Release buildah-1.33.6-2.module+el8.10.0+21371+46937ece ALSA-2024:2988

[maccelf]

ALSA-2024:2988: container-tools:rhel8 security update (Moderate)
Severity: Moderate
Description
The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

• urllib3: urllib3 does not remove the authorization HTTP header when following a cross-origin redirect (CVE-2018-25091)
• golang: math/big.Rat: may cause a panic or an unrecoverable fatal error if passed inputs with very large exponents (CVE-2021-33198)
• golang: crypto/tls: certificate of wrong type is causing TLS client to panic (CVE-2021-34558)
• golang: archive/tar: unbounded memory consumption when reading headers (CVE-2022-2879)
• golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters (CVE-2022-2880)
• golang: regexp/syntax: limit memory used by parsing regexps (CVE-2022-41715)
• golang: crypto/tls: slow verification of certificate chains containing large RSA keys (CVE-2023-29409)
• golang: html/template: improper handling of HTML-like comments within script contexts (CVE-2023-39318)
• golang: html/template: improper handling of special tags within script contexts (CVE-2023-39319)
• golang: crypto/tls: panic when processing post-handshake message on QUIC connections (CVE-2023-39321)
• golang: crypto/tls: lack of a limit on buffered post-handshake (CVE-2023-39322)
• golang: net/http/internal: Denial of Service (DoS) via Resource Consumption via HTTP requests (CVE-2023-39326)
• golang: crypto/tls: Timing Side Channel attack in RSA based TLS key exchanges. (CVE-2023-45287)
• urllib3: Request body not stripped after redirect from 303 status changes request method to GET (CVE-2023-45803)
• ssh: Prefix truncation attack on Binary Packet Protocol (BPP) (CVE-2023-48795)
• moby/buildkit: Possible race condition with accessing subpaths from cache mounts (CVE-2024-23650)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Affected packages:
buildah-1.33.6-2.module+el8.10.0+21371+46937ece.aarch64
buildah-1.33.6-2.module+el8.10.0+21371+46937ece.ppc64le
buildah-1.33.6-2.module+el8.10.0+21371+46937ece.s390x
buildah-1.33.6-2.module+el8.10.0+21371+46937ece.x86_64
buildah-tests-1.33.6-2.module+el8.10.0+21371+46937ece.aarch64
buildah-tests-1.33.6-2.module+el8.10.0+21371+46937ece.ppc64le
buildah-tests-1.33.6-2.module+el8.10.0+21371+46937ece.s390x
buildah-tests-1.33.6-2.module+el8.10.0+21371+46937ece.x86_64
cockpit-podman-84.1-1.module+el8.10.0+21373+0d273fdf.aarch64
cockpit-podman-84.1-1.module+el8.10.0+21373+0d273fdf.ppc64le
cockpit-podman-84.1-1.module+el8.10.0+21373+0d273fdf.s390x
cockpit-podman-84.1-1.module+el8.10.0+21373+0d273fdf.x86_64
conmon-2.1.10-1.module+el8.10.0+21077+98b84d8a.aarch64
conmon-2.1.10-1.module+el8.10.0+21077+98b84d8a.ppc64le
conmon-2.1.10-1.module+el8.10.0+21077+98b84d8a.s390x
conmon-2.1.10-1.module+el8.10.0+21077+98b84d8a.x86_64
container-selinux-2.229.0-2.module+el8.10.0+21196+3f0abbca.aarch64
container-selinux-2.229.0-2.module+el8.10.0+21196+3f0abbca.ppc64le
container-selinux-2.229.0-2.module+el8.10.0+21196+3f0abbca.s390x
container-selinux-2.229.0-2.module+el8.10.0+21196+3f0abbca.x86_64
containernetworking-plugins-1.4.0-2.module+el8.10.0+21366+f9cb49f8.aarch64
containernetworking-plugins-1.4.0-2.module+el8.10.0+21366+f9cb49f8.ppc64le
containernetworking-plugins-1.4.0-2.module+el8.10.0+21366+f9cb49f8.s390x
