24 more</p> <p>The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.</p> <p>Security Fix(es):</p> <p>* golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads (CVE-2024-1394) * golang: net/http: memory exhaustion in Request.ParseMultipartForm (CVE-2023-45290) * golang: crypto/x509: Verify panics on certificates with an unknown public key algorithm (CVE-2024-24783) * golang: net/mail: comments in display names are incorrectly handled (CVE-2024-24784) * containers/image: digest type does not guarantee valid type (CVE-2024-3727) * golang: archive/zip: Incorrect handling of certain ZIP files (CVE-2024-24789) * go-retryablehttp: url might write sensitive information to log file (CVE-2024-6104) * gorilla/schema: Potential memory exhaustion attack due to sparse slice deserialization (CVE-2024-37298)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p><strong>Affected:</strong> AlmaLinux:8: aardvark-dns, AlmaLinux:8: buildah, AlmaLinux:8: buildah-tests, AlmaLinux:8: cockpit-podman, AlmaLinux:8: conmon, AlmaLinux:8: container-selinux, AlmaLinux:8: containernetworking-plugins, AlmaLinux:8: containers-common, AlmaLinux:8: crit, AlmaLinux:8: criu and 24 more</p> <p>The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.</p> <p>Security Fix(es):</p> <p>* golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads (CVE-2024-1394) * golang: net/http: memory exhaustion in Request.ParseMultipartForm (CVE-2023-45290) * golang: crypto/x509: Verify panics on certificates with an unknown public key algorithm (CVE-2024-24783) * golang: net/mail: comments in display names are incorrectly handled (CVE-2024-24784) * containers/image: digest type does not guarantee valid type (CVE-2024-3727) * golang: archive/zip: Incorrect handling of certain ZIP files (CVE-2024-24789) * go-retryablehttp: url might write sensitive information to log file (CVE-2024-6104) * gorilla/schema: Potential memory exhaustion attack due to sparse slice deserialization (CVE-2024-37298)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> https://cve.radiocsirt.org/vuln/alsa-2024:5258 https://cve.radiocsirt.org/vuln/bdu:2024-06681 bdu:2024-06681 https://cve.radiocsirt.org/vuln/bdu:2024-06681 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0622 certfr-2025-avi-0622 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0622 https://cve.radiocsirt.org/vuln/cleanstart-2026-gg94489 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: prometheus</p> <p>Multiple security vulnerabilities affect the prometheus package. go-retryablehttp prior to 0. See references for individual vulnerability details.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: prometheus</p> <p>Multiple security vulnerabilities affect the prometheus package. go-retryablehttp prior to 0. See references for individual vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-gg94489 https://cve.radiocsirt.org/vuln/euvd-2026-3250 EUVD-2026-3250 https://cve.radiocsirt.org/vuln/euvd-2026-3250 https://cve.radiocsirt.org/vuln/fkie_cve-2024-6104 <p>go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability, CVE-2024-6104, was fixed in go-retryablehttp 0.7.7.</p> <p>go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability, CVE-2024-6104, was fixed in go-retryablehttp 0.7.7.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2024-6104 https://cve.radiocsirt.org/vuln/ghsa-v6v8-xj6m-xwqh <p><strong>Affected:</strong> Go: github.com/hashicorp/go-retryablehttp</p> <p>go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability, CVE-2024-6104, was fixed in go-retryablehttp 0.7.7.</p> <p><strong>Affected:</strong> Go: github.com/hashicorp/go-retryablehttp</p> <p>go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability, CVE-2024-6104, was fixed in go-retryablehttp 0.7.7.</p> https://cve.radiocsirt.org/vuln/ghsa-v6v8-xj6m-xwqh https://cve.radiocsirt.org/vuln/msrc_cve-2024-6104 msrc_CVE-2024-6104 https://cve.radiocsirt.org/vuln/msrc_cve-2024-6104 https://cve.radiocsirt.org/vuln/oesa-2025-1053 <p><strong>Affected:</strong> openEuler:24.03-LTS: podman</p> <p>Podman manages the entire container ecosystem which includes pods, containers, container images, and container volumes using the libpod library. Security Fix(es): Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both.