{ "document": { "aggregate_severity": { "text": "Critical" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" }, { "category": "details", "text": "rebuild with newer golang version 1.25.7-1.el9_6.tuxcare.els1 to fix the following CVEs\n - CVE-2025-68121: fix TLS session resumption bypass by preventing shared\n auto-rotated ticket keys in Config and validating full certificate chain expiry\n - CVE-2025-61726: limit parsed URL query parameters to mitigate excessive memory\n consumption during form parsing\n - CVE-2025-61728: fix denial-of-service in archive/zip by replacing super-linear\n index construction with an efficient algorithm\n - CVE-2025-61729: fix excessive resource consumption when constructing hostname\n error messages for certificates with many SANs", "title": "Details" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "https://cve.tuxcare.com/els/releases/CLSA-2026:1772465492", "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1772465492" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_os/tuxcare9.6esu/advisories/2026/clsa-2026_1772465492.json" } ], "tracking": { "current_release_date": "2026-04-20T17:30:08Z", "generator": { "date": "2026-04-20T17:30:08Z", "engine": { "name": "pyCSAF" } }, "id": "CLSA-2026:1772465492", "initial_release_date": "2026-03-02T15:32:28Z", "revision_history": [ { "date": "2026-03-02T15:32:28Z", "number": "1", "summary": "Initial version" }, { "date": "2026-04-20T17:30:08Z", "number": "2", "summary": "Update document" } ], "status": "final", "version": "2" }, "title": "podman: Fix of 4 CVEs" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "AlmaLinux 9.6", "product": { "name": "AlmaLinux 9.6", "product_id": "AlmaLinux-9.6", "product_identification_helper": { "cpe": "cpe:2.3:o:almalinux:almalinux:9.6:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "AlmaLinux" } ], "category": "vendor", "name": "AlmaLinux OS Foundation" }, { "branches": [ { "branches": [ { "category": "product_name", "name": "Rocky Linux 9.6", "product": { "name": "Rocky Linux 9.6", "product_id": "Rocky Linux-9.6", "product_identification_helper": { "cpe": "cpe:2.3:o:resf:rocky_linux:9.6:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Rocky Linux" } ], "category": "vendor", "name": "Rocky Linux" }, { "branches": [ { "branches": [ { "category": "product_version", "name": "podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "product": { "name": "podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "product_id": "podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/podman-tests@5.4.0-13.el9_6.tuxcare.els3?arch=x86_64&epoch=5" } } }, { "category": "product_version", "name": "podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "product": { "name": "podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "product_id": "podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/podman@5.4.0-13.el9_6.tuxcare.els3?arch=x86_64&epoch=5" } } }, { "category": "product_version", "name": "podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "product": { "name": "podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "product_id": "podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/podman-remote@5.4.0-13.el9_6.tuxcare.els3?arch=x86_64&epoch=5" } } }, { "category": "product_version", "name": "podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "product": { "name": "podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "product_id": "podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/podman-plugins@5.4.0-13.el9_6.tuxcare.els3?arch=x86_64&epoch=5" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "product": { "name": "podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "product_id": "podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/podman-docker@5.4.0-13.el9_6.tuxcare.els3?arch=noarch&epoch=5" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "TuxCare" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64 as a component of AlmaLinux 9.6", "product_id": "AlmaLinux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64" }, "product_reference": "podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "relates_to_product_reference": "AlmaLinux-9.6" }, { "category": "default_component_of", "full_product_name": { "name": "podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64 as a component of AlmaLinux 9.6", "product_id": "AlmaLinux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64" }, "product_reference": "podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "relates_to_product_reference": "AlmaLinux-9.6" }, { "category": "default_component_of", "full_product_name": { "name": "podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64 as a component of AlmaLinux 9.6", "product_id": "AlmaLinux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64" }, "product_reference": "podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "relates_to_product_reference": "AlmaLinux-9.6" }, { "category": "default_component_of", "full_product_name": { "name": "podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch as a component of AlmaLinux 9.6", "product_id": "AlmaLinux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch" }, "product_reference": "podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "relates_to_product_reference": "AlmaLinux-9.6" }, { "category": "default_component_of", "full_product_name": { "name": "podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64 as a component of AlmaLinux 9.6", "product_id": "AlmaLinux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64" }, "product_reference": "podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "relates_to_product_reference": "AlmaLinux-9.6" }, { "category": "default_component_of", "full_product_name": { "name": "podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64 