Vulnerability-Lookup

RHSA-2024_3254

Vulnerability from csaf_redhat - Published: 2024-05-22 11:48 - Updated: 2024-12-17 22:42

Summary

Red Hat Security Advisory: container-tools:rhel8 security update

Severity

Important

Notes

Topic: An update for the container-tools:rhel8 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc. Security Fix(es): * buildah: full container escape at build time (CVE-2024-1753) * golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters (CVE-2022-2880) * golang: regexp/syntax: limit memory used by parsing regexps (CVE-2022-41715) * golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON (CVE-2024-24786) * jose-go: improper handling of highly compressed data (CVE-2024-28180) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2022-2880

A flaw was found in the golang package, where requests forwarded by reverse proxy include the raw query parameters from the inbound request, including unparseable parameters rejected by net/http. This issue could permit query parameter smuggling when a Go proxy forwards a parameter with an unparseable value. After the fix, the reverse proxy sanitizes the query parameters in the forwarded query when the outbound request's form field is set after the reverse proxy. The director function returns, indicating that the proxy has parsed the query parameters. Proxies that do not parse query parameters continue to forward the original query parameters unchanged.

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Affected products

Fixed 262 products

Product	Version	Remediation
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:aardvark-dns-2:1.10.0-1.module+el8.10.0+21209+52deeb51.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:aardvark-dns-2:1.10.0-1.module+el8.10.0+21209+52deeb51.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:aardvark-dns-2:1.10.0-1.module+el8.10.0+21209+52deeb51.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:aardvark-dns-2:1.10.0-1.module+el8.10.0+21209+52deeb51.src	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:aardvark-dns-2:1.10.0-1.module+el8.10.0+21209+52deeb51.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:buildah-2:1.33.7-1.module+el8.10.0+21590+d7d75709.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:buildah-2:1.33.7-1.module+el8.10.0+21590+d7d75709.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:buildah-2:1.33.7-1.module+el8.10.0+21590+d7d75709.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:buildah-2:1.33.7-1.module+el8.10.0+21590+d7d75709.src	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:buildah-2:1.33.7-1.module+el8.10.0+21590+d7d75709.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:buildah-debuginfo-2:1.33.7-1.module+el8.10.0+21590+d7d75709.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:buildah-debuginfo-2:1.33.7-1.module+el8.10.0+21590+d7d75709.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:buildah-debuginfo-2:1.33.7-1.module+el8.10.0+21590+d7d75709.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:buildah-debuginfo-2:1.33.7-1.module+el8.10.0+21590+d7d75709.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:buildah-debugsource-2:1.33.7-1.module+el8.10.0+21590+d7d75709.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:buildah-debugsource-2:1.33.7-1.module+el8.10.0+21590+d7d75709.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:buildah-debugsource-2:1.33.7-1.module+el8.10.0+21590+d7d75709.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:buildah-debugsource-2:1.33.7-1.module+el8.10.0+21590+d7d75709.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:buildah-tests-2:1.33.7-1.module+el8.10.0+21590+d7d75709.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:buildah-tests-2:1.33.7-1.module+el8.10.0+21590+d7d75709.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:buildah-tests-2:1.33.7-1.module+el8.10.0+21590+d7d75709.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:buildah-tests-2:1.33.7-1.module+el8.10.0+21590+d7d75709.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:buildah-tests-debuginfo-2:1.33.7-1.module+el8.10.0+21590+d7d75709.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:buildah-tests-debuginfo-2:1.33.7-1.module+el8.10.0+21590+d7d75709.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:buildah-tests-debuginfo-2:1.33.7-1.module+el8.10.0+21590+d7d75709.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:buildah-tests-debuginfo-2:1.33.7-1.module+el8.10.0+21590+d7d75709.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:cockpit-podman-0:84.1-1.module+el8.10.0+21373+0d273fdf.noarch	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:cockpit-podman-0:84.1-1.module+el8.10.0+21373+0d273fdf.src	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:conmon-3:2.1.10-1.module+el8.10.0+21077+98b84d8a.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:conmon-3:2.1.10-1.module+el8.10.0+21077+98b84d8a.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:conmon-3:2.1.10-1.module+el8.10.0+21077+98b84d8a.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:conmon-3:2.1.10-1.module+el8.10.0+21077+98b84d8a.src	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:conmon-3:2.1.10-1.module+el8.10.0+21077+98b84d8a.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:conmon-debuginfo-3:2.1.10-1.module+el8.10.0+21077+98b84d8a.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:conmon-debuginfo-3:2.1.10-1.module+el8.10.0+21077+98b84d8a.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:conmon-debuginfo-3:2.1.10-1.module+el8.10.0+21077+98b84d8a.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:conmon-debuginfo-3:2.1.10-1.module+el8.10.0+21077+98b84d8a.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:conmon-debugsource-3:2.1.10-1.module+el8.10.0+21077+98b84d8a.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:conmon-debugsource-3:2.1.10-1.module+el8.10.0+21077+98b84d8a.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:conmon-debugsource-3:2.1.10-1.module+el8.10.0+21077+98b84d8a.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:conmon-debugsource-3:2.1.10-1.module+el8.10.0+21077+98b84d8a.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:container-selinux-2:2.229.0-2.module+el8.10.0+21196+3f0abbca.noarch	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:container-selinux-2:2.229.0-2.module+el8.10.0+21196+3f0abbca.src	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:containernetworking-plugins-1:1.4.0-2.module+el8.10.0+21366+f9cb49f8.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:containernetworking-plugins-1:1.4.0-2.module+el8.10.0+21366+f9cb49f8.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:containernetworking-plugins-1:1.4.0-2.module+el8.10.0+21366+f9cb49f8.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:containernetworking-plugins-1:1.4.0-2.module+el8.10.0+21366+f9cb49f8.src	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:containernetworking-plugins-1:1.4.0-2.module+el8.10.0+21366+f9cb49f8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:containernetworking-plugins-debuginfo-1:1.4.0-2.module+el8.10.0+21366+f9cb49f8.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:containernetworking-plugins-debuginfo-1:1.4.0-2.module+el8.10.0+21366+f9cb49f8.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:containernetworking-plugins-debuginfo-1:1.4.0-2.module+el8.10.0+21366+f9cb49f8.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:containernetworking-plugins-debuginfo-1:1.4.0-2.module+el8.10.0+21366+f9cb49f8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:containernetworking-plugins-debugsource-1:1.4.0-2.module+el8.10.0+21366+f9cb49f8.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:containernetworking-plugins-debugsource-1:1.4.0-2.module+el8.10.0+21366+f9cb49f8.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:containernetworking-plugins-debugsource-1:1.4.0-2.module+el8.10.0+21366+f9cb49f8.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:containernetworking-plugins-debugsource-1:1.4.0-2.module+el8.10.0+21366+f9cb49f8.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:containers-common-2:1-81.module+el8.10.0+21340+c6c7475a.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:containers-common-2:1-81.module+el8.10.0+21340+c6c7475a.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:containers-common-2:1-81.module+el8.10.0+21340+c6c7475a.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:containers-common-2:1-81.module+el8.10.0+21340+c6c7475a.src	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:containers-common-2:1-81.module+el8.10.0+21340+c6c7475a.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:crit-0:3.18-5.module+el8.10.0+21672+01ba06ae.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:crit-0:3.18-5.module+el8.10.0+21672+01ba06ae.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:crit-0:3.18-5.module+el8.10.0+21672+01ba06ae.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:crit-0:3.18-5.module+el8.10.0+21672+01ba06ae.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:criu-0:3.18-5.module+el8.10.0+21672+01ba06ae.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:criu-0:3.18-5.module+el8.10.0+21672+01ba06ae.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:criu-0:3.18-5.module+el8.10.0+21672+01ba06ae.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:criu-0:3.18-5.module+el8.10.0+21672+01ba06ae.src	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:criu-0:3.18-5.module+el8.10.0+21672+01ba06ae.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:criu-debuginfo-0:3.18-5.module+el8.10.0+21672+01ba06ae.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:criu-debuginfo-0:3.18-5.module+el8.10.0+21672+01ba06ae.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:criu-debuginfo-0:3.18-5.module+el8.10.0+21672+01ba06ae.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:criu-debuginfo-0:3.18-5.module+el8.10.0+21672+01ba06ae.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:criu-debugsource-0:3.18-5.module+el8.10.0+21672+01ba06ae.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:criu-debugsource-0:3.18-5.module+el8.10.0+21672+01ba06ae.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:criu-debugsource-0:3.18-5.module+el8.10.0+21672+01ba06ae.