ALSA-2024:3831 - containernetworking-plugins security and bug fix update
Summary
ALSA-2024:3831: Moderate: containernetworking-plugins security and bug fix update. Affects containernetworking-plugins versions < 1:1.4.0-3.el9_4. Fixed in 1:1.4.0-3.el9_4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The containernetworking-plugins package is part of the Container Network Interface (CNI) project, which provides a specification and libraries for configuring network interfaces in Linux containers. It includes various plug-ins for managing network connectivity and resource allocation in containers. The package focuses on network connectivity and resource deallocation when containers are deleted.
Vulnerability Detail
The vulnerability identified in this package is a memory exhaustion issue in the net/http module of the Go programming language. This vulnerability is tracked as CVE-2023-45290. An attacker can exploit this vulnerability to exhaust the memory resources of the affected system by sending specially crafted HTTP requests. This can lead to denial of service (DoS) conditions and potentially impact the availability of the system.
How To Fix
Minimum fixed version
1:1.4.0-3.el9_4
This is the first release that contains the fix.
sudo dnf update containernetworking-pluginsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the provided fix by updating the containernetworking-plugins package.
Conclusion
The containernetworking-plugins package is vulnerable to a memory exhaustion issue in the net/http module. To mitigate this vulnerability, it is recommended to update the package to version 1.4.0-3.el9_4 or later. If you require further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for containernetworking-plugins →
FAQ
The Container Network Interface (CNI) project provides a specification and libraries for configuring network interfaces in Linux containers. It focuses on network connectivity and resource deallocation when containers are deleted.
This vulnerability can lead to memory exhaustion, resulting in denial of service (DoS) conditions and potentially impacting the availability of the affected system.
To fix this vulnerability, update the containernetworking-plugins package to version 1.4.0-3.el9_4 or later.
No, there is no known workaround for this vulnerability. It is crucial to apply the provided fix by updating the containernetworking-plugins package.
You can find more information about this vulnerability in the CVE-2023-45290 advisory.
Related vulnerabilities
Recent vulnerabilities recorded for containernetworking-plugins.
