RHSA-2024:3831

Security

Issued at: 2024-06-11

Synopsis

Moderate: containernetworking-plugins security and bug fix update

Description

The Container Network Interface (CNI) project consists of a specification and libraries for writing plug-ins for configuring network interfaces in Linux containers, along with a number of supported plug-ins. CNI concerns itself only with network connectivity of containers and removing allocated resources when the container is deleted.

Security Fix(es):

* golang: net/http: memory exhaustion in Request.ParseMultipartForm (CVE-2023-45290)

Affected products

Red Hat Enterprise Linux for ARM 64 - 9 Red Hat Enterprise Linux for IBM z Systems - 9 Red Hat Enterprise Linux for Power, little endian - 9 Red Hat Enterprise Linux for x86_64 - 9

Fixes

2268017

CVEs

CVE-2023-45290

Affected packages

containernetworking-plugins-1:1.4.0-3.el9_4.aarch64 containernetworking-plugins-1:1.4.0-3.el9_4.ppc64le containernetworking-plugins-1:1.4.0-3.el9_4.s390x containernetworking-plugins-1:1.4.0-3.el9_4.src containernetworking-plugins-1:1.4.0-3.el9_4.x86_64 containernetworking-plugins-debuginfo-1:1.4.0-3.el9_4.aarch64 containernetworking-plugins-debuginfo-1:1.4.0-3.el9_4.ppc64le containernetworking-plugins-debuginfo-1:1.4.0-3.el9_4.s390x containernetworking-plugins-debuginfo-1:1.4.0-3.el9_4.x86_64 containernetworking-plugins-debugsource-1:1.4.0-3.el9_4.aarch64 containernetworking-plugins-debugsource-1:1.4.0-3.el9_4.ppc64le containernetworking-plugins-debugsource-1:1.4.0-3.el9_4.s390x containernetworking-plugins-debugsource-1:1.4.0-3.el9_4.x86_64