buildah-1.33.6-2.el9
エラータID: AXSA:2024-7786:03
リリース日:
2024/05/29 Wednesday - 19:57
題名:
buildah-1.33.6-2.el9
影響のあるチャネル:
MIRACLE LINUX 9 for x86_64
Severity:
Moderate
Description:
以下項目について対処しました。
[Security Fix]
- Go の net/http エンコーディングリーダーのチャンク拡張
機能の処理には、最大 1 GiByte の本文のよりも大きいデータ
の読み取りを許容してしまう問題があるため、リモートの
攻撃者により、細工された大量のデータの送信を介して、
サービス拒否攻撃を可能とする脆弱性が存在します。
(CVE-2023-39326)
- Go の crypto/tls ライブラリには、RSA を利用した TLS キー
交換処理の処理時間が一定にならない math/big ライブラリが
使用されている問題があるため、リモートの攻撃者により、
タイミングサイドチャネル攻撃を可能とする脆弱性が存在
します。(CVE-2023-45287)
解決策:
パッケージをアップデートしてください。
CVE:
CVE-2023-39326
A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of data (up to about 1GiB) when a handler fails to read the entire body of a request. Chunk extensions are a little-used HTTP feature which permit including additional metadata in a request or response body sent using the chunked encoding. The net/http chunked encoding reader discards this metadata. A sender can exploit this by inserting a large metadata segment with each byte transferred. The chunk reader now produces an error if the ratio of real body to encoded bytes grows too small.
A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of data (up to about 1GiB) when a handler fails to read the entire body of a request. Chunk extensions are a little-used HTTP feature which permit including additional metadata in a request or response body sent using the chunked encoding. The net/http chunked encoding reader discards this metadata. A sender can exploit this by inserting a large metadata segment with each byte transferred. The chunk reader now produces an error if the ratio of real body to encoded bytes grows too small.
CVE-2023-45287
Before Go 1.20, the RSA based TLS key exchanges used the math/big library, which is not constant time. RSA blinding was applied to prevent timing attacks, but analysis shows this may not have been fully effective. In particular it appears as if the removal of PKCS#1 padding may leak timing information, which in turn could be used to recover session key bits. In Go 1.20, the crypto/tls library switched to a fully constant time RSA implementation, which we do not believe exhibits any timing side channels.
Before Go 1.20, the RSA based TLS key exchanges used the math/big library, which is not constant time. RSA blinding was applied to prevent timing attacks, but analysis shows this may not have been fully effective. In particular it appears as if the removal of PKCS#1 padding may leak timing information, which in turn could be used to recover session key bits. In Go 1.20, the crypto/tls library switched to a fully constant time RSA implementation, which we do not believe exhibits any timing side channels.
追加情報:
N/A
ダウンロード:
SRPMS
- buildah-1.33.6-2.el9.src.rpm
MD5: 73fefc8da4cac145f951731b4b3a5f71
SHA-256: c43735e5803f8f6de04ba8d19ba0acb98a4bac2598700cc0308543fa675409d8
Size: 17.43 MB
Asianux Server 9 for x86_64
- buildah-1.33.6-2.el9.x86_64.rpm
MD5: 1405e23f50abb264dbee37b6dc27e5a9
SHA-256: 782c0a55e419e456861dd7727f20fb63ac857a0cc8b1143f9614baf849c82aa9
Size: 9.40 MB - buildah-tests-1.33.6-2.el9.x86_64.rpm
MD5: 8af2d187e63aa8d58417e3fe9a13b94b
SHA-256: 28ed719ed26eb119b5dcb751bce2c6e0c4b2f5479e898eb9d89e8098cbe78b8f
Size: 30.21 MB
English