as a component of Rocky Linux 9.6", "product_id": "Rocky Linux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64" }, "product_reference": "podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "relates_to_product_reference": "Rocky Linux-9.6" }, { "category": "default_component_of", "full_product_name": { "name": "podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64 as a component of Rocky Linux 9.6", "product_id": "Rocky Linux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64" }, "product_reference": "podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "relates_to_product_reference": "Rocky Linux-9.6" }, { "category": "default_component_of", "full_product_name": { "name": "podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64 as a component of Rocky Linux 9.6", "product_id": "Rocky Linux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64" }, "product_reference": "podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "relates_to_product_reference": "Rocky Linux-9.6" }, { "category": "default_component_of", "full_product_name": { "name": "podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch as a component of Rocky Linux 9.6", "product_id": "Rocky Linux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch" }, "product_reference": "podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "relates_to_product_reference": "Rocky Linux-9.6" }, { "category": "default_component_of", "full_product_name": { "name": "podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64 as a component of Rocky Linux 9.6", "product_id": "Rocky Linux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64" }, "product_reference": "podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "relates_to_product_reference": "Rocky Linux-9.6" } ] }, "vulnerabilities": [ { "cve": "CVE-2023-24536", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "notes": [ { "category": "description", "text": "Multipart form parsing can consume large amounts of CPU and memory when processing form inputs containing very large numbers of parts. This stems from several causes: 1. mime/multipart.Reader.ReadForm limits the total memory a parsed multipart form can consume. ReadForm can undercount the amount of memory consumed, leading it to accept larger inputs than intended. 2. Limiting total memory does not account for increased pressure on the garbage collector from large numbers of small allocations in forms with many parts. 3. ReadForm can allocate a large number of short-lived buffers, further increasing pressure on the garbage collector. The combination of these factors can permit an attacker to cause an program that parses multipart forms to consume large amounts of CPU and memory, potentially resulting in a denial of service. This affects programs that use mime/multipart.Reader.ReadForm, as well as form parsing in the net/http package with the Request methods FormFile, FormValue, ParseMultipartForm, and PostFormValue. With fix, ReadForm now does a better job of estimating the memory consumption of parsed forms, and performs many fewer short-lived allocations. In addition, the fixed mime/multipart.Reader imposes the following limits on the size of parsed forms: 1. Forms parsed with ReadForm may contain no more than 1000 parts. This limit may be adjusted with the environment variable GODEBUG=multipartmaxparts=. 2. Form parts parsed with NextPart and NextRawPart may contain no more than 10,000 header fields. In addition, forms parsed with ReadForm may contain no more than 10,000 header fields across all parts. This limit may be adjusted with the environment variable GODEBUG=multipartmaxheaders=.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AlmaLinux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "AlmaLinux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "Rocky Linux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2023-24536" }, { "category": "external", "summary": "https://go.dev/cl/482075", "url": "https://go.dev/cl/482075" }, { "category": "external", "summary": "https://go.dev/cl/482076", "url": "https://go.dev/cl/482076" }, { "category": "external", "summary": "https://go.dev/cl/482077", "url": "https://go.dev/cl/482077" }, { "category": "external", "summary": "https://go.dev/issue/59153", "url": "https://go.dev/issue/59153" }, { "category": "external", "summary": "https://groups.google.com/g/golang-announce/c/Xdv6JL9ENs8", "url": "https://groups.google.com/g/golang-announce/c/Xdv6JL9ENs8" }, { "category": "external", "summary": "https://pkg.go.dev/vuln/GO-2023-1705", "url": "https://pkg.go.dev/vuln/GO-2023-1705" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202311-09", "url": "https://security.gentoo.org/glsa/202311-09" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20230526-0007/", "url": "https://security.netapp.com/advisory/ntap-20230526-0007/" } ], "release_date": "2023-04-06T16:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-03-02T15:31:35.656958Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1772465492", "product_ids": [ "AlmaLinux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "AlmaLinux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "Rocky Linux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1772465492" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AlmaLinux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "AlmaLinux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "Rocky Linux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2024-34156", "cwe": { "id": "CWE-674", "name": "Uncontrolled Recursion" }, "notes": [ { "category": "description", "text": "Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AlmaLinux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "AlmaLinux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "Rocky Linux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2024-34156" } ], "release_date": "2024-09-06T21:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-03-02T15:31:35.656958Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1772465492", "product_ids": [ "AlmaLinux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "AlmaLinux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "Rocky Linux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1772465492" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AlmaLinux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "AlmaLinux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "Rocky Linux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2023-45287", "cwe": { "id": "CWE-203", "name": "Observable Discrepancy" }, "notes": [ { "category": "description", "text": "Before Go 1.20, the RSA based TLS key exchanges used the math/big library, which is not constant time. RSA blinding was applied to prevent timing attacks, but analysis shows this may not have been fully effective. In particular it appears as if the removal of PKCS#1 padding may leak timing information, which in turn could be used to recover session key bits. In Go 1.20, the crypto/tls library switched to a fully constant time RSA implementation, which we do not believe exhibits any timing side channels.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AlmaLinux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "AlmaLinux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "Rocky Linux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2023-45287" }, { "category": "external", "summary": "https://go.dev/cl/326012/26", "url": "https://go.dev/cl/326012/26" }, { "category": "external", "summary": "https://go.dev/issue/20654", "url": "https://go.dev/issue/20654" }, { "category": "external", "summary": "https://groups.google.com/g/golang-announce/c/QMK8IQALDvA", "url": "https://groups.google.com/g/golang-announce/c/QMK8IQALDvA" }, { "category": "external", "summary": "https://people.redhat.com/~hkario/marvin/", "url": "https://people.redhat.com/~hkario/marvin/" }, { "category": "external", "summary": "https://pkg.go.dev/vuln/GO-2023-2375", "url": "https://pkg.go.dev/vuln/GO-2023-2375" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20240112-0005/", "url": "https://security.netapp.com/advisory/ntap-20240112-0005/" } ], "release_date": "2023-12-05T17:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-03-02T15:31:35.656958Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1772465492", "product_ids": [ "AlmaLinux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "AlmaLinux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "Rocky Linux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1772465492" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "AlmaLinux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "AlmaLinux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "Rocky Linux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2025-61729", "cwe": { "id": "CWE-1050", "name": "Excessive Platform Resource Consumption within a Loop" }, "notes": [ { "category": "description", "text": "Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime. Therefore, a certificate provided by a malicious actor can result in excessive resource consumption.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AlmaLinux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "AlmaLinux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "Rocky Linux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-61729" } ], "release_date": "2025-12-02T18:54:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-03-02T15:31:35.656958Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1772465492", "product_ids": [ "AlmaLinux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "AlmaLinux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "Rocky Linux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1772465492" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AlmaLinux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "AlmaLinux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "Rocky Linux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2023-39321", "notes": [ { "category": "description", "text": "Processing an incomplete post-handshake message for a QUIC connection can cause a panic.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AlmaLinux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "AlmaLinux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "Rocky Linux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2023-39321" }, { "category": "external", "summary": "https://go.dev/cl/523039", "url": "https://go.dev/cl/523039" }, { "category": "external", "summary": "https://go.dev/issue/62266", "url": "https://go.dev/issue/62266" }, { "category": "external", "summary": "https://groups.google.com/g/golang-dev/c/2C5vbR-UNkI/m/L1hdrPhfBAAJ", "url": "https://groups.google.com/g/golang-dev/c/2C5vbR-UNkI/m/L1hdrPhfBAAJ" }, { "category": "external", "summary": "https://pkg.go.dev/vuln/GO-2023-2044", "url": "https://pkg.go.dev/vuln/GO-2023-2044" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202311-09", "url": "https://security.gentoo.org/glsa/202311-09" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20231020-0004/", "url": "https://security.netapp.com/advisory/ntap-20231020-0004/" } ], "release_date": "2023-09-08T17:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-03-02T15:31:35.656958Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1772465492", "product_ids": [ "AlmaLinux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "AlmaLinux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "Rocky Linux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1772465492" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AlmaLinux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "AlmaLinux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "Rocky Linux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2025-68121", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "notes": [ { "category": "description", "text": "During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user calls Config.Clone and mutates the returned Config, or uses Config.GetConfigForClient. This can cause a client to resume a session with a server that it would not have resumed with during the initial handshake, or cause a server to resume a session with a client that it would not have resumed with during the initial handshake.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AlmaLinux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "AlmaLinux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "Rocky Linux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-68121" }, { "category": "external", "summary": "https://go.dev/cl/737700", "url": "https://go.dev/cl/737700" }, { "category": "external", "summary": "https://go.dev/issue/77217", "url": "https://go.dev/issue/77217" }, { "category": "external", "summary": "https://groups.google.com/g/golang-announce/c/K09ubi9FQFk", "url": "https://groups.google.com/g/golang-announce/c/K09ubi9FQFk" }, { "category": "external", "summary": "https://pkg.go.dev/vuln/GO-2026-4337", "url": "https://pkg.go.dev/vuln/GO-2026-4337" } ], "release_date": "2026-02-05T18:16:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-03-02T15:31:35.656958Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1772465492", "product_ids": [ "AlmaLinux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "AlmaLinux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "Rocky Linux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1772465492" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 10.0, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "version": "3.1" }, "products": [ "AlmaLinux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "AlmaLinux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "Rocky Linux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Critical" } ] }, { "cve": "CVE-2025-61728", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "notes": [ { "category": "description", "text": "archive/zip uses a super-linear file name indexing algorithm that is invoked the first time a file in an archive is opened. This can lead to a denial of service when consuming a maliciously constructed ZIP archive.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AlmaLinux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "AlmaLinux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "Rocky Linux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-61728" } ], "release_date": "2026-01-28T19:30:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-03-02T15:31:35.656958Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1772465492", "product_ids": [ "AlmaLinux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "AlmaLinux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "Rocky Linux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1772465492" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AlmaLinux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "AlmaLinux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "Rocky Linux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2023-24539", "cwe": { "id": "CWE-74", "name": "Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')" }, "notes": [ { "category": "description", "text": "Angle brackets (<>) are not considered dangerous characters when inserted into CSS contexts. Templates containing multiple actions separated by a '/' character can result in unexpectedly closing the CSS context and allowing for injection of unexpected HTML, if executed with untrusted input.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AlmaLinux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "AlmaLinux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "Rocky Linux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2023-24539" }, { "category": "external", "summary": "https://go.dev/cl/491615", "url": "https://go.dev/cl/491615" }, { "category": "external", "summary": "https://go.dev/issue/59720", "url": "https://go.dev/issue/59720" }, { "category": "external", "summary": "https://groups.google.com/g/golang-announce/c/MEb0UyuSMsU", "url": "https://groups.google.com/g/golang-announce/c/MEb0UyuSMsU" }, { "category": "external", "summary": "https://pkg.go.dev/vuln/GO-2023-1751", "url": "https://pkg.go.dev/vuln/GO-2023-1751" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20241129-0005/", "url": "https://security.netapp.com/advisory/ntap-20241129-0005/" } ], "release_date": "2023-05-11T16:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-03-02T15:31:35.656958Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1772465492", "product_ids": [ "AlmaLinux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "AlmaLinux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "Rocky Linux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1772465492" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "AlmaLinux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "AlmaLinux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "Rocky Linux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2023-39322", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "notes": [ { "category": "description", "text": "QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC connection to cause unbounded memory growth. With fix, connections now consistently reject messages larger than 65KiB in size.