RHSA-2023:6938

Not all valid JavaScript whitespace characters are considered to be whitespace.

Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them as expected.

A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.

A denial of service is possible from excessive resource consumption in net/http and mime/multipart.

Large handshake records may cause panics in crypto/tls.

HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of service.

Parsing malicious or large YAML documents can consume excessive amounts of CPU or memory.

Calling any of the Parse functions on Go source code which contains //line directives with very large line numbers can cause an infinite loop due to integer overflow.

Multipart form parsing can consume large amounts of CPU and memory when processing form inputs containing very large numbers of parts.

Templates containing actions in unquoted HTML attributes (e.g.

runc is a CLI tool for spawning and running containers according to the OCI specification.

Angle brackets (<>) are not considered dangerous characters when inserted into CSS contexts.

runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go.

The HTTP/1 client does not fully validate the contents of the Host header.

Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be.

runc is a CLI tool for spawning and running containers according to the OCI specification.