Red Hat Security Advisory 2023-2236-01 - Toolbox is a tool for Linux operating systems, which allows the use of containerized command line environments. It is built on top of Podman and other standard container technologies from OCI. Issues addressed include a denial of service vulnerability.
0a296d3d6f07ee7a537f279ded5c609c8e46795c0154100f03dbfefe473e8df6
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
====================================================================
Red Hat Security Advisory
Synopsis: Moderate: toolbox security and bug fix update
Advisory ID: RHSA-2023:2236-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2023:2236
Issue date: 2023-05-09
CVE Names: CVE-2022-27664 CVE-2022-32189 CVE-2022-41717
====================================================================
1. Summary:
An update for toolbox is now available for Red Hat Enterprise Linux 9.
Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat Enterprise Linux AppStream (v. 9) - aarch64, ppc64le, s390x, x86_64
3. Description:
Toolbox is a tool for Linux operating systems, which allows the use of
containerized command line environments. It is built on top of Podman and
other standard container technologies from OCI.
Security Fix(es):
* golang: net/http: handle server errors after sending GOAWAY
(CVE-2022-27664)
* golang: net/http: An attacker can cause excessive memory growth in a Go
server accepting HTTP/2 requests (CVE-2022-41717)
* golang: math/big: decoding big.Float and big.Rat types can panic if the
encoded message is too short, potentially allowing a denial of service
(CVE-2022-32189)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat
Enterprise Linux 9.2 Release Notes linked from the References section.
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
5. Bugs fixed (https://bugzilla.redhat.com/):
2033282 - [RHEL9] toolbox list contains duplicate entries for images with multiple names
2113814 - CVE-2022-32189 golang: math/big: decoding big.Float and big.Rat types can panic if the encoded message is too short, potentially allowing a denial of service
2124669 - CVE-2022-27664 golang: net/http: handle server errors after sending GOAWAY
2161274 - CVE-2022-41717 golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests
2163752 - Support RHEL 9 Toolbx containers
6. Package List:
Red Hat Enterprise Linux AppStream (v. 9):
Source:
toolbox-0.0.99.3-9.el9.src.rpm
aarch64:
toolbox-0.0.99.3-9.el9.aarch64.rpm
toolbox-debuginfo-0.0.99.3-9.el9.aarch64.rpm
toolbox-debugsource-0.0.99.3-9.el9.aarch64.rpm
toolbox-tests-0.0.99.3-9.el9.aarch64.rpm
ppc64le:
toolbox-0.0.99.3-9.el9.ppc64le.rpm
toolbox-debuginfo-0.0.99.3-9.el9.ppc64le.rpm
toolbox-debugsource-0.0.99.3-9.el9.ppc64le.rpm
toolbox-tests-0.0.99.3-9.el9.ppc64le.rpm
s390x:
toolbox-0.0.99.3-9.el9.s390x.rpm
toolbox-debuginfo-0.0.99.3-9.el9.s390x.rpm
toolbox-debugsource-0.0.99.3-9.el9.s390x.rpm
toolbox-tests-0.0.99.3-9.el9.s390x.rpm
x86_64:
toolbox-0.0.99.3-9.el9.x86_64.rpm
toolbox-debuginfo-0.0.99.3-9.el9.x86_64.rpm
toolbox-debugsource-0.0.99.3-9.el9.x86_64.rpm
toolbox-tests-0.0.99.3-9.el9.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2022-27664
https://access.redhat.com/security/cve/CVE-2022-32189
https://access.redhat.com/security/cve/CVE-2022-41717
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.2_release_notes/index
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2023 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBZFo0gtzjgjWX9erEAQivcg/+NzmxQSRsNhrVrT30g6vLBqTuRR0cUBT+
ssBykONSX4QYQChIeizSunatv2125aXFlPmY8RUB8QWjHNVGuUy28S84IYsVHqBL
BjryF86B0WXDWZedx4wNGwdVVeIOmtEyg+mDA04EfwRgRJcROekzmHQM92afVpM+
n2xnBk2HRdQ00qqaruQA+WfzgVIxsoAG4AlZzvx4/6RG14WHseKhmrfrnLhp5bE1
Gi4lAI8YDrc0SqiT/acCYDGQyqcXZxMf1oJbFR0V9qTD1owRRksp9/BmOG4e6A4F
hYI8PSycLjSnTcjd91k2xqJq/zA14aqqh5eb7krjGwafFXPwtZbYr9QfwDKaQ5b0
0ueR9yiQ47JnSl77nefnHJFOKx9qkc3sr5FR9GWwalgggBgA6eBK4/jEzlknxKuf
XnxlpH7dvFKQHmKiffaExgnPP22NMlh5ABnFW8KdZa5LpIKSKHl2yeVUSIlc7Onf
VeENetzSrIJhTJ10QW1DFdoGAjAz4Uo4rPj1Kt3UfAQB9dywcXAgieyNsIWuJ0RS
Y+f5VlyYfpoFIJ1hlDvaVVUigczIB+dwVMGKsEhO8Td6Vu0x6u373gT1YI5bBn2Q
Kfrgfhpz3uxQ0GI1trcz51DW7drF2+5hY59yYc59o207DzMVYvtG1nD9VqKQCt3T
HZoEu858XnY=NsNd
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://listman.redhat.com/mailman/listinfo/rhsa-announce