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AlmaLinux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "AlmaLinux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "Rocky Linux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2023-39322" }, { "category": "external", "summary": "https://go.dev/cl/523039", "url": "https://go.dev/cl/523039" }, { "category": "external", "summary": "https://go.dev/issue/62266", "url": "https://go.dev/issue/62266" }, { "category": "external", "summary": "https://groups.google.com/g/golang-dev/c/2C5vbR-UNkI/m/L1hdrPhfBAAJ", "url": "https://groups.google.com/g/golang-dev/c/2C5vbR-UNkI/m/L1hdrPhfBAAJ" }, { "category": "external", "summary": "https://pkg.go.dev/vuln/GO-2023-2045", "url": "https://pkg.go.dev/vuln/GO-2023-2045" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202311-09", "url": "https://security.gentoo.org/glsa/202311-09" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20231020-0004/", "url": "https://security.netapp.com/advisory/ntap-20231020-0004/" } ], "release_date": "2023-09-08T17:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-03-02T15:31:35.656958Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1772465492", "product_ids": [ "AlmaLinux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "AlmaLinux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "Rocky Linux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1772465492" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AlmaLinux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "AlmaLinux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "Rocky Linux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2023-24537", "cwe": { "id": "CWE-190", "name": "Integer Overflow or Wraparound" }, "notes": [ { "category": "description", "text": "Calling any of the Parse functions on Go source code which contains //line directives with very large line numbers can cause an infinite loop due to integer overflow.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AlmaLinux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "AlmaLinux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "Rocky Linux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2023-24537" }, { "category": "external", "summary": "https://go.dev/cl/482078", "url": "https://go.dev/cl/482078" }, { "category": "external", "summary": "https://go.dev/issue/59180", "url": "https://go.dev/issue/59180" }, { "category": "external", "summary": "https://groups.google.com/g/golang-announce/c/Xdv6JL9ENs8", "url": "https://groups.google.com/g/golang-announce/c/Xdv6JL9ENs8" }, { "category": "external", "summary": "https://pkg.go.dev/vuln/GO-2023-1702", "url": "https://pkg.go.dev/vuln/GO-2023-1702" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202311-09", "url": "https://security.gentoo.org/glsa/202311-09" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20241129-0004/", "url": "https://security.netapp.com/advisory/ntap-20241129-0004/" } ], "release_date": "2023-04-06T16:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-03-02T15:31:35.656958Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1772465492", "product_ids": [ "AlmaLinux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "AlmaLinux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "Rocky Linux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1772465492" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AlmaLinux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "AlmaLinux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "Rocky Linux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2024-1394", "cwe": { "id": "CWE-401", "name": "Missing Release of Memory after Effective Lifetime" }, "notes": [ { "category": "description", "text": "A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled inputs​. The memory leak happens in github.com/golang-fips/openssl/openssl/rsa.go#L113. The objects leaked are pkey​ and ctx​. That function uses named return parameters to free pkey​ and ctx​ if there is an error initializing the context or setting the different properties. All return statements related to error cases follow the \"return nil, nil, fail(...)\" pattern, meaning that pkey​ and ctx​ will be nil inside the deferred function that should free them.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AlmaLinux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "AlmaLinux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "Rocky Linux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2024-1394" } ], "release_date": "2024-03-20T00:00:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-03-02T15:31:35.656958Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1772465492", "product_ids": [ "AlmaLinux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "AlmaLinux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "Rocky Linux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1772465492" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AlmaLinux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "AlmaLinux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "Rocky Linux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2022-41724", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "notes": [ { "category": "description", "text": "Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS handshake records which