ALSA-2023:2236

Dashboard / Vulnerabilities / ALSA-2023:2236

ALSA-2023:2236

Summary: Moderate: toolbox security and bug fix update

Details: Toolbox is a tool for Linux operating systems, which allows the use of containerized command line environments. It is built on top of Podman and other standard container technologies from OCI. Security Fix(es): * golang: net/http: handle server errors after sending GOAWAY (CVE-2022-27664) * golang: net/http: An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests (CVE-2022-41717) * golang: math/big: decoding big.Float and big.Rat types can panic if the encoded message is too short, potentially allowing a denial of service (CVE-2022-32189) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

References: https://access.redhat.com/errata/RHSA-2023:2236, https://access.redhat.com/security/cve/CVE-2022-27664, https://access.redhat.com/security/cve/CVE-2022-32189, https://access.redhat.com/security/cve/CVE-2022-41717, https://bugzilla.redhat.com/2113814, https://bugzilla.redhat.com/2124669, https://bugzilla.redhat.com/2161274, https://errata.almalinux.org/9/ALSA-2023-2236.html