runc-1.1.12-3.el9_4
エラータID: AXSA:2024-8613:04
リリース日:
2024/07/29 Monday - 10:22
題名:
runc-1.1.12-3.el9_4
影響のあるチャネル:
MIRACLE LINUX 9 for x86_64
Severity:
High
Description:
以下項目について対処しました。
[Security Fix]
- Go の RSA 暗号化 / 復号化の処理には、メモリリークの問題が
あるため、リモートの攻撃者により、サービス拒否攻撃 (メモリ
枯渇) を可能とする脆弱性が存在します。(CVE-2024-1394)
解決策:
パッケージをアップデートしてください。
CVE:
CVE-2024-1394
A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled inputs. The memory leak happens in github.com/golang-fips/openssl/openssl/rsa.go#L113. The objects leaked are pkey and ctx. That function uses named return parameters to free pkey and ctx if there is an error initializing the context or setting the different properties. All return statements related to error cases follow the "return nil, nil, fail(...)" pattern, meaning that pkey and ctx will be nil inside the deferred function that should free them.
A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled inputs. The memory leak happens in github.com/golang-fips/openssl/openssl/rsa.go#L113. The objects leaked are pkey and ctx. That function uses named return parameters to free pkey and ctx if there is an error initializing the context or setting the different properties. All return statements related to error cases follow the "return nil, nil, fail(...)" pattern, meaning that pkey and ctx will be nil inside the deferred function that should free them.
追加情報:
N/A
ダウンロード:
SRPMS
- runc-1.1.12-3.el9_4.src.rpm
MD5: 1cb272e6dbca4dcdfe2ee82d1398e6ea
SHA-256: 994375658b1b411240c28a99d0305fd5e75618396ed10fab9dbd326fb25af1db
Size: 2.38 MB
Asianux Server 9 for x86_64
- runc-1.1.12-3.el9_4.x86_64.rpm
MD5: ceb2164916d1c421223521015a625cf7
SHA-256: 7c0dc16c551a691853585a390354afd5536edf1843996a37fbebd36870cb3c31
Size: 3.13 MB