access.redhat.com Open in urlscan Pro
2a02:26f0:480:d::210:f145  Public Scan

Form analysis
1 forms found in the DOM

Name: topSearchForm — GET /search/browse/search/

<form class="ng-pristine ng-valid topSearchForm" id="topSearchForm" name="topSearchForm" action="/search/browse/search/" method="get" enctype="application/x-www-form-urlencoded">
  <cp-search-autocomplete class="push-bottom PFElement" path="/webassets/avalon/j/data.json" num-items="5" placeholder="Enter your search term" pfelement="" type="container"></cp-search-autocomplete>
  <div> Or <a href="/support/cases/#/troubleshoot">troubleshoot an issue</a>. </div>
</form>

Text Content

Note: Our personalized web services require that your browser be enabled for
JavaScript and cookies
Skip to navigation Skip to main content


UTILITIES

 * Subscriptions
 * Downloads
 * Red Hat Console
 * Get Support


 * Subscriptions
 * Downloads
 * Red Hat Console
 * Get Support
 * Products
   
   
   TOP PRODUCTS
   
    * Red Hat Enterprise Linux
    * Red Hat OpenShift
    * Red Hat Ansible Automation Platform
   
   All Products
   
   
   DOWNLOADS AND CONTAINERS
   
    * Downloads
    * Packages
    * Containers
   
   
   TOP RESOURCES
   
    * Documentation
    * Product Life Cycles
    * Product Compliance
    * Errata

 * Knowledge
   
   
   RED HAT KNOWLEDGE CENTER
   
    * Knowledgebase Solutions
    * Knowledgebase Articles
    * Customer Portal Labs
    * Errata
   
   
   TOP PRODUCT DOCS
   
    * Red Hat Enterprise Linux
    * Red Hat OpenShift
    * Red Hat Ansible Automation Platform
   
   All Product Docs
   
   
   TRAINING AND CERTIFICATION
   
    * About
    * Course Index
    * Certification Index
    * Skill Assessment

 * Security
   
   
   RED HAT PRODUCT SECURITY CENTER
   
    * Security Updates
    * Security Advisories
    * Red Hat CVE Database
    * Errata
   
   
   REFERENCES
   
    * Security Bulletins
    * Security Measurement
    * Severity Ratings
    * Security Data
   
   
   TOP RESOURCES
   
    * Security Labs
    * Backporting Policies
    * Security Blog

 * Support
   
   
   RED HAT SUPPORT
   
    * Support Cases
    * Troubleshoot
    * Get Support
    * Contact Red Hat Support
   
   
   RED HAT COMMUNITY SUPPORT
   
    * Customer Portal Community
    * Community Discussions
    * Red Hat Accelerator Program
      
   
   
   TOP RESOURCES
   
    * Product Life Cycles
    * Customer Portal Labs
    * Red Hat JBoss Supported Configurations
    * Red Hat Insights

Or troubleshoot an issue.
English


SELECT YOUR LANGUAGE

 * English
 * Français
 * 한국어
 * 日本語
 * 中文 (中国)

Infrastructure and Management
 * Red Hat Enterprise Linux
 * Red Hat Satellite
 * Red Hat Subscription Management
 * Red Hat Insights
 * Red Hat Ansible Automation Platform

Cloud Computing
 * Red Hat OpenShift
 * Red Hat OpenStack Platform
 * Red Hat OpenShift
 * Red Hat OpenShift AI
 * Red Hat OpenShift Dedicated
 * Red Hat Advanced Cluster Security for Kubernetes
 * Red Hat Advanced Cluster Management for Kubernetes
 * Red Hat Quay
 * Red Hat OpenShift Dev Spaces
 * Red Hat OpenShift Service on AWS

Storage
 * Red Hat Gluster Storage
 * Red Hat Hyperconverged Infrastructure
 * Red Hat Ceph Storage
 * Red Hat OpenShift Data Foundation

Runtimes
 * Red Hat Runtimes
 * Red Hat JBoss Enterprise Application Platform
 * Red Hat Data Grid
 * Red Hat JBoss Web Server
 * Red Hat build of Keycloak
 * Red Hat support for Spring Boot
 * Red Hat build of Node.js
 * Red Hat build of Quarkus

Integration and Automation
 * Red Hat Application Foundations
 * Red Hat Fuse
 * Red Hat AMQ
 * Red Hat 3scale API Management

All Products
All Red Hat
Back to menu


QUICK LINKS: REDHAT.COM, CUSTOMER PORTAL, RED HAT'S DEVELOPER SITE, RED HAT'S
PARTNER SITE.

