buildah-1.33.7-3.el9_4
エラータID: AXSA:2024-8549:06
Release date:
Wednesday, July 10, 2024 - 14:44
Subject:
buildah-1.33.7-3.el9_4
Affected Channels:
MIRACLE LINUX 9 for x86_64
Severity:
High
Description:
The buildah package provides a tool for facilitating building OCI container
images. Among other things, buildah enables you to: Create a working container,
either from scratch or using an image as a starting point; Create an image,
either from a working container or using the instructions in a Dockerfile; Build
both Docker and OCI images.
Security Fix(es):
golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA
payloads (CVE-2024-1394)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s)
listed in the References section.
CVE(s):
CVE-2024-1394
Solution:
Update packages.
CVEs:
CVE-2024-1394
A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled inputs. The memory leak happens in github.com/golang-fips/openssl/openssl/rsa.go#L113. The objects leaked are pkey and ctx. That function uses named return parameters to free pkey and ctx if there is an error initializing the context or setting the different properties. All return statements related to error cases follow the "return nil, nil, fail(...)" pattern, meaning that pkey and ctx will be nil inside the deferred function that should free them.
A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled inputs. The memory leak happens in github.com/golang-fips/openssl/openssl/rsa.go#L113. The objects leaked are pkey and ctx. That function uses named return parameters to free pkey and ctx if there is an error initializing the context or setting the different properties. All return statements related to error cases follow the "return nil, nil, fail(...)" pattern, meaning that pkey and ctx will be nil inside the deferred function that should free them.
Additional Info:
N/A
Download:
SRPMS
- buildah-1.33.7-3.el9_4.src.rpm
MD5: c9ee72c1ff9cf336d2a37cd687d27ddd
SHA-256: 2aefbb44f23e18cff7bf7da104c8c289bbedd15cbd9c0d583f9bdd494eb310bd
Size: 17.46 MB
Asianux Server 9 for x86_64
- buildah-1.33.7-3.el9_4.x86_64.rpm
MD5: 4f79fa3db3a82f775c07efda6b029c51
SHA-256: e47ef5d9250b1f8ac40abd2f647ba880d73388d3309d259ac63025b6e5621bd9
Size: 9.41 MB - buildah-tests-1.33.7-3.el9_4.x86_64.rpm
MD5: 5562978d689f59680e929dbf25758561
SHA-256: 21383b251a52f6b0a95f85641e73fb12b401c037dd9ddbaa8932304c71c3fc18
Size: 30.30 MB
日本語