RHSA-2024:2988MediumCVSS 7.5

Red Hat Security Advisory: container-tools:rhel8 security update

Published
May 22, 2024
Last Modified
September 8, 2026

🔗 CVE IDs covered (16)

CVE-2021-34558 →CVE-2023-29409 →CVE-2023-39318 →CVE-2023-39322 →CVE-2022-2879 →CVE-2023-45803 →CVE-2023-48795 →CVE-2024-23650 →CVE-2023-39326 →CVE-2023-45287 →CVE-2021-33198 →CVE-2022-2880 →CVE-2022-41715 →CVE-2023-39319 →CVE-2018-25091 →CVE-2023-39321 →

📋 Description

CVE-2018-25091 — urllib3: urllib3 does not remove the authorization HTTP header when following a cross-origin redirect CVE-2021-33198 — golang: math/big.Rat: may cause a panic or an unrecoverable fatal error if passed inputs with very large exponents CVE-2021-34558 — golang: crypto/tls: certificate of wrong type is causing TLS client to panic CVE-2022-2879 — golang: archive/tar: github.com/vbatts/tar-split: unbounded memory consumption when reading headers CVE-2022-2880 — golang: net/http/httputil: ReverseProxy should not forward unparseable query parameters CVE-2022-41715 — golang: regexp/syntax: limit memory used by parsing regexps CVE-2023-29409 — golang: crypto/tls: slow verification of certificate chains containing large RSA keys CVE-2023-39318 — golang: html/template: improper handling of HTML-like comments within script contexts CVE-2023-39319 — golang: html/template: improper handling of special tags within script contexts CVE-2023-39321 — golang: crypto/tls: panic when processing post-handshake message on QUIC connections CVE-2023-39322 — golang: crypto/tls: lack of a limit on buffered post-handshake CVE-2023-39326 — golang: net/http/internal: Denial of Service (DoS) via Resource Consumption via HTTP requests CVE-2023-45287 — golang: crypto/tls: Timing Side Channel attack in RSA based TLS key exchanges. CVE-2023-45803 — urllib3: Request body not stripped after redirect from 303 status changes request method to GET CVE-2023-48795 — ssh: Prefix truncation attack on Binary Packet Protocol (BPP) CVE-2024-23650 — moby/buildkit: Possible race condition with accessing subpaths from cache mounts