cause servers and clients, respectively, to panic when attempting to construct responses. This affects all TLS 1.3 clients, TLS 1.2 clients which explicitly enable session resumption (by setting Config.ClientSessionCache to a non-nil value), and TLS 1.3 servers which request client certificates (by setting Config.ClientAuth >= RequestClientCert).", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AlmaLinux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "AlmaLinux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "Rocky Linux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2022-41724" }, { "category": "external", "summary": "https://go.dev/cl/468125", "url": "https://go.dev/cl/468125" }, { "category": "external", "summary": "https://go.dev/issue/58001", "url": "https://go.dev/issue/58001" }, { "category": "external", "summary": "https://groups.google.com/g/golang-announce/c/V0aBFqaFs_E", "url": "https://groups.google.com/g/golang-announce/c/V0aBFqaFs_E" }, { "category": "external", "summary": "https://pkg.go.dev/vuln/GO-2023-1570", "url": "https://pkg.go.dev/vuln/GO-2023-1570" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202311-09", "url": "https://security.gentoo.org/glsa/202311-09" } ], "release_date": "2023-02-28T18:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-03-02T15:31:35.656958Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1772465492", "product_ids": [ "AlmaLinux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "AlmaLinux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "Rocky Linux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1772465492" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AlmaLinux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "AlmaLinux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "Rocky Linux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2022-41725", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "notes": [ { "category": "description", "text": "A denial of service is possible from excessive resource consumption in net/http and mime/multipart. Multipart form parsing with mime/multipart.Reader.ReadForm can consume largely unlimited amounts of memory and disk files. This also affects form parsing in the net/http package with the Request methods FormFile, FormValue, ParseMultipartForm, and PostFormValue. ReadForm takes a maxMemory parameter, and is documented as storing \"up to maxMemory bytes +10MB (reserved for non-file parts) in memory\". File parts which cannot be stored in memory are stored on disk in temporary files. The unconfigurable 10MB reserved for non-file parts is excessively large and can potentially open a denial of service vector on its own. However, ReadForm did not properly account for all memory consumed by a parsed form, such as map entry overhead, part names, and MIME headers, permitting a maliciously crafted form to consume well over 10MB. In addition, ReadForm contained no limit on the number of disk files created, permitting a relatively small request body to create a large number of disk temporary files. With fix, ReadForm now properly accounts for various forms of memory overhead, and should now stay within its documented limit of 10MB + maxMemory bytes of memory consumption. Users should still be aware that this limit is high and may still be hazardous. In addition, ReadForm now creates at most one on-disk temporary file, combining multiple form parts into a single temporary file. The mime/multipart.File interface type's documentation states, \"If stored on disk, the File's underlying concrete type will be an *os.File.\". This is no longer the case when a form contains more than one file part, due to this coalescing of parts into a single file. The previous behavior of using distinct files for each form part may be reenabled with the environment variable GODEBUG=multipartfiles=distinct. Users should be aware that multipart.ReadForm and the http.Request methods that call it do not limit the amount of disk consumed by temporary files. Callers can limit the size of form data with http.MaxBytesReader.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AlmaLinux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "AlmaLinux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "Rocky Linux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2022-41725" }, { "category": "external", "summary": "https://go.dev/cl/468124", "url": "https://go.dev/cl/468124" }, { "category": "external", "summary": "https://go.dev/issue/58006", "url": "https://go.dev/issue/58006" }, { "category": "external", "summary": "https://groups.google.com/g/golang-announce/c/V0aBFqaFs_E", "url": "https://groups.google.com/g/golang-announce/c/V0aBFqaFs_E" }, { "category": "external", "summary": "https://pkg.go.dev/vuln/GO-2023-1569", "url": "https://pkg.go.dev/vuln/GO-2023-1569" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202311-09", "url": "https://security.gentoo.org/glsa/202311-09" } ], "release_date": "2023-02-28T18:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-03-02T15:31:35.656958Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1772465492", "product_ids": [ "AlmaLinux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "AlmaLinux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "Rocky Linux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1772465492" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AlmaLinux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "AlmaLinux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "Rocky Linux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2025-61726", "cwe": { "id": "CWE-770", "name": "Allocation of Resources Without Limits or Throttling" }, "notes": [ { "category": "description", "text": "The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded forms. Parsing a large form containing many unique query parameters can cause excessive memory consumption.