[ALSA-2023:6402] Moderate: containernetworking-plugins security and bug fix update
Release date:
The Container Network Interface (CNI) project consists of a specification and libraries for writing plug-ins for configuring network interfaces in Linux containers, along with a number of supported plug-ins. CNI concerns itself only with network connectivity of containers and removing allocated resources when the container is deleted. Security Fix(es): * golang: html/template: improper handling of JavaScript whitespace (CVE-2023-24540) * net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding (CVE-2022-41723) * golang: crypto/tls: large handshake records may cause panics (CVE-2022-41724) * golang: net/http, mime/multipart: denial of service from excessive resource consumption (CVE-2022-41725) * golang: net/http, net/textproto: denial of service from excessive memory allocation (CVE-2023-24534) * golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption (CVE-2023-24536) * golang: html/template: backticks not treated as string delimiters (CVE-2023-24538) * golang: html/template: improper sanitization of CSS values (CVE-2023-24539) * golang: html/template: improper handling of empty HTML attributes (CVE-2023-29400) * golang: net/http: insufficient sanitization of Host header (CVE-2023-29406) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
Updated packages listed below:
Architecture Package Checksum
aarch64 containernetworking-plugins-1.3.0-4.el9.aarch64.rpm 404e6e478cb25ec4fe2dc65932afdbb496906d49c55f18472ce18db6b2c546f2
ppc64le containernetworking-plugins-1.3.0-4.el9.ppc64le.rpm d9b1d02cdad34a27056a200fcbcd1b7a4e17d87288b696514483ef0ca41a159b
s390x containernetworking-plugins-1.3.0-4.el9.s390x.rpm bfcd219a406229b3060f13e4d71998053f33abfbda467fece383d54d45a4f4fe
x86_64 containernetworking-plugins-1.3.0-4.el9.x86_64.rpm bd71dc584a8e67a61aa07666f1cdcc94a276728b0c4c9e68e6f001f6cd61961a
This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.