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:criu-debugsource-0:3.18-5.module+el8.10.0+21672+01ba06ae.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:criu-devel-0:3.18-5.module+el8.10.0+21672+01ba06ae.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:criu-devel-0:3.18-5.module+el8.10.0+21672+01ba06ae.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:criu-devel-0:3.18-5.module+el8.10.0+21672+01ba06ae.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:criu-devel-0:3.18-5.module+el8.10.0+21672+01ba06ae.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:criu-libs-0:3.18-5.module+el8.10.0+21672+01ba06ae.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:criu-libs-0:3.18-5.module+el8.10.0+21672+01ba06ae.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:criu-libs-0:3.18-5.module+el8.10.0+21672+01ba06ae.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:criu-libs-0:3.18-5.module+el8.10.0+21672+01ba06ae.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:criu-libs-debuginfo-0:3.18-5.module+el8.10.0+21672+01ba06ae.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:criu-libs-debuginfo-0:3.18-5.module+el8.10.0+21672+01ba06ae.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:criu-libs-debuginfo-0:3.18-5.module+el8.10.0+21672+01ba06ae.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:criu-libs-debuginfo-0:3.18-5.module+el8.10.0+21672+01ba06ae.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:crun-0:1.14.3-2.module+el8.10.0+21340+c6c7475a.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:crun-0:1.14.3-2.module+el8.10.0+21340+c6c7475a.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:crun-0:1.14.3-2.module+el8.10.0+21340+c6c7475a.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:crun-0:1.14.3-2.module+el8.10.0+21340+c6c7475a.src	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:crun-0:1.14.3-2.module+el8.10.0+21340+c6c7475a.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:crun-debuginfo-0:1.14.3-2.module+el8.10.0+21340+c6c7475a.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:crun-debuginfo-0:1.14.3-2.module+el8.10.0+21340+c6c7475a.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:crun-debuginfo-0:1.14.3-2.module+el8.10.0+21340+c6c7475a.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:crun-debuginfo-0:1.14.3-2.module+el8.10.0+21340+c6c7475a.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:crun-debugsource-0:1.14.3-2.module+el8.10.0+21340+c6c7475a.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:crun-debugsource-0:1.14.3-2.module+el8.10.0+21340+c6c7475a.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:crun-debugsource-0:1.14.3-2.module+el8.10.0+21340+c6c7475a.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:crun-debugsource-0:1.14.3-2.module+el8.10.0+21340+c6c7475a.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:fuse-overlayfs-0:1.13-1.module+el8.10.0+20412+95ee28e2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:fuse-overlayfs-0:1.13-1.module+el8.10.0+20412+95ee28e2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:fuse-overlayfs-0:1.13-1.module+el8.10.0+20412+95ee28e2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:fuse-overlayfs-0:1.13-1.module+el8.10.0+20412+95ee28e2.src	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:fuse-overlayfs-0:1.13-1.module+el8.10.0+20412+95ee28e2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:fuse-overlayfs-debuginfo-0:1.13-1.module+el8.10.0+20412+95ee28e2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:fuse-overlayfs-debuginfo-0:1.13-1.module+el8.10.0+20412+95ee28e2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:fuse-overlayfs-debuginfo-0:1.13-1.module+el8.10.0+20412+95ee28e2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:fuse-overlayfs-debuginfo-0:1.13-1.module+el8.10.0+20412+95ee28e2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:fuse-overlayfs-debugsource-0:1.13-1.module+el8.10.0+20412+95ee28e2.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:fuse-overlayfs-debugsource-0:1.13-1.module+el8.10.0+20412+95ee28e2.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:fuse-overlayfs-debugsource-0:1.13-1.module+el8.10.0+20412+95ee28e2.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:fuse-overlayfs-debugsource-0:1.13-1.module+el8.10.0+20412+95ee28e2.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:libslirp-0:4.4.0-2.module+el8.10.0+21672+01ba06ae.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:libslirp-0:4.4.0-2.module+el8.10.0+21672+01ba06ae.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:libslirp-0:4.4.0-2.module+el8.10.0+21672+01ba06ae.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:libslirp-0:4.4.0-2.module+el8.10.0+21672+01ba06ae.src	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:libslirp-0:4.4.0-2.module+el8.10.0+21672+01ba06ae.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:libslirp-debuginfo-0:4.4.0-2.module+el8.10.0+21672+01ba06ae.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:libslirp-debuginfo-0:4.4.0-2.module+el8.10.0+21672+01ba06ae.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:libslirp-debuginfo-0:4.4.0-2.module+el8.10.0+21672+01ba06ae.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:libslirp-debuginfo-0:4.4.0-2.module+el8.10.0+21672+01ba06ae.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:libslirp-debugsource-0:4.4.0-2.module+el8.10.0+21672+01ba06ae.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:libslirp-debugsource-0:4.4.0-2.module+el8.10.0+21672+01ba06ae.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:libslirp-debugsource-0:4.4.0-2.module+el8.10.0+21672+01ba06ae.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:libslirp-debugsource-0:4.4.0-2.module+el8.10.0+21672+01ba06ae.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:libslirp-devel-0:4.4.0-2.module+el8.10.0+21672+01ba06ae.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:libslirp-devel-0:4.4.0-2.module+el8.10.0+21672+01ba06ae.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:libslirp-devel-0:4.4.0-2.module+el8.10.0+21672+01ba06ae.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:libslirp-devel-0:4.4.0-2.module+el8.10.0+21672+01ba06ae.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:netavark-2:1.10.3-1.module+el8.10.0+21306+6be40ce7.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:netavark-2:1.10.3-1.module+el8.10.0+21306+6be40ce7.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:netavark-2:1.10.3-1.module+el8.10.0+21306+6be40ce7.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:netavark-2:1.10.3-1.module+el8.10.0+21306+6be40ce7.src	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:netavark-2:1.10.3-1.module+el8.10.0+21306+6be40ce7.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:oci-seccomp-bpf-hook-0:1.2.10-1.module+el8.10.0+20565+a40ba0e5.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:oci-seccomp-bpf-hook-0:1.2.10-1.module+el8.10.0+20565+a40ba0e5.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:oci-seccomp-bpf-hook-0:1.2.10-1.module+el8.10.0+20565+a40ba0e5.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:oci-seccomp-bpf-hook-0:1.2.10-1.module+el8.10.0+20565+a40ba0e5.src	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:oci-seccomp-bpf-hook-0:1.2.10-1.module+el8.10.0+20565+a40ba0e5.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:oci-seccomp-bpf-hook-debuginfo-0:1.2.10-1.module+el8.10.0+20565+a40ba0e5.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:oci-seccomp-bpf-hook-debuginfo-0:1.2.10-1.module+el8.10.0+20565+a40ba0e5.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:oci-seccomp-bpf-hook-debuginfo-0:1.2.10-1.module+el8.10.0+20565+a40ba0e5.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:oci-seccomp-bpf-hook-debuginfo-0:1.2.10-1.module+el8.10.0+20565+a40ba0e5.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:oci-seccomp-bpf-hook-debugsource-0:1.2.10-1.module+el8.10.0+20565+a40ba0e5.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:oci-seccomp-bpf-hook-debugsource-0:1.2.10-1.module+el8.10.0+20565+a40ba0e5.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:oci-seccomp-bpf-hook-debugsource-0:1.2.10-1.module+el8.10.0+20565+a40ba0e5.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:oci-seccomp-bpf-hook-debugsource-0:1.2.10-1.module+el8.10.0+20565+a40ba0e5.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:podman-4:4.9.4-1.module+el8.10.0+21632+761e0d34.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:podman-4:4.9.4-1.module+el8.10.0+21632+761e0d34.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:podman-4:4.9.4-1.module+el8.10.0+21632+761e0d34.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:podman-4:4.9.4-1.module+el8.10.0+21632+761e0d34.src	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:podman-4:4.9.4-1.module+el8.10.0+21632+761e0d34.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:podman-catatonit-4:4.9.4-1.module+el8.10.0+21632+761e0d34.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:podman-catatonit-4:4.9.4-1.module+el8.10.0+21632+761e0d34.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:podman-catatonit-4:4.9.4-1.module+el8.10.0+21632+761e0d34.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:podman-catatonit-4:4.9.4-1.module+el8.10.0+21632+761e0d34.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:podman-catatonit-debuginfo-4:4.9.4-1.module+el8.10.0+21632+761e0d34.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:podman-catatonit-debuginfo-4:4.9.4-1.module+el8.10.0+21632+761e0d34.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:podman-catatonit-debuginfo-4:4.9.4-1.module+el8.10.0+21632+761e0d34.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:podman-catatonit-debuginfo-4:4.9.4-1.module+el8.10.0+21632+761e0d34.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:podman-debuginfo-4:4.9.4-1.module+el8.10.0+21632+761e0d34.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:podman-debuginfo-4:4.9.4-1.module+el8.10.0+21632+761e0d34.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:podman-debuginfo-4:4.9.4-1.module+el8.10.0+21632+761e0d34.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:podman-debuginfo-4:4.9.4-1.module+el8.10.0+21632+761e0d34.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:podman-debugsource-4:4.9.4-1.module+el8.10.0+21632+761e0d34.