🎯 Affected products200

  • Red Hat Enterprise Linux AppStream (v. 8)
  • aardvark-dns-2:1.10.0-1.module+el8.10.0+21209+52deeb51.aarch64 (container-tools:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • aardvark-dns-2:1.10.0-1.module+el8.10.0+21209+52deeb51.ppc64le (container-tools:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • aardvark-dns-2:1.10.0-1.module+el8.10.0+21209+52deeb51.s390x (container-tools:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • aardvark-dns-2:1.10.0-1.module+el8.10.0+21209+52deeb51.src (container-tools:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • aardvark-dns-2:1.10.0-1.module+el8.10.0+21209+52deeb51.x86_64 (container-tools:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • buildah-2:1.33.6-2.module+el8.10.0+21371+46937ece.aarch64 (container-tools:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • buildah-2:1.33.6-2.module+el8.10.0+21371+46937ece.ppc64le (container-tools:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • buildah-2:1.33.6-2.module+el8.10.0+21371+46937ece.s390x (container-tools:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • buildah-2:1.33.6-2.module+el8.10.0+21371+46937ece.src (container-tools:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • buildah-2:1.33.6-2.module+el8.10.0+21371+46937ece.x86_64 (container-tools:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • buildah-debuginfo-2:1.33.6-2.module+el8.10.0+21371+46937ece.aarch64 (container-tools:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • buildah-debuginfo-2:1.33.6-2.module+el8.10.0+21371+46937ece.ppc64le (container-tools:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • buildah-debuginfo-2:1.33.6-2.module+el8.10.0+21371+46937ece.s390x (container-tools:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • buildah-debuginfo-2:1.33.6-2.module+el8.10.0+21371+46937ece.x86_64 (container-tools:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • buildah-debugsource-2:1.33.6-2.module+el8.10.0+21371+46937ece.aarch64 (container-tools:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • buildah-debugsource-2:1.33.6-2.module+el8.10.0+21371+46937ece.ppc64le (container-tools:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • buildah-debugsource-2:1.33.6-2.module+el8.10.0+21371+46937ece.s390x (container-tools:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • buildah-debugsource-2:1.33.6-2.module+el8.10.0+21371+46937ece.x86_64 (container-tools:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • buildah-tests-2:1.33.6-2.module+el8.10.0+21371+46937ece.aarch64 (container-tools:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • buildah-tests-2:1.33.6-2.module+el8.10.0+21371+46937ece.ppc64le (container-tools:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • buildah-tests-2:1.33.6-2.module+el8.10.0+21371+46937ece.s390x (container-tools:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • buildah-tests-2:1.33.6-2.module+el8.10.0+21371+46937ece.x86_64 (container-tools:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • buildah-tests-debuginfo-2:1.33.6-2.module+el8.10.0+21371+46937ece.aarch64 (container-tools:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • buildah-tests-debuginfo-2:1.33.6-2.module+el8.10.0+21371+46937ece.ppc64le (container-tools:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • buildah-tests-debuginfo-2:1.33.6-2.module+el8.10.0+21371+46937ece.s390x (container-tools:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • buildah-tests-debuginfo-2:1.33.6-2.module+el8.10.0+21371+46937ece.x86_64 (container-tools:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • cockpit-podman-0:84.1-1.module+el8.10.0+21373+0d273fdf.noarch (container-tools:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • cockpit-podman-0:84.1-1.module+el8.10.0+21373+0d273fdf.src (container-tools:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • conmon-3:2.1.10-1.module+el8.10.0+21077+98b84d8a.aarch64 (container-tools:rhel8) as a component of Red Hat Enterprise Linux AppStream (v. 8)
  • +170 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: No mitigation is available for this flaw. Workaround: No current mitigation is available for this vulnerability. Workaround: Users unable to update should disable redirects for services that aren't expecting to respond with redirects with `redirects=False`, disable automatic redirects with `redirects=False`, and handle 301, 302, and 303 redirects manually by stripping the HTTP request body. Workaround: Update to the last version and check that client and server provide kex pseudo-algorithms indicating usage of the updated version of the protocol which is protected from the attack. If "[email protected]" is provided by clients and "[email protected]" is in the server's reply, no other steps are necessary. Disabling ciphers if necessary: If "[email protected]" is not provided by clients or "[email protected]" is absent in the server's reply, you can disable the following ciphers and HMACs as a workaround on RHEL-8 and RHEL-9: 1. [email protected] 2. [email protected] 3. [email protected] 4. [email protected] 5. [email protected] To do that through crypto-policies, one can apply a subpolicy with the following content: ``` cipher@SSH = -CHACHA20-POLY1305 ssh_etm = 0 ``` e.g., by putting these lines into `/etc/crypto-policies/policies/modules/CVE-2023-48795.pmod`, applying the resulting subpolicy with `update-crypto-policies --set $(update-crypto-policies --show):CVE-2023-48795` and restarting openssh server. One can verify that the changes are in effect by ensuring the ciphers listed above are missing from both `/etc/crypto-policies/back-ends/openssh.config` and `/etc/crypto-policies/back-ends/opensshserver.config`. For more details on using crypto-policies, please refer to https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/security_hardening/using-the-system-wide-cryptographic-policies_security-hardening Note that this procedure does limit the interoperability of the host and is only suggested as a temporary mitigation until the issue is fully resolved with an update. For RHEL-7: We can recommend to use strict MACs and Ciphers on RHEL7 in both files /etc/ssh/ssh_config and /etc/ssh/sshd_config. Below strict set of Ciphers and MACs can be used as mitigation for RHEL 7. ``` Ciphers aes128-ctr,aes192-ctr,aes256-ctr,[email protected],[email protected] MACs [email protected],[email protected],hmac-sha2-256,hmac-sha2-512 ``` - For Openshift Container Platform 4: Please refer the KCS[1] document for verifying the fix in RHCOS. [1] https://access.redhat.com/solutions/7071748 ~~~ NOTE: The crypto-policies workaround requires RHEL 8.5 or newer. Customers (for older RHEL 8 releases) who cannot immediately update crypto-policies packages may manually configuring Ciphers and MACs directly in /etc/ssh/sshd_config and ssh_config (as used for "RHEL-7") method documented https://access.redhat.com/solutions/7066001 ~~~~ Workaround: Avoid using untrusted input for the client or frontend syntax to minimize the vulnerability exploration.

🔗 References (27)