(CVE-2019-9514) Uncontrolled recursion in the Parse functions in go/parser before Go 1.17.12 and Go 1.18.4 allow an attacker to cause a panic due to stack exhaustion via deeply nested types or declarations.(CVE-2022-1962) Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy forwards a parameter with an unparsable value. After fix, ReverseProxy sanitizes the query parameters in the forwarded query when the outbound request&amp;apos;s Form field is set after the ReverseProxy. Director function returns, indicating that the proxy has parsed the query parameters. Proxies which do not parse query parameters continue to forward the original query parameters unchanged.(CVE-2022-2880) A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go before 1.17.13 and 1.18.5, p…</p> <p><strong>Affected:</strong> openEuler:24.03-LTS: podman</p> <p>Podman manages the entire container ecosystem which includes pods, containers, container images, and container volumes using the libpod library. Security Fix(es): Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both.(CVE-2019-9514) Uncontrolled recursion in the Parse functions in go/parser before Go 1.17.12 and Go 1.18.4 allow an attacker to cause a panic due to stack exhaustion via deeply nested types or declarations.(CVE-2022-1962) Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy forwards a parameter with an unparsable value. After fix, ReverseProxy sanitizes the query parameters in the forwarded query when the outbound request&amp;apos;s Form field is set after the ReverseProxy. Director function returns, indicating that the proxy has parsed the query parameters. Proxies which do not parse query parameters continue to forward the original query parameters unchanged.(CVE-2022-2880) A too-short encoded message can cause a panic in Float.GobDecode and Rat GobDecode in math/big in Go before 1.17.13 and 1.18.5, p…</p> https://cve.radiocsirt.org/vuln/oesa-2025-1053 https://cve.radiocsirt.org/vuln/opensuse-su-2024:0226-1 <p>Security update for gh</p> <p>Security update for gh</p> https://cve.radiocsirt.org/vuln/opensuse-su-2024:0226-1 https://cve.radiocsirt.org/vuln/rhba-2024:5865 <p>go-retryablehttp: url might write sensitive information to log file</p> <p>go-retryablehttp: url might write sensitive information to log file</p> https://cve.radiocsirt.org/vuln/rhba-2024:5865 https://cve.radiocsirt.org/vuln/suse-ru-2025:02092-1 <p>Recommended update for podman</p> <p>Recommended update for podman</p> https://cve.radiocsirt.org/vuln/suse-ru-2025:02092-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-6104 <p><strong>Affected:</strong> Ubuntu:18.04:LTS: golang-github-hashicorp-go-retryablehttp, Ubuntu:20.04:LTS: golang-github-hashicorp-go-retryablehttp, Ubuntu:22.04:LTS: golang-github-hashicorp-go-retryablehttp, Ubuntu:24.04:LTS: golang-github-hashicorp-go-retryablehttp, Ubuntu:25.10: golang-github-hashicorp-go-retryablehttp, Ubuntu:26.04:LTS: golang-github-hashicorp-go-retryablehttp</p> <p>go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability, CVE-2024-6104, was fixed in go-retryablehttp 0.7.7.</p> <p><strong>Affected:</strong> Ubuntu:18.04:LTS: golang-github-hashicorp-go-retryablehttp, Ubuntu:20.04:LTS: golang-github-hashicorp-go-retryablehttp, Ubuntu:22.04:LTS: golang-github-hashicorp-go-retryablehttp, Ubuntu:24.04:LTS: golang-github-hashicorp-go-retryablehttp, Ubuntu:25.10: golang-github-hashicorp-go-retryablehttp, Ubuntu:26.04:LTS: golang-github-hashicorp-go-retryablehttp</p> <p>go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability, CVE-2024-6104, was fixed in go-retryablehttp 0.7.7.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-6104 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-1772 <p>Ein lokaler Angreifer kann eine Schwachstelle in Red Hat OpenShift ausnutzen, um Informationen offenzulegen.</p> <p>Ein lokaler Angreifer kann eine Schwachstelle in Red Hat OpenShift ausnutzen, um Informationen offenzulegen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2024-1772