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:podman-debugsource-4:4.9.4-1.module+el8.10.0+21632+761e0d34.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:podman-debugsource-4:4.9.4-1.module+el8.10.0+21632+761e0d34.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:podman-debugsource-4:4.9.4-1.module+el8.10.0+21632+761e0d34.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:podman-docker-4:4.9.4-1.module+el8.10.0+21632+761e0d34.noarch	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:podman-gvproxy-4:4.9.4-1.module+el8.10.0+21632+761e0d34.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:podman-gvproxy-4:4.9.4-1.module+el8.10.0+21632+761e0d34.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:podman-gvproxy-4:4.9.4-1.module+el8.10.0+21632+761e0d34.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:podman-gvproxy-4:4.9.4-1.module+el8.10.0+21632+761e0d34.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:podman-gvproxy-debuginfo-4:4.9.4-1.module+el8.10.0+21632+761e0d34.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:podman-gvproxy-debuginfo-4:4.9.4-1.module+el8.10.0+21632+761e0d34.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:podman-gvproxy-debuginfo-4:4.9.4-1.module+el8.10.0+21632+761e0d34.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:podman-gvproxy-debuginfo-4:4.9.4-1.module+el8.10.0+21632+761e0d34.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:podman-plugins-4:4.9.4-1.module+el8.10.0+21632+761e0d34.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:podman-plugins-4:4.9.4-1.module+el8.10.0+21632+761e0d34.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:podman-plugins-4:4.9.4-1.module+el8.10.0+21632+761e0d34.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:podman-plugins-4:4.9.4-1.module+el8.10.0+21632+761e0d34.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:podman-plugins-debuginfo-4:4.9.4-1.module+el8.10.0+21632+761e0d34.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:podman-plugins-debuginfo-4:4.9.4-1.module+el8.10.0+21632+761e0d34.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:podman-plugins-debuginfo-4:4.9.4-1.module+el8.10.0+21632+761e0d34.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:podman-plugins-debuginfo-4:4.9.4-1.module+el8.10.0+21632+761e0d34.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:podman-remote-4:4.9.4-1.module+el8.10.0+21632+761e0d34.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:podman-remote-4:4.9.4-1.module+el8.10.0+21632+761e0d34.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:podman-remote-4:4.9.4-1.module+el8.10.0+21632+761e0d34.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:podman-remote-4:4.9.4-1.module+el8.10.0+21632+761e0d34.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:podman-remote-debuginfo-4:4.9.4-1.module+el8.10.0+21632+761e0d34.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:podman-remote-debuginfo-4:4.9.4-1.module+el8.10.0+21632+761e0d34.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:podman-remote-debuginfo-4:4.9.4-1.module+el8.10.0+21632+761e0d34.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:podman-remote-debuginfo-4:4.9.4-1.module+el8.10.0+21632+761e0d34.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:podman-tests-4:4.9.4-1.module+el8.10.0+21632+761e0d34.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:podman-tests-4:4.9.4-1.module+el8.10.0+21632+761e0d34.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:podman-tests-4:4.9.4-1.module+el8.10.0+21632+761e0d34.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:podman-tests-4:4.9.4-1.module+el8.10.0+21632+761e0d34.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:python-podman-0:4.9.0-1.module+el8.10.0+21196+3f0abbca.src	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:python3-criu-0:3.18-5.module+el8.10.0+21672+01ba06ae.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:python3-criu-0:3.18-5.module+el8.10.0+21672+01ba06ae.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:python3-criu-0:3.18-5.module+el8.10.0+21672+01ba06ae.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:python3-criu-0:3.18-5.module+el8.10.0+21672+01ba06ae.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:python3-podman-0:4.9.0-1.module+el8.10.0+21196+3f0abbca.noarch	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:runc-1:1.1.12-1.module+el8.10.0+21251+62b7388c.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:runc-1:1.1.12-1.module+el8.10.0+21251+62b7388c.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:runc-1:1.1.12-1.module+el8.10.0+21251+62b7388c.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:runc-1:1.1.12-1.module+el8.10.0+21251+62b7388c.src	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:runc-1:1.1.12-1.module+el8.10.0+21251+62b7388c.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:runc-debuginfo-1:1.1.12-1.module+el8.10.0+21251+62b7388c.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:runc-debuginfo-1:1.1.12-1.module+el8.10.0+21251+62b7388c.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:runc-debuginfo-1:1.1.12-1.module+el8.10.0+21251+62b7388c.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:runc-debuginfo-1:1.1.12-1.module+el8.10.0+21251+62b7388c.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:runc-debugsource-1:1.1.12-1.module+el8.10.0+21251+62b7388c.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:runc-debugsource-1:1.1.12-1.module+el8.10.0+21251+62b7388c.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:runc-debugsource-1:1.1.12-1.module+el8.10.0+21251+62b7388c.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:runc-debugsource-1:1.1.12-1.module+el8.10.0+21251+62b7388c.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:skopeo-2:1.14.3-2.module+el8.10.0+21728+a1d9b0ab.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:skopeo-2:1.14.3-2.module+el8.10.0+21728+a1d9b0ab.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:skopeo-2:1.14.3-2.module+el8.10.0+21728+a1d9b0ab.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:skopeo-2:1.14.3-2.module+el8.10.0+21728+a1d9b0ab.src	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:skopeo-2:1.14.3-2.module+el8.10.0+21728+a1d9b0ab.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:skopeo-tests-2:1.14.3-2.module+el8.10.0+21728+a1d9b0ab.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:skopeo-tests-2:1.14.3-2.module+el8.10.0+21728+a1d9b0ab.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:skopeo-tests-2:1.14.3-2.module+el8.10.0+21728+a1d9b0ab.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:skopeo-tests-2:1.14.3-2.module+el8.10.0+21728+a1d9b0ab.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:slirp4netns-0:1.2.3-1.module+el8.10.0+21306+6be40ce7.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:slirp4netns-0:1.2.3-1.module+el8.10.0+21306+6be40ce7.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:slirp4netns-0:1.2.3-1.module+el8.10.0+21306+6be40ce7.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:slirp4netns-0:1.2.3-1.module+el8.10.0+21306+6be40ce7.src	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:slirp4netns-0:1.2.3-1.module+el8.10.0+21306+6be40ce7.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:slirp4netns-debuginfo-0:1.2.3-1.module+el8.10.0+21306+6be40ce7.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:slirp4netns-debuginfo-0:1.2.3-1.module+el8.10.0+21306+6be40ce7.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:slirp4netns-debuginfo-0:1.2.3-1.module+el8.10.0+21306+6be40ce7.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:slirp4netns-debuginfo-0:1.2.3-1.module+el8.10.0+21306+6be40ce7.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:slirp4netns-debugsource-0:1.2.3-1.module+el8.10.0+21306+6be40ce7.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:slirp4netns-debugsource-0:1.2.3-1.module+el8.10.0+21306+6be40ce7.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:slirp4netns-debugsource-0:1.2.3-1.module+el8.10.0+21306+6be40ce7.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:slirp4netns-debugsource-0:1.2.3-1.module+el8.10.0+21306+6be40ce7.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:toolbox-0:0.0.99.5-2.module+el8.10.0+21341+ff0b5f89.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:toolbox-0:0.0.99.5-2.module+el8.10.0+21341+ff0b5f89.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:toolbox-0:0.0.99.5-2.module+el8.10.0+21341+ff0b5f89.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:toolbox-0:0.0.99.5-2.module+el8.10.0+21341+ff0b5f89.src	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:toolbox-0:0.0.99.5-2.module+el8.10.0+21341+ff0b5f89.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:toolbox-debuginfo-0:0.0.99.5-2.module+el8.10.0+21341+ff0b5f89.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:toolbox-debuginfo-0:0.0.99.5-2.module+el8.10.0+21341+ff0b5f89.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:toolbox-debuginfo-0:0.0.99.5-2.module+el8.10.0+21341+ff0b5f89.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:toolbox-debuginfo-0:0.0.99.5-2.module+el8.10.0+21341+ff0b5f89.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:toolbox-debugsource-0:0.0.99.5-2.module+el8.10.0+21341+ff0b5f89.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:toolbox-debugsource-0:0.0.99.5-2.module+el8.10.0+21341+ff0b5f89.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:toolbox-debugsource-0:0.0.99.5-2.module+el8.10.0+21341+ff0b5f89.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:toolbox-debugsource-0:0.0.99.5-2.module+el8.10.0+21341+ff0b5f89.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:toolbox-tests-0:0.0.99.5-2.module+el8.10.0+21341+ff0b5f89.aarch64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:toolbox-tests-0:0.0.99.5-2.module+el8.10.0+21341+ff0b5f89.ppc64le	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:toolbox-tests-0:0.0.99.5-2.module+el8.10.0+21341+ff0b5f89.s390x	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:toolbox-tests-0:0.0.99.5-2.module+el8.10.0+21341+ff0b5f89.x86_64	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:udica-0:0.2.6-21.module+el8.10.0+21672+01ba06ae.noarch	—	Vendor Fix fix
Unresolved product id: AppStream-8.10.0.Z.MAIN.EUS:container-tools:rhel8:8100020240419145834:afee755d:udica-0:0.2.6-21.module+el8.10.0+21672+01ba06ae.src	—	Vendor Fix fix

