buildah-1.33.7-3.el9_4
エラータID: AXSA:2024-8549:06
Release date:
Wednesday, July 10, 2024 - 14:44
Subject:
buildah-1.33.7-3.el9_4
Affected Channels:
MIRACLE LINUX 9 for x86_64
Severity:
High
Description:
The buildah package provides a tool for facilitating building OCI container
images. Among other things, buildah enables you to: Create a working container,
either from scratch or using an image as a starting point; Create an image,
either from a working container or using the instructions in a Dockerfile; Build
both Docker and OCI images.
Security Fix(es):
golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA
payloads (CVE-2024-1394)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s)
listed in the References section.
CVE(s):
CVE-2024-1394
Solution:
Update packages.
CVEs:
CVE-2024-1394
A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled inputs​. The memory leak happens in github.com/golang-fips/openssl/openssl/rsa.go#L113. The objects leaked are pkey​ and ctx​. That function uses named return parameters to free pkey​ and ctx​ if there is an error initializing the context or setting the different properties. All return statements related to error cases follow the "return nil, nil, fail(...)" pattern, meaning that pkey​ and ctx​ will be nil inside the deferred function that should free them.
A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled inputs​. The memory leak happens in github.com/golang-fips/openssl/openssl/rsa.go#L113. The objects leaked are pkey​ and ctx​. That function uses named return parameters to free pkey​ and ctx​ if there is an error initializing the context or setting the different properties. All return statements related to error cases follow the "return nil, nil, fail(...)" pattern, meaning that pkey​ and ctx​ will be nil inside the deferred function that should free them.
Additional Info:
N/A
Download:
SRPMS
- buildah-1.33.7-3.el9_4.src.rpm
MD5: c9ee72c1ff9cf336d2a37cd687d27ddd
SHA-256: 2aefbb44f23e18cff7bf7da104c8c289bbedd15cbd9c0d583f9bdd494eb310bd
Size: 17.46 MB
Asianux Server 9 for x86_64
- buildah-1.33.7-3.el9_4.x86_64.rpm
MD5: 4f79fa3db3a82f775c07efda6b029c51
SHA-256: e47ef5d9250b1f8ac40abd2f647ba880d73388d3309d259ac63025b6e5621bd9
Size: 9.41 MB - buildah-tests-1.33.7-3.el9_4.x86_64.rpm
MD5: 5562978d689f59680e929dbf25758561
SHA-256: 21383b251a52f6b0a95f85641e73fb12b401c037dd9ddbaa8932304c71c3fc18
Size: 30.30 MB
日本語