TI-2024-24810 CVE-2024-37298 · GHSA-3669-72x9-r9p3
Potential memory exhaustion attack due to sparse slice deserialization
Priority HIGH 72
gorilla/schema converts structs to and from form values.
RHSA-2024:5258
container-tools:rhel8 security update
Released 2024-08-13 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 8) aardvark-dns-2:1.10.0-1.module+el8.10.0+22202+761b9a65.aarch64::container-tools:rhel8, aardvark-dns-2:1.10.0-1.module+el8.10.0+22202+761b9a65.ppc64le::container-tools:rhel8, aardvark-dns-2:1.10.0-1.module+el8.10.0+22202+761b9a65.s390x::container-tools:rhel8 +47
Fixes 9 records
TI-2024-16306 CVE-2024-24789 · GHSA-236w-p7wf-5ph8
Mishandling of corrupt central directory record in archive/zip
Priority MEDIUM 58
The archive/zip package's handling of certain types of invalid zip files differs from the behavior of most zip implementations.
TI-2024-16301 CVE-2024-24784 · GHSA-fgq5-q76c-gx78
Comments in display names are incorrectly handled in net/mail
Priority MEDIUM 41
The ParseAddressList function incorrectly handles comments (text within parentheses) within display names.
TI-2024-03473 CVE-2024-3727 · GHSA-6wvf-f2vw-3425
Containers/image: digest type does not guarantee valid type
Priority LOW 39
A flaw was found in the github.com/containers/image library.
TI-2024-01301 CVE-2024-1394 · GHSA-78hx-gp6g-7mj6
Golang-fips/openssl: memory leaks in code encrypting and decrypting rsa payloads
Priority LOW 36
A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled inputs.
TI-2024-25208 CVE-2024-37891 · GHSA-34jh-p97f-mpxf
Proxy-Authorization request header isn't stripped during cross-origin redirects in urllib3
Priority LOW 31
urllib3 is a user-friendly HTTP client library for Python.
TI-2023-24280 CVE-2023-45290 · GHSA-rr6r-cfgf-gc6h
Memory exhaustion in multipart form parsing in net/textproto and net/http
Priority LOW 31
When parsing a multipart form (either explicitly with Request.ParseMultipartForm or implicitly with Request.FormValue, Request.PostFormValue, or Request.FormFile), limits on the total size of the parsed form were not app…
TI-2024-16300 CVE-2024-24783 · GHSA-3q2c-pvp5-3cqp
Verify panics on certificates with an unknown public key algorithm in crypto/x509
Priority LOW 28
Verifying a certificate chain which contains a certificate with an unknown public key algorithm will cause Certificate.Verify to panic.
TI-2024-05657 CVE-2024-6104 · GHSA-v6v8-xj6m-xwqh
go-retryablehttp can leak basic auth credentials to log files
Priority LOW 27
go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file.