Threats

Impact Moderate

CVE-2022-41715

A flaw was found in the golang package, where programs that compile regular expressions from untrusted sources are vulnerable to memory exhaustion or a denial of service. The parsed regexp representation is linear in the input size. Still, in some cases, the constant factor can be as high as 40,000, making a relatively small regexp consume larger amounts of memory. After the fix, each regexp being parsed is limited to a 256 MB memory footprint. Regular expressions whose representation would use more space than that are rejected. Routine use of regular expressions is unaffected.

6.5 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

Fixed 262 products, the same list as for CVE-2022-2880

Threats

Impact Moderate

CVE-2024-1753

A flaw was found in Buildah (and subsequently Podman Build) which allows containers to mount arbitrary locations on the host filesystem into build containers. A malicious Containerfile can use a dummy image with a symbolic link to the root filesystem as a mount source and cause the mount operation to mount the host root filesystem inside the RUN step. The commands inside the RUN step will then have read-write access to the host filesystem, allowing for full container escape at build time.

8.6 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

CWE-59 - Improper Link Resolution Before File Access ('Link Following')

Affected products

Fixed 262 products, the same list as for CVE-2022-2880

Threats

Impact Important

CVE-2024-24786

A flaw was found in Golang's protobuf module, where the unmarshal function can enter an infinite loop when processing certain invalid inputs. This issue occurs during unmarshaling into a message that includes a google.protobuf.Any or when the UnmarshalOptions.DiscardUnknown option is enabled. This flaw allows an attacker to craft malicious input tailored to trigger the identified flaw in the unmarshal function. By providing carefully constructed invalid inputs, they could potentially cause the function to enter an infinite loop, resulting in a denial of service condition or other unintended behaviors in the affected system.

5.9 (Medium)


                
                  CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Affected products

Fixed 262 products, the same list as for CVE-2022-2880

Threats

Impact Moderate

CVE-2024-28180

A vulnerability was found in Jose due to improper handling of highly compressed data. This issue could allow an attacker to send a JWE containing compressed data that uses large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti.