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AlmaLinux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "AlmaLinux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "Rocky Linux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2025-61726" } ], "release_date": "2026-01-28T19:30:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-03-02T15:31:35.656958Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1772465492", "product_ids": [ "AlmaLinux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "AlmaLinux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "Rocky Linux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1772465492" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AlmaLinux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "AlmaLinux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "Rocky Linux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2023-29400", "cwe": { "id": "CWE-74", "name": "Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')" }, "notes": [ { "category": "description", "text": "Templates containing actions in unquoted HTML attributes (e.g. \"attr={{.}}\") executed with empty input can result in output with unexpected results when parsed due to HTML normalization rules. This may allow injection of arbitrary attributes into tags.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AlmaLinux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "AlmaLinux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "Rocky Linux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2023-29400" }, { "category": "external", "summary": "https://go.dev/cl/491617", "url": "https://go.dev/cl/491617" }, { "category": "external", "summary": "https://go.dev/issue/59722", "url": "https://go.dev/issue/59722" }, { "category": "external", "summary": "https://groups.google.com/g/golang-announce/c/MEb0UyuSMsU", "url": "https://groups.google.com/g/golang-announce/c/MEb0UyuSMsU" }, { "category": "external", "summary": "https://pkg.go.dev/vuln/GO-2023-1753", "url": "https://pkg.go.dev/vuln/GO-2023-1753" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20241213-0005/", "url": "https://security.netapp.com/advisory/ntap-20241213-0005/" } ], "release_date": "2023-05-11T16:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-03-02T15:31:35.656958Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1772465492", "product_ids": [ "AlmaLinux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "AlmaLinux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "Rocky Linux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1772465492" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "AlmaLinux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "AlmaLinux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "Rocky Linux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] }, { "cve": "CVE-2023-24534", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "notes": [ { "category": "description", "text": "HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of service. Certain unusual patterns of input data can cause the common function used to parse HTTP and MIME headers to allocate substantially more memory than required to hold the parsed headers. An attacker can exploit this behavior to cause an HTTP server to allocate large amounts of memory from a small request, potentially leading to memory exhaustion and a denial of service. With fix, header parsing now correctly allocates only the memory required to hold parsed headers.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AlmaLinux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "AlmaLinux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "Rocky Linux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2023-24534" }, { "category": "external", "summary": "https://go.dev/cl/481994", "url": "https://go.dev/cl/481994" }, { "category": "external", "summary": "https://go.dev/issue/58975", "url": "https://go.dev/issue/58975" }, { "category": "external", "summary": "https://groups.google.com/g/golang-announce/c/Xdv6JL9ENs8", "url": "https://groups.google.com/g/golang-announce/c/Xdv6JL9ENs8" }, { "category": "external", "summary": "https://pkg.go.dev/vuln/GO-2023-1704", "url": "https://pkg.go.dev/vuln/GO-2023-1704" }, { "category": "external", "summary": "https://security.gentoo.org/glsa/202311-09", "url": "https://security.gentoo.org/glsa/202311-09" }, { "category": "external", "summary": "https://security.netapp.com/advisory/ntap-20230526-0007/", "url": "https://security.netapp.com/advisory/ntap-20230526-0007/" } ], "release_date": "2023-04-06T16:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-03-02T15:31:35.656958Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1772465492", "product_ids": [ "AlmaLinux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "AlmaLinux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "Rocky Linux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1772465492" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "AlmaLinux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "AlmaLinux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "AlmaLinux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-docker-5:5.4.0-13.el9_6.tuxcare.els3.noarch", "Rocky Linux-9.6:podman-plugins-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-remote-5:5.4.0-13.el9_6.tuxcare.els3.x86_64", "Rocky Linux-9.6:podman-tests-5:5.4.0-13.el9_6.tuxcare.els3.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] } ] }