containernetworking-plugins-1.4.0-2.module+el8.10.0+21366+f9cb49f8.x86_64
containers-common-1-81.module+el8.10.0+21340+c6c7475a.aarch64
containers-common-1-81.module+el8.10.0+21340+c6c7475a.ppc64le
containers-common-1-81.module+el8.10.0+21340+c6c7475a.s390x
containers-common-1-81.module+el8.10.0+21340+c6c7475a.x86_64
crit-3.18-4.module+el8.9.0+20326+387084d0.aarch64
crit-3.18-4.module+el8.9.0+20326+387084d0.ppc64le
crit-3.18-4.module+el8.9.0+20326+387084d0.s390x
crit-3.18-4.module+el8.9.0+20326+387084d0.x86_64
criu-3.18-4.module+el8.9.0+20326+387084d0.aarch64
criu-3.18-4.module+el8.9.0+20326+387084d0.ppc64le
criu-3.18-4.module+el8.9.0+20326+387084d0.s390x
criu-3.18-4.module+el8.9.0+20326+387084d0.x86_64
crun-1.14.3-2.module+el8.10.0+21340+c6c7475a.aarch64
crun-1.14.3-2.module+el8.10.0+21340+c6c7475a.ppc64le
crun-1.14.3-2.module+el8.10.0+21340+c6c7475a.s390x
crun-1.14.3-2.module+el8.10.0+21340+c6c7475a.x86_64
fuse-overlayfs-1.13-1.module+el8.10.0+20412+95ee28e2.aarch64
fuse-overlayfs-1.13-1.module+el8.10.0+20412+95ee28e2.ppc64le
fuse-overlayfs-1.13-1.module+el8.10.0+20412+95ee28e2.s390x
fuse-overlayfs-1.13-1.module+el8.10.0+20412+95ee28e2.x86_64
libslirp-4.4.0-1.module+el8.9.0+20326+387084d0.aarch64
libslirp-4.4.0-1.module+el8.9.0+20326+387084d0.ppc64le
libslirp-4.4.0-1.module+el8.9.0+20326+387084d0.s390x
libslirp-4.4.0-1.module+el8.9.0+20326+387084d0.x86_64
libslirp-devel-4.4.0-1.module+el8.9.0+20326+387084d0.aarch64
libslirp-devel-4.4.0-1.module+el8.9.0+20326+387084d0.ppc64le
libslirp-devel-4.4.0-1.module+el8.9.0+20326+387084d0.s390x
libslirp-devel-4.4.0-1.module+el8.9.0+20326+387084d0.x86_64
oci-seccomp-bpf-hook-1.2.10-1.module+el8.10.0+20565+a40ba0e5.aarch64
oci-seccomp-bpf-hook-1.2.10-1.module+el8.10.0+20565+a40ba0e5.ppc64le
oci-seccomp-bpf-hook-1.2.10-1.module+el8.10.0+20565+a40ba0e5.s390x
oci-seccomp-bpf-hook-1.2.10-1.module+el8.10.0+20565+a40ba0e5.x86_64
podman-4.9.4-0.1.module+el8.10.0+21350+ea09fba1.aarch64
podman-4.9.4-0.1.module+el8.10.0+21350+ea09fba1.ppc64le
podman-4.9.4-0.1.module+el8.10.0+21350+ea09fba1.s390x
podman-4.9.4-0.1.module+el8.10.0+21350+ea09fba1.x86_64
podman-catatonit-4.9.4-0.1.module+el8.10.0+21350+ea09fba1.aarch64
podman-catatonit-4.9.4-0.1.module+el8.10.0+21350+ea09fba1.ppc64le
podman-catatonit-4.9.4-0.1.module+el8.10.0+21350+ea09fba1.s390x
podman-catatonit-4.9.4-0.1.module+el8.10.0+21350+ea09fba1.x86_64
podman-docker-4.9.4-0.1.module+el8.10.0+21350+ea09fba1.aarch64
podman-docker-4.9.4-0.1.module+el8.10.0+21350+ea09fba1.ppc64le
podman-docker-4.9.4-0.1.module+el8.10.0+21350+ea09fba1.s390x
podman-docker-4.9.4-0.1.module+el8.10.0+21350+ea09fba1.x86_64
podman-plugins-4.9.4-0.1.module+el8.10.0+21350+ea09fba1.aarch64
podman-plugins-4.9.4-0.1.module+el8.10.0+21350+ea09fba1.ppc64le
podman-plugins-4.9.4-0.1.module+el8.10.0+21350+ea09fba1.s390x
podman-plugins-4.9.4-0.1.module+el8.10.0+21350+ea09fba1.x86_64
podman-remote-4.9.4-0.1.module+el8.10.0+21350+ea09fba1.aarch64
podman-remote-4.9.4-0.1.module+el8.10.0+21350+ea09fba1.ppc64le
podman-remote-4.9.4-0.1.module+el8.10.0+21350+ea09fba1.s390x
podman-remote-4.9.4-0.1.module+el8.10.0+21350+ea09fba1.x86_64
podman-tests-4.9.4-0.1.module+el8.10.0+21350+ea09fba1.aarch64
podman-tests-4.9.4-0.1.module+el8.10.0+21350+ea09fba1.ppc64le
podman-tests-4.9.4-0.1.module+el8.10.0+21350+ea09fba1.s390x