4.3 (Medium)


                
                  CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)

Affected products

Fixed 262 products, the same list as for CVE-2022-2880

Threats

Impact Moderate

References

41 references

URL	Category
https://access.redhat.com/errata/RHSA-2024:3254	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2132868	external
https://bugzilla.redhat.com/show_bug.cgi?id=2132872	external
https://bugzilla.redhat.com/show_bug.cgi?id=2265513	external
https://bugzilla.redhat.com/show_bug.cgi?id=2268046	external
https://bugzilla.redhat.com/show_bug.cgi?id=2268854	external
https://issues.redhat.com/browse/RHEL-26664	external
https://issues.redhat.com/browse/RHEL-28628	external
https://issues.redhat.com/browse/RHEL-30885	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2022-2880	self
https://bugzilla.redhat.com/show_bug.cgi?id=2132868	external
https://www.cve.org/CVERecord?id=CVE-2022-2880	external
https://nvd.nist.gov/vuln/detail/CVE-2022-2880	external
https://github.com/golang/go/issues/54663	external
https://groups.google.com/g/golang-announce/c/xtu…	external
https://access.redhat.com/security/cve/CVE-2022-41715	self
https://bugzilla.redhat.com/show_bug.cgi?id=2132872	external
https://www.cve.org/CVERecord?id=CVE-2022-41715	external
https://nvd.nist.gov/vuln/detail/CVE-2022-41715	external
https://github.com/golang/go/issues/55949	external
https://access.redhat.com/security/cve/CVE-2024-1753	self
https://bugzilla.redhat.com/show_bug.cgi?id=2265513	external
https://www.cve.org/CVERecord?id=CVE-2024-1753	external
https://nvd.nist.gov/vuln/detail/CVE-2024-1753	external
https://github.com/containers/buildah/security/ad…	external
https://github.com/containers/podman/security/adv…	external
https://pkg.go.dev/vuln/GO-2024-2658	external
https://access.redhat.com/security/cve/CVE-2024-24786	self
https://bugzilla.redhat.com/show_bug.cgi?id=2268046	external
https://www.cve.org/CVERecord?id=CVE-2024-24786	external
https://nvd.nist.gov/vuln/detail/CVE-2024-24786	external
https://go.dev/cl/569356	external
https://groups.google.com/g/golang-announce/c/ArQ…	external
https://pkg.go.dev/vuln/GO-2024-2611	external
https://access.redhat.com/security/cve/CVE-2024-28180	self
https://bugzilla.redhat.com/show_bug.cgi?id=2268854	external
https://www.cve.org/CVERecord?id=CVE-2024-28180	external
https://nvd.nist.gov/vuln/detail/CVE-2024-28180	external
https://github.com/go-jose/go-jose/security/advis…	external

Acknowledgments

Head of Research, Oxeye Daniel Abeles

Security Researcher, Oxeye Gal Goldstein

ADA Logics Adam Korczynski

OSS-Fuzz

JSON

To clipboard

Loading 1.1 MB of JSON…

CVE-2022-2880 (GCVE-0-2022-2880)

Vulnerability from cvelistv5 – Published: 2022-10-14 00:00 – Updated: 2025-02-13 16:32

Title

Incorrect sanitization of forwarded query parameters in net/http/httputil

Summary

Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy forwards a parameter with an unparsable value. After fix, ReverseProxy sanitizes the query parameters in the forwarded query when the outbound request's Form field is set after the ReverseProxy. Director function returns, indicating that the proxy has parsed the query parameters. Proxies which do not parse query parameters continue to forward the original query parameters unchanged.

Severity

No CVSS data available.

CWE

CWE-444 - Inconsistent Interpretation of HTTP Requests

Assigner

Go Google root

References

5 references

URL	Tags
https://go.dev/issue/54663
https://go.dev/cl/432976
https://groups.google.com/g/golang-announce/c/xtu…
https://pkg.go.dev/vuln/GO-2022-1038
https://security.gentoo.org/glsa/202311-09

Impacted products

1 product

Vendor	Product	Version
Go standard library	net/http/httputil	Affected: 0 , < 1.18.7 (semver) Affected: 1.19.0-0 , < 1.19.2 (semver)

Credits

Gal Goldstein (Security Researcher, Oxeye) Daniel Abeles (Head of Research, Oxeye)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T00:52:59.582Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/issue/54663"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/cl/432976"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://groups.google.com/g/golang-announce/c/xtuG5faxtaU"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://pkg.go.dev/vuln/GO-2022-1038"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202311-09"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "net/http/httputil",
          "product": "net/http/httputil",
          "programRoutines": [
            {
              "name": "ReverseProxy.ServeHTTP"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.18.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.19.2",
              "status": "affected",
              "version": "1.19.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Gal Goldstein (Security Researcher, Oxeye)"
        },
        {
          "lang": "en",
          "value": "Daniel Abeles (Head of Research, Oxeye)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy forwards a parameter with an unparsable value. After fix, ReverseProxy sanitizes the query parameters in the forwarded query when the outbound request\u0027s Form field is set after the ReverseProxy. Director function returns, indicating that the proxy has parsed the query parameters. Proxies which do not parse query parameters continue to forward the original query parameters unchanged."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-444: Inconsistent Interpretation of HTTP Requests",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-11-25T11:09:33.806Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/issue/54663"
        },
        {
          "url": "https://go.dev/cl/432976"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/xtuG5faxtaU"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2022-1038"
        },
        {
          "url": "https://security.gentoo.org/glsa/202311-09"
        }
      ],
      "title": "Incorrect sanitization of forwarded query parameters in net/http/httputil"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2022-2880",
    "datePublished": "2022-10-14T00:00:00.000Z",
    "dateReserved": "2022-08-17T00:00:00.000Z",
    "dateUpdated": "2025-02-13T16:32:39.111Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2022-41715 (GCVE-0-2022-41715)

Vulnerability from cvelistv5 – Published: 2022-10-14 00:00 – Updated: 2025-02-13 16:33

Title

Memory exhaustion when compiling regular expressions in regexp/syntax

Summary

Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed regexp representation is linear in the size of the input, but in some cases the constant factor can be as high as 40,000, making relatively small regexps consume much larger amounts of memory. After fix, each regexp being parsed is limited to a 256 MB memory footprint. Regular expressions whose representation would use more space than that are rejected. Normal use of regular expressions is unaffected.

Severity

No CVSS data available.

CWE

CWE 400: Uncontrolled Resource Consumption

Assigner

Go Google root

References

5 references

URL	Tags
https://go.dev/issue/55949
https://go.dev/cl/439356
https://groups.google.com/g/golang-announce/c/xtu…
https://pkg.go.dev/vuln/GO-2022-1039
https://security.gentoo.org/glsa/202311-09

Impacted products

1 product

Vendor	Product	Version
Go standard library	regexp/syntax	Affected: 0 , < 1.18.7 (semver) Affected: 1.19.0-0 , < 1.19.2 (semver)

Credits

Adam Korczynski (ADA Logics) OSS-Fuzz

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T12:49:43.550Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/issue/55949"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/cl/439356"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://groups.google.com/g/golang-announce/c/xtuG5faxtaU"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://pkg.go.dev/vuln/GO-2022-1039"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202311-09"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "regexp/syntax",
          "product": "regexp/syntax",
          "programRoutines": [
            {
              "name": "parser.push"
            },
            {
              "name": "parser.repeat"
            },
            {
              "name": "parser.factor"
            },
            {
              "name": "parse"
            },
            {
              "name": "Parse"
            }
          ],
          "vendor": "Go standard library",
          "versions": [
            {
              "lessThan": "1.18.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.19.2",
              "status": "affected",
              "version": "1.19.0-0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Adam Korczynski (ADA Logics)"
        },
        {
          "lang": "en",
          "value": "OSS-Fuzz"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed regexp representation is linear in the size of the input, but in some cases the constant factor can be as high as 40,000, making relatively small regexps consume much larger amounts of memory. After fix, each regexp being parsed is limited to a 256 MB memory footprint. Regular expressions whose representation would use more space than that are rejected. Normal use of regular expressions is unaffected."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE 400: Uncontrolled Resource Consumption",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-11-25T11:09:55.534Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/issue/55949"
        },
        {
          "url": "https://go.dev/cl/439356"
        },
        {
          "url": "https://groups.google.com/g/golang-announce/c/xtuG5faxtaU"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2022-1039"
        },
        {
          "url": "https://security.gentoo.org/glsa/202311-09"
        }
      ],
      "title": "Memory exhaustion when compiling regular expressions in regexp/syntax"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2022-41715",
    "datePublished": "2022-10-14T00:00:00.000Z",
    "dateReserved": "2022-09-28T00:00:00.000Z",
    "dateUpdated": "2025-02-13T16:33:07.652Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-1753 (GCVE-0-2024-1753)

