RHSA-2024:2988

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negoti…

QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth.

Processing an incomplete post-handshake message for a QUIC connection can cause a panic.

The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the expected type when doing a RSA based key exchange, allowing a malicious TLS server to c…

In Go before 1.15.13 and 1.16.x before 1.16.5, there can be a panic for a large exponent to the math/big.Rat SetString or UnmarshalText method.

Reader.Read does not set a limit on the maximum size of file headers.

Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service.

Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http.

Before Go 1.20, the RSA based TLS key exchanges used the math/big library, which is not constant time.

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner.

The html/template package does not apply the proper rules for handling occurrences of "<script", "<!--", and "</script" within JS literals in <script> contexts.

The html/template package does not properly handle HTML-like "" comment tokens, nor hashbang "#!" comment tokens, in <script> contexts.

urllib3 before 1.24.2 does not remove the authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme).

Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures.

A malicious HTTP sender can use chunk extensions to cause a receiver reading from a request or response body to read many more bytes from the network than are in the body.

urllib3 is a user-friendly HTTP client library for Python.