 * You are here
   
   
   
   
   RED HAT
   
   Learn about our open source products, services, and company.

 * You are here
   
   
   
   
   RED HAT CUSTOMER PORTAL
   
   Get product support and knowledge from the open source experts.

 * You are here
   
   
   
   
   RED HAT DEVELOPER
   
   Read developer tutorials and download Red Hat software for cloud application
   development.

 * You are here
   
   
   
   
   RED HAT PARTNER CONNECT
   
   Get training, subscriptions, certifications, and more for partners to build,
   sell, and support customer solutions.


PRODUCTS & TOOLS


 * ANSIBLE.COM
   
   Learn about and try our IT automation product.


 * RED HAT ECOSYSTEM CATALOG
   
   Find hardware, software, and cloud providers―and download container
   images―certified to perform with Red Hat technologies.


TRY, BUY, & SELL


 * RED HAT HYBRID CLOUD CONSOLE
   
   Access technical how-tos, tutorials, and learning paths focused on Red Hat’s
   hybrid cloud managed services.


 * RED HAT STORE
   
   Buy select Red Hat products and services online.


 * RED HAT MARKETPLACE
   
   Try, buy, sell, and manage certified enterprise software for container-based
   environments.


EVENTS


 * RED HAT SUMMIT AND ANSIBLEFEST
   
   Register for and learn about our annual open source IT industry event.



红帽产品勘误 RHSA-2024:9459 - Security Advisory
发布： 2024-11-12 已更新： 2024-11-12


RHSA-2024:9459 - SECURITY ADVISORY

 * 概述
 * 更新的软件包


概述

Important: buildah security update


类型/严重性

Security Advisory: Important


RED HAT INSIGHTS 补丁分析

识别并修复受此公告影响的系统。

查看受影响的系统


标题

An update for buildah is now available for Red Hat Enterprise Linux 9.


Red Hat Product Security has rated this update as having a security impact of
Important. A Common Vulnerability Scoring System (CVSS) base score, which gives
a detailed severity rating, is available for each vulnerability from the CVE
link(s) in the References section.


描述

The buildah package provides a tool for facilitating building OCI container
images. Among other things, buildah enables you to: Create a working container,
either from scratch or using an image as a starting point; Create an image,
either from a working container or using the instructions in a Dockerfile; Build
both Docker and OCI images.


Security Fix(es):


 * go/parser: golang: Calling any of the Parse functions containing deeply
   nested literals can cause a panic/stack exhaustion (CVE-2024-34155)
 * encoding/gob: golang: Calling Decoder.Decode on a message which contains
   deeply nested structures can cause a panic due to stack exhaustion
   (CVE-2024-34156)
 * go/build/constraint: golang: Calling Parse on a "// +build" build tag line
   with deeply nested expressions can cause a panic due to stack exhaustion
   (CVE-2024-34158)
 * Podman: Buildah: cri-o: FIPS Crypto-Policy Directory Mounting Issue in
   containers/common Go Library (CVE-2024-9341)
 * Buildah: Podman: Improper Input Validation in bind-propagation Option of
   Dockerfile RUN --mount Instruction (CVE-2024-9407)
 * buildah: Buildah allows arbitrary directory mount (CVE-2024-9675)
 * Podman: Buildah: CRI-O: symlink traversal vulnerability in the
   containers/storage library can cause Denial of Service (DoS) (CVE-2024-9676)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s)
listed in the References section.


