containernetworking-plugins-1.4.0-2.el9
エラータID: AXSA:2024-7953:01
リリース日:
2024/05/30 Thursday - 14:32
題名:
containernetworking-plugins-1.4.0-2.el9
影響のあるチャネル:
MIRACLE LINUX 9 for x86_64
Severity:
Moderate
Description:
以下項目について対処しました。
[Security Fix]
- Go の net/http エンコーディングリーダーのチャンク拡張
機能の処理には、最大 1 GiByte の本文のよりも大きいデータ
の読み取りを許容してしまう問題があるため、リモートの
攻撃者により、細工された大量のデータの送信を介して、
サービス拒否攻撃を可能とする脆弱性が存在します。
(CVE-2023-39326)
- Go の crypto/tls ライブラリには、RSA を利用した TLS キー
交換処理の処理時間が一定にならない math/big ライブラリが
使用されている問題があるため、リモートの攻撃者により、
タイミングサイドチャネル攻撃を可能とする脆弱性が存在
します。(CVE-2023-45287)
解決策:
パッケージをアップデートしてください。
CVE:
CVE-2023-39326
A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of data (up to about 1GiB) when a handler fails to read the entire body of a request. Chunk extensions are a little-used HTTP feature which permit including additional metadata in a request or response body sent using the chunked encoding. The net/http chunked encoding reader discards this metadata. A sender can exploit this by inserting a large metadata segment with each byte transferred. The chunk reader now produces an error if the ratio of real body to encoded bytes grows too small.
A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body. A malicious HTTP client can further exploit this to cause a server to automatically read a large amount of data (up to about 1GiB) when a handler fails to read the entire body of a request. Chunk extensions are a little-used HTTP feature which permit including additional metadata in a request or response body sent using the chunked encoding. The net/http chunked encoding reader discards this metadata. A sender can exploit this by inserting a large metadata segment with each byte transferred. The chunk reader now produces an error if the ratio of real body to encoded bytes grows too small.
CVE-2023-45287
Before Go 1.20, the RSA based TLS key exchanges used the math/big library, which is not constant time. RSA blinding was applied to prevent timing attacks, but analysis shows this may not have been fully effective. In particular it appears as if the removal of PKCS#1 padding may leak timing information, which in turn could be used to recover session key bits. In Go 1.20, the crypto/tls library switched to a fully constant time RSA implementation, which we do not believe exhibits any timing side channels.
Before Go 1.20, the RSA based TLS key exchanges used the math/big library, which is not constant time. RSA blinding was applied to prevent timing attacks, but analysis shows this may not have been fully effective. In particular it appears as if the removal of PKCS#1 padding may leak timing information, which in turn could be used to recover session key bits. In Go 1.20, the crypto/tls library switched to a fully constant time RSA implementation, which we do not believe exhibits any timing side channels.
追加情報:
N/A
ダウンロード:
SRPMS
- containernetworking-plugins-1.4.0-2.el9.src.rpm
MD5: aba1678cf6c30e43c0dc6870791eecf4
SHA-256: b68b61aa20fe4540948148c4eac5bc1fc98368d9172d85780c5bf6a032e47464
Size: 3.62 MB
Asianux Server 9 for x86_64
- containernetworking-plugins-1.4.0-2.el9.x86_64.rpm
MD5: 7277bdc8a5a4e34e346ae603fa2d9a2a
SHA-256: 3299384c5bb29629967359a49a54f60bdc7529bed3de73f37a0ebd3cab682901
Size: 9.30 MB
English