Vulnerability from cvelistv5 – Published: 2024-03-18 14:23 – Updated: 2026-03-04 04:16

Title

Buildah: full container escape at build time

Summary

Severity

8.6 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-05-02 15:05 UTC

CWE

CWE-59 - Improper Link Resolution Before File Access ('Link Following')

Assigner

redhat redhat root

References

25 references

URL	Tags
https://access.redhat.com/errata/RHSA-2024:2049	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:2055	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:2064	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:2066	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:2077	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:2084	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:2089	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:2090	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:2097	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:2098	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:2548	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:2645	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:2669	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:2672	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:2784	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:2877	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2024:3254	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2024-1753	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2265513	issue-trackingx_refsource_REDHAT
https://github.com/containers/buildah/security/ad…
https://github.com/containers/podman/security/adv…
https://pkg.go.dev/vuln/GO-2024-2658
https://lists.fedoraproject.org/archives/list/pac…	x_transferred
https://lists.fedoraproject.org/archives/list/pac…	x_transferred
https://lists.fedoraproject.org/archives/list/pac…	x_transferred

Impacted products

20 products

Vendor	Product	Version
		Affected: 4.15.0
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 8090020240413110917.d7b6f4b7 , < * (rpm) cpe:/a:redhat:enterprise_linux:8::appstream
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 8090020240417184044.e7857ab1 , < * (rpm) cpe:/a:redhat:enterprise_linux:8::appstream
Red Hat	Red Hat Enterprise Linux 8	Unaffected: 8100020240419145834.afee755d , < * (rpm) cpe:/a:redhat:enterprise_linux:8::appstream
Red Hat	Red Hat Enterprise Linux 8.6 Extended Update Support	Unaffected: 8060020240422155330.3b538bd8 , < * (rpm) cpe:/a:redhat:rhel_eus:8.6::appstream
Red Hat	Red Hat Enterprise Linux 8.6 Extended Update Support	Unaffected: 8060020240419071711.2e213529 , < * (rpm) cpe:/a:redhat:rhel_eus:8.6::appstream
Red Hat	Red Hat Enterprise Linux 8.8 Extended Update Support	Unaffected: 8080020240422101606.0f77c1b7 , < * (rpm) cpe:/a:redhat:rhel_eus:8.8::appstream
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 1:1.31.5-1.el9_3 , < * (rpm) cpe:/a:redhat:enterprise_linux:9::appstream
Red Hat	Red Hat Enterprise Linux 9	Unaffected: 4:4.9.4-3.el9_4 , < * (rpm) cpe:/a:redhat:enterprise_linux:9::appstream
Red Hat	Red Hat Enterprise Linux 9.0 Extended Update Support	Unaffected: 1:1.26.7-1.el9_0 , < * (rpm) cpe:/a:redhat:rhel_eus:9.0::appstream
Red Hat	Red Hat Enterprise Linux 9.0 Extended Update Support	Unaffected: 2:4.2.0-3.el9_0 , < * (rpm) cpe:/a:redhat:rhel_eus:9.0::appstream
Red Hat	Red Hat Enterprise Linux 9.2 Extended Update Support	Unaffected: 1:1.29.3-1.el9_2 , < * (rpm) cpe:/a:redhat:rhel_eus:9.2::appstream
Red Hat	Red Hat Enterprise Linux 9.2 Extended Update Support	Unaffected: 2:4.4.1-16.el9_2 , < * (rpm) cpe:/a:redhat:rhel_eus:9.2::appstream
Red Hat	Red Hat OpenShift Container Platform 4.12	Unaffected: 3:4.4.1-3.2.rhaos4.12.el8 , < * (rpm) cpe:/a:redhat:openshift:4.12::el8 cpe:/a:redhat:openshift:4.12::el9
Red Hat	Red Hat OpenShift Container Platform 4.13	Unaffected: 3:4.4.1-6.3.rhaos4.13.el9 , < * (rpm) cpe:/a:redhat:openshift:4.13::el9 cpe:/a:redhat:openshift:4.13::el8
Red Hat	Red Hat OpenShift Container Platform 4.13	Unaffected: 3:4.4.1-8.3.rhaos4.13.el9 , < * (rpm) cpe:/a:redhat:openshift:4.13::el9 cpe:/a:redhat:openshift:4.13::el8
Red Hat	Red Hat OpenShift Container Platform 4.14	Unaffected: 3:4.4.1-13.4.rhaos4.14.el8 , < * (rpm) cpe:/a:redhat:openshift:4.14::el8 cpe:/a:redhat:openshift:4.14::el9
Red Hat	Red Hat OpenShift Container Platform 4.15	Unaffected: 3:4.4.1-23.2.rhaos4.15.el8 , < * (rpm) cpe:/a:redhat:openshift:4.15::el9 cpe:/a:redhat:openshift:4.15::el8
Red Hat	Red Hat Enterprise Linux 7	cpe:/o:redhat:enterprise_linux:7
Red Hat	Red Hat OpenShift Container Platform 3.11	cpe:/a:redhat:openshift:3.11

