Red Hat Security Advisory

RHSA-2023:2253

buildah security and bug fix update

Released 2023-05-09 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 9) buildah-1:1.29.1-1.el9, buildah-tests-1:1.29.1-1.el9

Fixes 2 records

TI-2022-20109 CVE-2022-41717 · GHSA-xrjj-mj9h-534m

Excessive memory growth in net/http and golang.org/x/net/http2

LOW 33

An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.06077 Published 2022-12-08 Partial fix · 1.18.9, 1.19.4 +1 CWE-770

TI-2022-12765 CVE-2022-30629 · GHSA-j55j-52j7-vq87

Session tickets lack random ticket_age_add in crypto/tls

LOW 18

Non-random values for ticket_age_add in session tickets in crypto/tls before Go 1.17.11 and Go 1.18.3 allow an attacker that can observe TLS handshakes to correlate successive connections by comparing ticket ages during…

CVSS 3.1LOW 3.1 Network No auth User interaction EPSS 0.0121 Published 2022-08-09 Partial fix · 1.17.11, 1.18.3 CWE-330