解决方案

For details on how to apply this update, which includes the changes described in
this advisory, refer to:


https://access.redhat.com/articles/11258


受影响的产品

 * Red Hat Enterprise Linux for x86_64 9 x86_64
 * Red Hat Enterprise Linux for IBM z Systems 9 s390x
 * Red Hat Enterprise Linux for Power, little endian 9 ppc64le
 * Red Hat Enterprise Linux for ARM 64 9 aarch64


修复

 * BZ - 2310527 - CVE-2024-34155 go/parser: golang: Calling any of the Parse
   functions containing deeply nested literals can cause a panic/stack
   exhaustion
 * BZ - 2310528 - CVE-2024-34156 encoding/gob: golang: Calling Decoder.Decode on
   a message which contains deeply nested structures can cause a panic due to
   stack exhaustion
 * BZ - 2310529 - CVE-2024-34158 go/build/constraint: golang: Calling Parse on a
   "// +build" build tag line with deeply nested expressions can cause a panic
   due to stack exhaustion
 * BZ - 2315691 - CVE-2024-9341 Podman: Buildah: cri-o: FIPS Crypto-Policy
   Directory Mounting Issue in containers/common Go Library
 * BZ - 2315887 - CVE-2024-9407 Buildah: Podman: Improper Input Validation in
   bind-propagation Option of Dockerfile RUN --mount Instruction
 * BZ - 2317458 - CVE-2024-9675 buildah: Buildah allows arbitrary directory
   mount
 * BZ - 2317467 - CVE-2024-9676 Podman: Buildah: CRI-O: symlink traversal
   vulnerability in the containers/storage library can cause Denial of Service
   (DoS)
 * RHEL-62107 - Buildah in RHEL 9.5 is built without CNI support - [RHEL-9.5
   0day]


CVE

 * CVE-2024-9341
 * CVE-2024-9407
 * CVE-2024-9675
 * CVE-2024-9676
 * CVE-2024-34155
 * CVE-2024-34156
 * CVE-2024-34158


参考

 * https://access.redhat.com/security/updates/classification/#important

注：: 可能有这些软件包的更新版本。 点击软件包名称查看详情。


RED HAT ENTERPRISE LINUX FOR X86_64 9

SRPM buildah-1.37.5-1.el9_5.src.rpm SHA-256:
620c3a6c025acfa1936cd5b1ad5464478169e84db2777fddac1a48e9ca5b7344 x86_64
buildah-1.37.5-1.el9_5.x86_64.rpm SHA-256:
ffdf7333dbdd2dae3899566f7ac72bfc1ef513982e4b9a1c15cbf3e0725385f3
buildah-debuginfo-1.37.5-1.el9_5.x86_64.rpm SHA-256:
5d7d8eefe09b26e05c28cb478d6418f51b9ede59784546ad53716231eee74602
buildah-debugsource-1.37.5-1.el9_5.x86_64.rpm SHA-256:
9b58fcd9709f7a1f11b904aaf6eccb3adff07969eb944e9ad11b95b47d5a6bf3
buildah-tests-1.37.5-1.el9_5.x86_64.rpm SHA-256:
c79ad386e44d44be262f05659dab9b3911f69ce4aec4de2c24ae84c1604f5790
buildah-tests-debuginfo-1.37.5-1.el9_5.x86_64.rpm SHA-256:
08e15504fa4cc578feb833f13f921fba7eb35270f59b51c3ad629b1d1cee4142


RED HAT ENTERPRISE LINUX FOR IBM Z SYSTEMS 9

SRPM buildah-1.37.5-1.el9_5.src.rpm SHA-256:
620c3a6c025acfa1936cd5b1ad5464478169e84db2777fddac1a48e9ca5b7344 s390x
buildah-1.37.5-1.el9_5.s390x.rpm SHA-256:
f71e1ce726c928691d4b00562ba89c8215791567012849af14d78d8bc0d85dd3
buildah-debuginfo-1.37.5-1.el9_5.s390x.rpm SHA-256:
70be228766a87987f7644dcb271a930fe1b38eb2efbb95aab99696f7a068be22
buildah-debugsource-1.37.5-1.el9_5.s390x.rpm SHA-256:
92da9cc02b47fdec83840d0ca5fd036be010778c9d655562ad33a40e5f38b291
buildah-tests-1.37.5-1.el9_5.s390x.rpm SHA-256:
e1445b1e4e5b1c5cebaf818247c9552a01508849df598416d416f8114441f4fc
buildah-tests-debuginfo-1.37.5-1.el9_5.s390x.rpm SHA-256:
387ac66c1520f0ebf3e450f0d9206f40ea1c9b52f5c970ef641bf0251531294c