Date Public

2024-03-18 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-1753",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-05-02T15:05:28.144862Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-06-04T18:00:10.892Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T18:48:22.005Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "RHSA-2024:2049",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:2049"
          },
          {
            "name": "RHSA-2024:2055",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:2055"
          },
          {
            "name": "RHSA-2024:2064",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:2064"
          },
          {
            "name": "RHSA-2024:2066",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:2066"
          },
          {
            "name": "RHSA-2024:2077",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:2077"
          },
          {
            "name": "RHSA-2024:2084",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:2084"
          },
          {
            "name": "RHSA-2024:2089",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:2089"
          },
          {
            "name": "RHSA-2024:2090",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:2090"
          },
          {
            "name": "RHSA-2024:2097",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:2097"
          },
          {
            "name": "RHSA-2024:2098",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:2098"
          },
          {
            "name": "RHSA-2024:2548",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:2548"
          },
          {
            "name": "RHSA-2024:2645",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:2645"
          },
          {
            "name": "RHSA-2024:2669",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:2669"
          },
          {
            "name": "RHSA-2024:2672",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:2672"
          },
          {
            "name": "RHSA-2024:2784",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:2784"
          },
          {
            "name": "RHSA-2024:2877",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:2877"
          },
          {
            "name": "RHSA-2024:3254",
            "tags": [
              "vendor-advisory",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/errata/RHSA-2024:3254"
          },
          {
            "tags": [
              "vdb-entry",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://access.redhat.com/security/cve/CVE-2024-1753"
          },
          {
            "name": "RHBZ#2265513",
            "tags": [
              "issue-tracking",
              "x_refsource_REDHAT",
              "x_transferred"
            ],
            "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2265513"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/containers/buildah/security/advisories/GHSA-pmf3-c36m-g5cf"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/containers/podman/security/advisories/GHSA-874v-pj72-92f3"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FCRZVUDOFM5CPREQKBEU2VK2QK62PSBP/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KOYMVMQ7RWMDTSKQTBO734BE3WQPI2AJ/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZVBSVZGVABPYIHK5HZM472NPGWMI7WXH/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/openshift/builder/",
          "defaultStatus": "unaffected",
          "packageName": "buildah",
          "versions": [
            {
              "status": "affected",
              "version": "4.15.0"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "container-tools:4.0",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8090020240413110917.d7b6f4b7",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "container-tools:rhel8",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8090020240417184044.e7857ab1",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:8::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "container-tools:rhel8",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8100020240419145834.afee755d",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:8.6::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "container-tools:rhel8",
          "product": "Red Hat Enterprise Linux 8.6 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8060020240422155330.3b538bd8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:8.6::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "container-tools:4.0",
          "product": "Red Hat Enterprise Linux 8.6 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8060020240419071711.2e213529",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:8.8::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "container-tools:rhel8",
          "product": "Red Hat Enterprise Linux 8.8 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "8080020240422101606.0f77c1b7",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "buildah",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1:1.31.5-1.el9_3",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:enterprise_linux:9::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "podman",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "4:4.9.4-3.el9_4",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.0::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "buildah",
          "product": "Red Hat Enterprise Linux 9.0 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1:1.26.7-1.el9_0",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.0::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "podman",
          "product": "Red Hat Enterprise Linux 9.0 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2:4.2.0-3.el9_0",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.2::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "buildah",
          "product": "Red Hat Enterprise Linux 9.2 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "1:1.29.3-1.el9_2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhel_eus:9.2::appstream"
          ],
          "defaultStatus": "affected",
          "packageName": "podman",
          "product": "Red Hat Enterprise Linux 9.2 Extended Update Support",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "2:4.4.1-16.el9_2",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.12::el8",
            "cpe:/a:redhat:openshift:4.12::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "podman",
          "product": "Red Hat OpenShift Container Platform 4.12",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "3:4.4.1-3.2.rhaos4.12.el8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.13::el9",
            "cpe:/a:redhat:openshift:4.13::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "podman",
          "product": "Red Hat OpenShift Container Platform 4.13",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "3:4.4.1-6.3.rhaos4.13.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.13::el9",
            "cpe:/a:redhat:openshift:4.13::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "podman",
          "product": "Red Hat OpenShift Container Platform 4.13",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "3:4.4.1-8.3.rhaos4.13.el9",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.14::el8",
            "cpe:/a:redhat:openshift:4.14::el9"
          ],
          "defaultStatus": "affected",
          "packageName": "podman",
          "product": "Red Hat OpenShift Container Platform 4.14",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "3:4.4.1-13.4.rhaos4.14.el8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4.15::el9",
            "cpe:/a:redhat:openshift:4.15::el8"
          ],
          "defaultStatus": "affected",
          "packageName": "podman",
          "product": "Red Hat OpenShift Container Platform 4.15",
          "vendor": "Red Hat",
          "versions": [
            {
              "lessThan": "*",
              "status": "unaffected",
              "version": "3:4.4.1-23.2.rhaos4.15.el8",
              "versionType": "rpm"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "defaultStatus": "unaffected",
          "packageName": "buildah",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "defaultStatus": "unknown",
          "packageName": "podman",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:3.11"
          ],
          "defaultStatus": "unknown",
          "packageName": "podman",
          "product": "Red Hat OpenShift Container Platform 3.11",
          "vendor": "Red Hat"
        }
      ],
      "datePublic": "2024-03-18T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in Buildah (and subsequently Podman Build) which allows containers to mount arbitrary locations on the host filesystem into build containers. A malicious Containerfile can use a dummy image with a symbolic link to the root filesystem as a mount source and cause the mount operation to mount the host root filesystem inside the RUN step. The commands inside the RUN step will then have read-write access to the host filesystem, allowing for full container escape at build time."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Important"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 8.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-03-04T04:16:07.393Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2024:2049",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:2049"
        },
        {
          "name": "RHSA-2024:2055",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:2055"
        },
        {
          "name": "RHSA-2024:2064",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:2064"
        },
        {
          "name": "RHSA-2024:2066",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:2066"
        },
        {
          "name": "RHSA-2024:2077",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:2077"
        },
        {
          "name": "RHSA-2024:2084",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:2084"
        },
        {
          "name": "RHSA-2024:2089",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:2089"
        },
        {
          "name": "RHSA-2024:2090",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:2090"
        },
        {
          "name": "RHSA-2024:2097",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:2097"
        },
        {
          "name": "RHSA-2024:2098",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:2098"
        },
        {
          "name": "RHSA-2024:2548",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:2548"
        },
        {
          "name": "RHSA-2024:2645",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:2645"
        },
        {
          "name": "RHSA-2024:2669",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:2669"
        },
        {
          "name": "RHSA-2024:2672",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:2672"
        },
        {
          "name": "RHSA-2024:2784",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:2784"
        },
        {
          "name": "RHSA-2024:2877",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:2877"
        },
        {
          "name": "RHSA-2024:3254",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:3254"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2024-1753"
        },
        {
          "name": "RHBZ#2265513",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2265513"
        },
        {
          "url": "https://github.com/containers/buildah/security/advisories/GHSA-pmf3-c36m-g5cf"
        },
        {
          "url": "https://github.com/containers/podman/security/advisories/GHSA-874v-pj72-92f3"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2024-2658"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2024-02-22T00:00:00.000Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2024-03-18T00:00:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Buildah: full container escape at build time",
      "workarounds": [
        {
          "lang": "en",
          "value": "When SELinux is enabled, the container is restricted to limited read-only access."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2024-1753",
    "datePublished": "2024-03-18T14:23:44.213Z",
    "dateReserved": "2024-02-22T14:42:20.623Z",
    "dateUpdated": "2026-03-04T04:16:07.393Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2024-24786 (GCVE-0-2024-24786)

Vulnerability from cvelistv5 – Published: 2024-03-05 22:22 – Updated: 2025-02-13 17:40

Title

Infinite loop in JSON unmarshaling in google.golang.org/protobuf

Summary

The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-11-07 16:22 UTC

CWE

CWE-1286 - Improper Validation of Syntactic Correctness of Input

Assigner

Go Google root

References

5 references

URL	Tags
https://go.dev/cl/569356
https://pkg.go.dev/vuln/GO-2024-2611
https://lists.fedoraproject.org/archives/list/pac…
http://www.openwall.com/lists/oss-security/2024/03/08/4
https://security.netapp.com/advisory/ntap-2024051…

