Red Hat Security Advisory

RHSA-2023:7763

runc security update

Released 2023-12-12 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 9) runc-4:1.1.9-2.el9_3

Fixes 3 records

TI-2023-20464 CVE-2023-39322 · GHSA-892h-r6cr-53g4

Memory exhaustion in QUIC connection handling in crypto/tls

MEDIUM 42

QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01345 Published 2023-09-08 Partial fix · 1.21.1 CWE-770

TI-2023-20463 CVE-2023-39321 · GHSA-9v7r-x7cv-v437

Panic when processing post-handshake message on QUIC connections in crypto/tls

MEDIUM 42

Processing an incomplete post-handshake message for a QUIC connection can cause a panic.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01345 Published 2023-09-08 Partial fix · 1.21.1 CWE-400

TI-2023-13789 CVE-2023-29409 · GHSA-xc82-5m89-g4jv

Large RSA keys can cause high CPU usage in crypto/tls

LOW 27

Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01601 Published 2023-08-02 Partial fix · 1.19.12, 1.20.7 +1 CWE-400