RED HAT ENTERPRISE LINUX FOR POWER, LITTLE ENDIAN 9

SRPM buildah-1.37.5-1.el9_5.src.rpm SHA-256:
620c3a6c025acfa1936cd5b1ad5464478169e84db2777fddac1a48e9ca5b7344 ppc64le
buildah-1.37.5-1.el9_5.ppc64le.rpm SHA-256:
8651fe6c8b6cb8dfdbe012558bb20216e9ace65b4900529200df87dd83336ee4
buildah-debuginfo-1.37.5-1.el9_5.ppc64le.rpm SHA-256:
21ade2a82d51f19d698e4751c9cb942071123786d01a722dd2868965e50f7c13
buildah-debugsource-1.37.5-1.el9_5.ppc64le.rpm SHA-256:
8831c24ef7ae29e045a01046ddc6f63d1ddfc08edc7999b7c942850d16abb61f
buildah-tests-1.37.5-1.el9_5.ppc64le.rpm SHA-256:
6c8001aa358f1d73380946790d12178b34a68a55633867f6a280806d03b4859c
buildah-tests-debuginfo-1.37.5-1.el9_5.ppc64le.rpm SHA-256:
9ba63427e7213ec213fabdbdd8a4c1e589c087e8cf2492a7d0d8559a8a5e7b62


RED HAT ENTERPRISE LINUX FOR ARM 64 9

SRPM buildah-1.37.5-1.el9_5.src.rpm SHA-256:
620c3a6c025acfa1936cd5b1ad5464478169e84db2777fddac1a48e9ca5b7344 aarch64
buildah-1.37.5-1.el9_5.aarch64.rpm SHA-256:
86a06a3d8835d187c2e4ffa17a2ea5670c08406b5794510ba49cf90404906b0d
buildah-debuginfo-1.37.5-1.el9_5.aarch64.rpm SHA-256:
a1c0a50f0e69d9770796f166dea038ecaf2e3222e41d63f220cf7a8fc0e4ce21
buildah-debugsource-1.37.5-1.el9_5.aarch64.rpm SHA-256:
d96e9e4c0085ffe15863a45c8e925c28452f38c6ae1ffbd59545bff6efa62630
buildah-tests-1.37.5-1.el9_5.aarch64.rpm SHA-256:
ade3cb1598f0e48ca72c94170f8c868846953e0827ba86874744f8c9e0d93ed0
buildah-tests-debuginfo-1.37.5-1.el9_5.aarch64.rpm SHA-256:
5e866387608a72fce3d5ba059674b9a0fe74051fbd4ef0f49775a36463f1b71f

Red Hat 安全团队联络方式为 secalert@redhat.com。 更多联络细节请参考
https://access.redhat.com/security/team/contact/。

X (formerly Twitter)


QUICK LINKS

 * Downloads
 * Subscriptions
 * Support Cases
 * Customer Service
 * Product Documentation


HELP

 * Contact Us
 * Customer Portal FAQ
 * Log-in Assistance


SITE INFO

 * Trust Red Hat
 * Browser Support Policy
 * Accessibility
 * Awards and Recognition
 * Colophon


RELATED SITES

 * redhat.com
 * developers.redhat.com
 * connect.redhat.com
 * cloud.redhat.com




RED HAT LEGAL AND PRIVACY LINKS

 * About Red Hat
 * Jobs
 * Events
 * Locations
 * Contact Red Hat
 * Red Hat Blog
 * Diversity, equity, and inclusion
 * Cool Stuff Store
 * Red Hat Summit

© 2024 Red Hat, Inc.


RED HAT LEGAL AND PRIVACY LINKS

 * Privacy statement
 * Terms of use
 * All policies and guidelines
 * Digital accessibility
   
   
 * Cookie-präferenzen