ALSA-2023:7766 - Moderate: containernetworking-plugins security update
Summary
ALSA-2023:7766: Moderate: containernetworking-plugins security update. Affects containernetworking-plugins versions < 1:1.3.0-6.el9_3. Fixed in 1:1.3.0-6.el9_3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Container Network Interface (CNI) project is a specification and library for writing plug-ins that configure network interfaces in Linux containers. It focuses on container network connectivity and resource deallocation upon container deletion.
Vulnerability Detail
This vulnerability affects the containernetworking-plugins package in AlmaLinux 9. It includes the following security issues:
- CVE-2023-29409: The golang crypto/tls library has slow verification of certificate chains containing large RSA keys.
- CVE-2023-39318: The golang html/template library improperly handles HTML-like comments within script contexts.
- CVE-2023-39319: The golang html/template library improperly handles special tags within script contexts.
- CVE-2023-39321: The golang crypto/tls library panics when processing post-handshake messages on QUIC connections.
- CVE-2023-39322: The golang crypto/tls library lacks a limit on buffered post-handshake messages.
These vulnerabilities can have various impacts and may lead to security breaches or system instability.
How To Fix
Minimum fixed version
1:1.3.0-6.el9_3
This is the first release that contains the fix.
sudo dnf update containernetworking-pluginsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The containernetworking-plugins package in AlmaLinux 9 is affected by multiple vulnerabilities. It is recommended to update the package to the latest version to mitigate these security risks. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for containernetworking-plugins →
FAQ
The Container Network Interface (CNI) project is a specification and library for configuring network interfaces in Linux containers.
These vulnerabilities can result in security breaches or system instability.
The containernetworking-plugins package in AlmaLinux 9 is affected.
To fix these vulnerabilities, update the containernetworking-plugins package to version 1.3.0-6.el9_3 or later.
No workaround is mentioned for these vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for containernetworking-plugins.
