Red Hat Security AdvisoryRHSA-2022:7954
podman security and bug fix update
Released 2022-11-15 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 9) podman-2:4.2.0-3.el9, podman-docker-2:4.2.0-3.el9, podman-gvproxy-2:4.2.0-3.el9 +3
Fixes 8 records
Priority MEDIUM 40
The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain circumstances involving AddHostKey.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.03963 · Published 2022-03-18 · Partial fix · 0.0.0-20220314234659-1baeb1ce4c0b CWE-327
Priority LOW 39
The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS server to c…
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.06975 · Published 2021-07-15 · Partial fix CWE-295
Priority LOW 37
In x/text in Go 1.15.4, an "index out of range" panic occurs in language.ParseAcceptLanguage while parsing the -u- extension.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02325 · Published 2021-01-02 · Partial fix CWE-129
Priority LOW 36
In x/text in Go before v0.3.5, a "slice bounds out of range" panic occurs in language.ParseAcceptLanguage while processing a BCP 47 tag.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01742 · Published 2021-01-02 · Partial fix CWE-129
Priority LOW 32
A deadlock vulnerability was found in 'github.com/containers/storage' in versions before 1.28.1.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.01587 · Published 2021-04-01 · Partial fix · 1.28.1 CWE-667
Priority LOW 31
A flaw was found in podman.
CVSS 3.1MEDIUM 6.5· Network · No auth · No interaction · EPSS 0.01137 · Published 2021-12-23 · Fixed in 3.4.3 CWE-200
Priority LOW 29
Rootless containers run with Podman, receive all traffic with a source IP address of 127.0.0.1 (including from remote hosts).
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.01159 · Published 2021-02-02 · Partial fix · 3.0.0 CWE-346
Priority LOW 28
In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from net/http/httputil) result in a situation where an attacker is able to drop arbitrary headers.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.0226 · Published 2021-08-02 · Partial fix CWE-862
THREATIST.IORead the docs