podman-4.9.4-10.el9_4

エラータID: AXSA:2024-8754:08

Release date: 
Wednesday, September 4, 2024 - 16:15
Subject: 
podman-4.9.4-10.el9_4
Affected Channels: 
MIRACLE LINUX 9 for x86_64
Severity: 
High
Description: 

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.

Security Fix(es):

* golang: crypto/x509: Verify panics on certificates with an unknown public key algorithm (CVE-2024-24783)
* go-retryable[http:](http:) url might write sensitive information to log file (CVE-2024-6104)
* gorilla/schema: Potential memory exhaustion attack due to sparse slice deserialization (CVE-2024-37298)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

CVE-2024-24783
Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic. This affects all crypto/tls clients, and servers that set Config.ClientAuth to VerifyClientCertIfGiven or RequireAndVerifyClientCert. The default behavior is for TLS servers to not verify client certificates.
CVE-2024-37298
gorilla/schema converts structs to and from form values. Prior to version 1.4.1 Running `schema.Decoder.Decode()` on a struct that has a field of type `[]struct{...}` opens it up to malicious attacks regarding memory allocations, taking advantage of the sparse slice functionality. Any use of `schema.Decoder.Decode()` on a struct with arrays of other structs could be vulnerable to this memory exhaustion vulnerability. Version 1.4.1 contains a patch for the issue.
CVE-2024-6104
go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability, CVE-2024-6104, was fixed in go-retryablehttp 0.7.7.

Solution: 

Update packages.

Additional Info: 

N/A

Download: 

SRPMS
  1. podman-4.9.4-10.el9_4.src.rpm
    MD5: 144a38f850533ec9a5724b8975356024
    SHA-256: 5d09a6dd61aabbd03fd4bd5247daeaf74b9a1e9d188b0660b42b60b8f0188f30
    Size: 22.77 MB

Asianux Server 9 for x86_64
  1. podman-4.9.4-10.el9_4.x86_64.rpm
    MD5: 49d783a1c4e9b85a51c790ec2bae7c9b
    SHA-256: 4dd50c6ddd93c982e11af10c3117bace221b788c64db6519bede53a984ea5c03
    Size: 15.54 MB
  2. podman-docker-4.9.4-10.el9_4.noarch.rpm
    MD5: 51c1da9867b240325673e78f920ea30e
    SHA-256: e27697b95b18fa17495cc4565e25619d8623371c3d29825a3b117233d902f0cb
    Size: 105.73 kB
  3. podman-plugins-4.9.4-10.el9_4.x86_64.rpm
    MD5: daff49442062480ca3a7ed844226c6c4
    SHA-256: 476962cecc38a3a8f669d79930ffdcbf9b0e1b51cc657a485a4438f9f1a62f13
    Size: 1.28 MB
  4. podman-remote-4.9.4-10.el9_4.x86_64.rpm
    MD5: fec5a866821641c18349c5e82b6884b2
    SHA-256: 37a77092d9946ae70cd25016e07cf031cbaa2aaa22a52fec9e244cd81664e660
    Size: 10.22 MB
  5. podman-tests-4.9.4-10.el9_4.x86_64.rpm
    MD5: 1ae05b606ad4815ae8dd3bd99ebd1f75
    SHA-256: b2c15dad87bb41e6f2b1c7ac8c73bc8886dfcdda0c6803878d11e3815a99d2a0
    Size: 209.75 kB