exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Red Hat Security Advisory 2023-2236-01

Red Hat Security Advisory 2023-2236-01
Posted May 9, 2023
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2023-2236-01 - Toolbox is a tool for Linux operating systems, which allows the use of containerized command line environments. It is built on top of Podman and other standard container technologies from OCI. Issues addressed include a denial of service vulnerability.

tags | advisory, denial of service
systems | linux, redhat
advisories | CVE-2022-27664, CVE-2022-32189, CVE-2022-41717
SHA-256 | 0a296d3d6f07ee7a537f279ded5c609c8e46795c0154100f03dbfefe473e8df6

Red Hat Security Advisory 2023-2236-01

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

====================================================================
Red Hat Security Advisory

Synopsis: Moderate: toolbox security and bug fix update
Advisory ID: RHSA-2023:2236-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2023:2236
Issue date: 2023-05-09
CVE Names: CVE-2022-27664 CVE-2022-32189 CVE-2022-41717
====================================================================
1. Summary:

An update for toolbox is now available for Red Hat Enterprise Linux 9.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AppStream (v. 9) - aarch64, ppc64le, s390x, x86_64

3. Description:

Toolbox is a tool for Linux operating systems, which allows the use of
containerized command line environments. It is built on top of Podman and
other standard container technologies from OCI.

Security Fix(es):

* golang: net/http: handle server errors after sending GOAWAY
(CVE-2022-27664)

* golang: net/http: An attacker can cause excessive memory growth in a Go
server accepting HTTP/2 requests (CVE-2022-41717)

* golang: math/big: decoding big.Float and big.Rat types can panic if the
encoded message is too short, potentially allowing a denial of service
(CVE-2022-32189)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat
Enterprise Linux 9.2 Release Notes linked from the References section.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

2033282 - [RHEL9] toolbox list contains duplicate entries for images with multiple names
2113814 - CVE-2022-32189 golang: math/big: decoding big.Float and big.Rat types can panic if the encoded message is too short, potentially allowing a denial of service
2124669 - CVE-2022-27664 golang: net/http: handle server errors after sending GOAWAY
2161274 - CVE-2022-41717 golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests
2163752 - Support RHEL 9 Toolbx containers

6. Package List:

Red Hat Enterprise Linux AppStream (v. 9):

Source:
toolbox-0.0.99.3-9.el9.src.rpm

aarch64:
toolbox-0.0.99.3-9.el9.aarch64.rpm
toolbox-debuginfo-0.0.99.3-9.el9.aarch64.rpm
toolbox-debugsource-0.0.99.3-9.el9.aarch64.rpm
toolbox-tests-0.0.99.3-9.el9.aarch64.rpm

ppc64le:
toolbox-0.0.99.3-9.el9.ppc64le.rpm
toolbox-debuginfo-0.0.99.3-9.el9.ppc64le.rpm
toolbox-debugsource-0.0.99.3-9.el9.ppc64le.rpm
toolbox-tests-0.0.99.3-9.el9.ppc64le.rpm

s390x:
toolbox-0.0.99.3-9.el9.s390x.rpm
toolbox-debuginfo-0.0.99.3-9.el9.s390x.rpm
toolbox-debugsource-0.0.99.3-9.el9.s390x.rpm
toolbox-tests-0.0.99.3-9.el9.s390x.rpm

x86_64:
toolbox-0.0.99.3-9.el9.x86_64.rpm
toolbox-debuginfo-0.0.99.3-9.el9.x86_64.rpm
toolbox-debugsource-0.0.99.3-9.el9.x86_64.rpm
toolbox-tests-0.0.99.3-9.el9.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2022-27664
https://access.redhat.com/security/cve/CVE-2022-32189
https://access.redhat.com/security/cve/CVE-2022-41717
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.2_release_notes/index

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2023 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBZFo0gtzjgjWX9erEAQivcg/+NzmxQSRsNhrVrT30g6vLBqTuRR0cUBT+
ssBykONSX4QYQChIeizSunatv2125aXFlPmY8RUB8QWjHNVGuUy28S84IYsVHqBL
BjryF86B0WXDWZedx4wNGwdVVeIOmtEyg+mDA04EfwRgRJcROekzmHQM92afVpM+
n2xnBk2HRdQ00qqaruQA+WfzgVIxsoAG4AlZzvx4/6RG14WHseKhmrfrnLhp5bE1
Gi4lAI8YDrc0SqiT/acCYDGQyqcXZxMf1oJbFR0V9qTD1owRRksp9/BmOG4e6A4F
hYI8PSycLjSnTcjd91k2xqJq/zA14aqqh5eb7krjGwafFXPwtZbYr9QfwDKaQ5b0
0ueR9yiQ47JnSl77nefnHJFOKx9qkc3sr5FR9GWwalgggBgA6eBK4/jEzlknxKuf
XnxlpH7dvFKQHmKiffaExgnPP22NMlh5ABnFW8KdZa5LpIKSKHl2yeVUSIlc7Onf
VeENetzSrIJhTJ10QW1DFdoGAjAz4Uo4rPj1Kt3UfAQB9dywcXAgieyNsIWuJ0RS
Y+f5VlyYfpoFIJ1hlDvaVVUigczIB+dwVMGKsEhO8Td6Vu0x6u373gT1YI5bBn2Q
Kfrgfhpz3uxQ0GI1trcz51DW7drF2+5hY59yYc59o207DzMVYvtG1nD9VqKQCt3T
HZoEu858XnY=NsNd
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://listman.redhat.com/mailman/listinfo/rhsa-announce
Login or Register to add favorites

File Archive:

February 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Feb 1st
    16 Files
  • 2
    Feb 2nd
    19 Files
  • 3
    Feb 3rd
    0 Files
  • 4
    Feb 4th
    0 Files
  • 5
    Feb 5th
    24 Files
  • 6
    Feb 6th
    2 Files
  • 7
    Feb 7th
    10 Files
  • 8
    Feb 8th
    25 Files
  • 9
    Feb 9th
    37 Files
  • 10
    Feb 10th
    0 Files
  • 11
    Feb 11th
    0 Files
  • 12
    Feb 12th
    17 Files
  • 13
    Feb 13th
    20 Files
  • 14
    Feb 14th
    25 Files
  • 15
    Feb 15th
    15 Files
  • 16
    Feb 16th
    6 Files
  • 17
    Feb 17th
    0 Files
  • 18
    Feb 18th
    0 Files
  • 19
    Feb 19th
    35 Files
  • 20
    Feb 20th
    25 Files
  • 21
    Feb 21st
    18 Files
  • 22
    Feb 22nd
    15 Files
  • 23
    Feb 23rd
    0 Files
  • 24
    Feb 24th
    10 Files
  • 25
    Feb 25th
    0 Files
  • 26
    Feb 26th
    37 Files
  • 27
    Feb 27th
    34 Files
  • 28
    Feb 28th
    27 Files
  • 29
    Feb 29th
    8 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close