[ALSA-2023:7766] Moderate: containernetworking-plugins security update
Type:
security
Severity:
moderate
Release date:
2023-12-14
Description:
The Container Network Interface (CNI) project consists of a specification and libraries for writing plug-ins for configuring network interfaces in Linux containers, along with a number of supported plug-ins. CNI concerns itself only with network connectivity of containers and removing allocated resources when the container is deleted. Security Fix(es): * golang: crypto/tls: slow verification of certificate chains containing large RSA keys (CVE-2023-29409) * golang: html/template: improper handling of HTML-like comments within script contexts (CVE-2023-39318) * golang: html/template: improper handling of special tags within script contexts (CVE-2023-39319) * golang: crypto/tls: panic when processing post-handshake message on QUIC connections (CVE-2023-39321) * golang: crypto/tls: lack of a limit on buffered post-handshake (CVE-2023-39322) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Updated packages listed below:
Architecture Package Checksum
aarch64 containernetworking-plugins-1.3.0-6.el9_3.aarch64.rpm f4d13f2a07342d1fe6d8c5bed2d301e6dbf220b143407336691ac8890b57a347
ppc64le containernetworking-plugins-1.3.0-6.el9_3.ppc64le.rpm b8f94a830ce882954c9299d476ddbffe3adb2c640f87e7c0634b74ba0c831ccc
s390x containernetworking-plugins-1.3.0-6.el9_3.s390x.rpm 13c571102b6d3809d40603f6c993666f4980fe22f8c1a73498d3ffee7c3aff8f
x86_64 containernetworking-plugins-1.3.0-6.el9_3.x86_64.rpm 8582b72210e0dc98664caf5c9306738a1062d6b135aa8f4fbfac835bd64375df
Notes:
This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.