Impacted products

3 products

Vendor	Product	Version
google.golang.org/protobuf	google.golang.org/protobuf/encoding/protojson	Affected: 0 , < 1.33.0 (semver)
google.golang.org/protobuf	google.golang.org/protobuf/internal/encoding/json	Affected: 0 , < 1.33.0 (semver)
golang	go	Affected: 0 , < 1.33.0 (custom) cpe:2.3:a:golang:go::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:golang:go:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "go",
            "vendor": "golang",
            "versions": [
              {
                "lessThan": "1.33.0",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 7.5,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2024-24786",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-11-07T16:22:27.828054Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-11-07T16:23:32.865Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-01T23:28:12.790Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://go.dev/cl/569356"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://pkg.go.dev/vuln/GO-2024-2611"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JDMBHAVSDU2FBDZ45U3A2VLSM35OJ2HU/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2024/03/08/4"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240517-0002/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "google.golang.org/protobuf/encoding/protojson",
          "product": "google.golang.org/protobuf/encoding/protojson",
          "programRoutines": [
            {
              "name": "UnmarshalOptions.unmarshal"
            },
            {
              "name": "Unmarshal"
            },
            {
              "name": "UnmarshalOptions.Unmarshal"
            }
          ],
          "vendor": "google.golang.org/protobuf",
          "versions": [
            {
              "lessThan": "1.33.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://pkg.go.dev",
          "defaultStatus": "unaffected",
          "packageName": "google.golang.org/protobuf/internal/encoding/json",
          "product": "google.golang.org/protobuf/internal/encoding/json",
          "programRoutines": [
            {
              "name": "Decoder.Read"
            },
            {
              "name": "Decoder.Peek"
            }
          ],
          "vendor": "google.golang.org/protobuf",
          "versions": [
            {
              "lessThan": "1.33.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "CWE-1286: Improper Validation of Syntactic Correctness of Input",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-10T17:12:44.017Z",
        "orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
        "shortName": "Go"
      },
      "references": [
        {
          "url": "https://go.dev/cl/569356"
        },
        {
          "url": "https://pkg.go.dev/vuln/GO-2024-2611"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JDMBHAVSDU2FBDZ45U3A2VLSM35OJ2HU/"
        },
        {
          "url": "http://www.openwall.com/lists/oss-security/2024/03/08/4"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20240517-0002/"
        }
      ],
      "title": "Infinite loop in JSON unmarshaling in google.golang.org/protobuf"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
    "assignerShortName": "Go",
    "cveId": "CVE-2024-24786",
    "datePublished": "2024-03-05T22:22:35.299Z",
    "dateReserved": "2024-01-30T16:05:14.757Z",
    "dateUpdated": "2025-02-13T17:40:25.868Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2024-28180 (GCVE-0-2024-28180)

Vulnerability from cvelistv5 – Published: 2024-03-09 00:54 – Updated: 2025-02-13 17:47

Title

Go JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification)

Summary

Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3.

Severity

4.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-03-11 15:08 UTC

CWE

CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)

Assigner

GitHub_M mitre root

References

13 references

URL	Tags
https://github.com/go-jose/go-jose/security/advis…	x_refsource_CONFIRM
https://github.com/go-jose/go-jose/commit/0dd4dd5…	x_refsource_MISC
https://github.com/go-jose/go-jose/commit/add6a28…	x_refsource_MISC
https://github.com/go-jose/go-jose/commit/f4c051a…	x_refsource_MISC
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…
https://lists.fedoraproject.org/archives/list/pac…

Impacted products

2 products

Vendor	Product	Version
go-jose	go-jose	Affected: < 4.0.1 Affected: < 3.0.3 Affected: < 2.6.3
go-jose_project	go-jose	Affected: 0 , < 4.0.1 (custom) Affected: 0 , < 3.0.3 (custom) Affected: 0 , < 2.6.3 (custom) cpe:2.3:a:go-jose_project:go-jose::::::::

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T00:48:49.442Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "https://github.com/go-jose/go-jose/security/advisories/GHSA-c5q2-7r4c-mv6g",
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/go-jose/go-jose/security/advisories/GHSA-c5q2-7r4c-mv6g"
          },
          {
            "name": "https://github.com/go-jose/go-jose/commit/0dd4dd541c665fb292d664f77604ba694726f298",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/go-jose/go-jose/commit/0dd4dd541c665fb292d664f77604ba694726f298"
          },
          {
            "name": "https://github.com/go-jose/go-jose/commit/add6a284ea0f844fd6628cba637be5451fe4b28a",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/go-jose/go-jose/commit/add6a284ea0f844fd6628cba637be5451fe4b28a"
          },
          {
            "name": "https://github.com/go-jose/go-jose/commit/f4c051a0653d78199a053892f7619ebf96339502",
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/go-jose/go-jose/commit/f4c051a0653d78199a053892f7619ebf96339502"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XJDO5VSIAOGT2WP63AXAAWNRSVJCNCRH/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KXKGNCRU7OTM5AHC7YIYBNOWI742PRMY/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I6MMWFBOXJA6ZCXNVPDFJ4XMK5PVG5RG/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UJO2U5ACZVACNQXJ5EBRFLFW6DP5BROY/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UG5FSEYJ3GP27FZXC5YAAMMEC5XWKJHG/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IJ6LAJJ2FTA2JVVOACCV5RZTOIZLXUNJ/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JNPMXL36YGS3GQEVI3Q5HKHJ7YAAQXL5/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MSOMHDKRPU3A2JEMRODT2IREDFBLVPGS/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GD2GSBQTBLYADASUBHHZV2CZPTSLIPQJ/"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:go-jose_project:go-jose:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unknown",
            "product": "go-jose",
            "vendor": "go-jose_project",
            "versions": [
              {
                "lessThan": "4.0.1",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "lessThan": "3.0.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              },
              {
                "lessThan": "2.6.3",
                "status": "affected",
                "version": "0",
                "versionType": "custom"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-28180",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-03-11T15:08:38.886435Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-28T17:51:52.720Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "go-jose",
          "vendor": "go-jose",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.0.1"
            },
            {
              "status": "affected",
              "version": "\u003c 3.0.3"
            },
            {
              "status": "affected",
              "version": "\u003c 2.6.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-409",
              "description": "CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-12T02:06:02.656Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/go-jose/go-jose/security/advisories/GHSA-c5q2-7r4c-mv6g",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/go-jose/go-jose/security/advisories/GHSA-c5q2-7r4c-mv6g"
        },
        {
          "name": "https://github.com/go-jose/go-jose/commit/0dd4dd541c665fb292d664f77604ba694726f298",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/go-jose/go-jose/commit/0dd4dd541c665fb292d664f77604ba694726f298"
        },
        {
          "name": "https://github.com/go-jose/go-jose/commit/add6a284ea0f844fd6628cba637be5451fe4b28a",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/go-jose/go-jose/commit/add6a284ea0f844fd6628cba637be5451fe4b28a"
        },
        {
          "name": "https://github.com/go-jose/go-jose/commit/f4c051a0653d78199a053892f7619ebf96339502",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/go-jose/go-jose/commit/f4c051a0653d78199a053892f7619ebf96339502"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XJDO5VSIAOGT2WP63AXAAWNRSVJCNCRH/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KXKGNCRU7OTM5AHC7YIYBNOWI742PRMY/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I6MMWFBOXJA6ZCXNVPDFJ4XMK5PVG5RG/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UJO2U5ACZVACNQXJ5EBRFLFW6DP5BROY/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UG5FSEYJ3GP27FZXC5YAAMMEC5XWKJHG/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/IJ6LAJJ2FTA2JVVOACCV5RZTOIZLXUNJ/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JNPMXL36YGS3GQEVI3Q5HKHJ7YAAQXL5/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MSOMHDKRPU3A2JEMRODT2IREDFBLVPGS/"
        },
        {
          "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GD2GSBQTBLYADASUBHHZV2CZPTSLIPQJ/"
        }
      ],
      "source": {
        "advisory": "GHSA-c5q2-7r4c-mv6g",
        "discovery": "UNKNOWN"
      },
      "title": "Go JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-28180",
    "datePublished": "2024-03-09T00:54:46.382Z",
    "dateReserved": "2024-03-06T17:35:00.857Z",
    "dateUpdated": "2025-02-13T17:47:27.104Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

RHSA-2024_3254

CVE-2022-2880 (GCVE-0-2022-2880)

CVE-2022-41715 (GCVE-0-2022-41715)

CVE-2024-1753 (GCVE-0-2024-1753)

CVE-2024-24786 (GCVE-0-2024-24786)

CVE-2024-28180 (GCVE-0-2024-28180)

Tags

Sightings

Nomenclature