TI-2024-14351 CVE-2024-21626 · GHSA-xr7r-f8xq-vfvv
runc container breakout through process.cwd trickery and leaked fds
Priority HIGH 72
runc is a CLI tool for spawning and running containers on Linux according to the OCI specification.
RHSA-2024:0748
container-tools:4.0 security update
Released 2024-02-08 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.0.1-38.module+el8.9.0+21242+944321bb.aarch64::container-tools:4.0, aardvark-dns-2:1.0.1-38.module+el8.9.0+21242+944321bb.ppc64le::container-tools:4.0, aardvark-dns-2:1.0.1-38.module+el8.9.0+21242+944321bb.s390x::container-tools:4.0 +47
Fixes 3 records
TI-2023-24277 CVE-2023-45287 · GHSA-33qr-2xwr-95pw
Before Go 1.20, the RSA based key exchange methods in crypto/tls may exhibit a timing side channel
Priority LOW 35
Before Go 1.20, the RSA based TLS key exchanges used the math/big library, which is not constant time.
TI-2023-20467 CVE-2023-39326 · GHSA-9f76-wg39-x86h
Denial of service via chunk extensions in net/http
Priority LOW 26
A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body.