[ALSA-2023:6473] Moderate: buildah security update
Type:
security
Severity:
moderate
Release date:
2023-11-14
Description:
The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. Security Fix(es): * golang: html/template: improper handling of JavaScript whitespace (CVE-2023-24540) * net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding (CVE-2022-41723) * golang: crypto/tls: large handshake records may cause panics (CVE-2022-41724) * golang: net/http, mime/multipart: denial of service from excessive resource consumption (CVE-2022-41725) * golang: net/http, net/textproto: denial of service from excessive memory allocation (CVE-2023-24534) * golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption (CVE-2023-24536) * golang: html/template: backticks not treated as string delimiters (CVE-2023-24538) * golang: html/template: improper sanitization of CSS values (CVE-2023-24539) * containerd: Supplementary groups are not set up properly (CVE-2023-25173) * golang: html/template: improper handling of empty HTML attributes (CVE-2023-29400) * golang: net/http: insufficient sanitization of Host header (CVE-2023-29406) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
Updated packages listed below:
Architecture Package Checksum
aarch64 buildah-tests-1.31.3-1.el9.aarch64.rpm 15956bba82723f26aa9ee5366af80d07a3685ae6daa7b920a501b0c58d8eefab
aarch64 buildah-1.31.3-1.el9.aarch64.rpm f4c5a781f08f71be3d01e9f90c061458ad4784c137829a26918657bce09475f9
ppc64le buildah-1.31.3-1.el9.ppc64le.rpm 546505be8476239876f783013259d8f98e1686d19ac5d1cd2abac0aeb9015fdc
ppc64le buildah-tests-1.31.3-1.el9.ppc64le.rpm f321fcbf593d0bfa90ab1772a1d93dde6a1921299dcc1d7a5b3531c325947c43
s390x buildah-tests-1.31.3-1.el9.s390x.rpm 3a79731fe89a2654eedf723e3d6fdd5a725d8a18bb26a72076adf4edef20db72
s390x buildah-1.31.3-1.el9.s390x.rpm 6cfd3c4afa6aa431eadfec755903e5c44e3975e118bd2ccf795415aeaa811afb
x86_64 buildah-tests-1.31.3-1.el9.x86_64.rpm b033d8d848956b135b20b6c695d84981a84ee22b5d2c63ae15eec9917fde1dd4
x86_64 buildah-1.31.3-1.el9.x86_64.rpm cef09cd8f61aba3f56ffd3b5b9a45b59488d1d085042100c3bb3c9ecb2f0329e
Notes:
This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.