podman-tests-4.9.4-0.1.module+el8.10.0+21350+ea09fba1.x86_64
python3-criu-3.18-4.module+el8.9.0+20326+387084d0.aarch64
python3-criu-3.18-4.module+el8.9.0+20326+387084d0.ppc64le
python3-criu-3.18-4.module+el8.9.0+20326+387084d0.s390x
python3-criu-3.18-4.module+el8.9.0+20326+387084d0.x86_64
runc-1.1.12-1.module+el8.10.0+21251+62b7388c.aarch64
runc-1.1.12-1.module+el8.10.0+21251+62b7388c.ppc64le
runc-1.1.12-1.module+el8.10.0+21251+62b7388c.s390x
runc-1.1.12-1.module+el8.10.0+21251+62b7388c.x86_64
skopeo-1.14.3-0.1.module+el8.10.0+21251+62b7388c.aarch64
skopeo-1.14.3-0.1.module+el8.10.0+21251+62b7388c.ppc64le
skopeo-1.14.3-0.1.module+el8.10.0+21251+62b7388c.s390x
skopeo-1.14.3-0.1.module+el8.10.0+21251+62b7388c.x86_64
skopeo-tests-1.14.3-0.1.module+el8.10.0+21251+62b7388c.aarch64
skopeo-tests-1.14.3-0.1.module+el8.10.0+21251+62b7388c.ppc64le
skopeo-tests-1.14.3-0.1.module+el8.10.0+21251+62b7388c.s390x
skopeo-tests-1.14.3-0.1.module+el8.10.0+21251+62b7388c.x86_64
slirp4netns-1.2.3-1.module+el8.10.0+21306+6be40ce7.aarch64
slirp4netns-1.2.3-1.module+el8.10.0+21306+6be40ce7.ppc64le
slirp4netns-1.2.3-1.module+el8.10.0+21306+6be40ce7.s390x
slirp4netns-1.2.3-1.module+el8.10.0+21306+6be40ce7.x86_64
toolbox-0.0.99.5-2.module+el8.10.0+21341+ff0b5f89.aarch64
toolbox-0.0.99.5-2.module+el8.10.0+21341+ff0b5f89.ppc64le
toolbox-0.0.99.5-2.module+el8.10.0+21341+ff0b5f89.s390x
toolbox-0.0.99.5-2.module+el8.10.0+21341+ff0b5f89.x86_64
toolbox-tests-0.0.99.5-2.module+el8.10.0+21341+ff0b5f89.aarch64
toolbox-tests-0.0.99.5-2.module+el8.10.0+21341+ff0b5f89.ppc64le
toolbox-tests-0.0.99.5-2.module+el8.10.0+21341+ff0b5f89.s390x
toolbox-tests-0.0.99.5-2.module+el8.10.0+21341+ff0b5f89.x86_64
udica-0.2.6-20.module+el8.9.0+20326+387084d0.aarch64
udica-0.2.6-20.module+el8.9.0+20326+387084d0.ppc64le
udica-0.2.6-20.module+el8.9.0+20326+387084d0.s390x
udica-0.2.6-20.module+el8.9.0+20326+387084d0.x86_64
criu-devel-3.18-4.module+el8.9.0+20326+387084d0.aarch64
criu-devel-3.18-4.module+el8.9.0+20326+387084d0.ppc64le
criu-devel-3.18-4.module+el8.9.0+20326+387084d0.s390x
criu-devel-3.18-4.module+el8.9.0+20326+387084d0.x86_64
criu-libs-3.18-4.module+el8.9.0+20326+387084d0.aarch64
criu-libs-3.18-4.module+el8.9.0+20326+387084d0.ppc64le
criu-libs-3.18-4.module+el8.9.0+20326+387084d0.s390x
criu-libs-3.18-4.module+el8.9.0+20326+387084d0.x86_64
podman-gvproxy-4.9.4-0.1.module+el8.10.0+21350+ea09fba1.aarch64
podman-gvproxy-4.9.4-0.1.module+el8.10.0+21350+ea09fba1.ppc64le
podman-gvproxy-4.9.4-0.1.module+el8.10.0+21350+ea09fba1.s390x
podman-gvproxy-4.9.4-0.1.module+el8.10.0+21350+ea09fba1.x86_64
python3-podman-4.9.0-1.module+el8.10.0+21196+3f0abbca.aarch64
python3-podman-4.9.0-1.module+el8.10.0+21196+3f0abbca.ppc64le
python3-podman-4.9.0-1.module+el8.10.0+21196+3f0abbca.s390x
python3-podman-4.9.0-1.module+el8.10.0+21196+3f0abbca.x86_64
aardvark-dns-1.10.0-1.module+el8.10.0+21209+52deeb51.aarch64
aardvark-dns-1.10.0-1.module+el8.10.0+21209+52deeb51.ppc64le
aardvark-dns-1.10.0-1.module+el8.10.0+21209+52deeb51.s390x
aardvark-dns-1.10.0-1.module+el8.10.0+21209+52deeb51.x86_64
netavark-1.10.3-1.module+el8.10.0+21306+6be40ce7.aarch64
netavark-1.10.3-1.module+el8.10.0+21306+6be40ce7.ppc64le
netavark-1.10.3-1.module+el8.10.0+21306+6be40ce7.s390x
netavark-1.10.3-1.module+el8.10.0+21306+6be40ce7.x86_64