ALSA-2023:2367 - containernetworking-plugins security and bug fix update
Summary
ALSA-2023:2367: Moderate: containernetworking-plugins security and bug fix update. Affects containernetworking-plugins versions < 1:1.2.0-1.el9. Fixed in 1:1.2.0-1.el9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Container Network Interface (CNI) project is a collection of libraries and specifications for configuring network interfaces in Linux containers. It focuses on managing network connectivity and resource allocation for containers. The containernetworking-plugins package is a set of supported plug-ins for CNI. These plug-ins enable various network configurations for containers. The package is vulnerable to two security issues: CVE-2022-41717 and CVE-2022-30629.
Vulnerability Detail
CVE-2022-41717 is a vulnerability in the golang net/http package that allows an attacker to cause excessive memory growth in a Go server accepting HTTP/2 requests. This can lead to denial-of-service attacks by consuming excessive system resources. CVE-2022-30629 is a vulnerability in the golang crypto/tls package that affects session tickets. The session tickets lack a random ticket_age_add value, which can weaken the security of TLS connections. An attacker could potentially exploit this weakness to decrypt encrypted traffic or perform other malicious activities.
How To Fix
Minimum fixed version
1:1.2.0-1.el9
This is the first release that contains the fix.
sudo dnf update containernetworking-pluginsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The containernetworking-plugins package is vulnerable to two security issues: CVE-2022-41717 and CVE-2022-30629. To mitigate these vulnerabilities, it is recommended to update the package to version 1.2.0-1.el9 or later. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for containernetworking-plugins →
FAQ
The Container Network Interface (CNI) project provides a specification and libraries for configuring network interfaces in Linux containers. It focuses on network connectivity and resource management for containers.
The containernetworking-plugins package is a collection of supported plug-ins for the Container Network Interface (CNI) project. These plug-ins enable different network configurations for containers.
CVE-2022-41717 is a vulnerability in the golang net/http package that allows an attacker to cause excessive memory growth in a Go server accepting HTTP/2 requests. It can lead to denial-of-service attacks.
CVE-2022-30629 is a vulnerability in the golang crypto/tls package that affects session tickets. The session tickets lack a random ticket_age_add value, which can weaken the security of TLS connections.
To fix the vulnerabilities, update the containernetworking-plugins package to version 1.2.0-1.el9 or later. This update includes the necessary patches to address the security issues.
Related vulnerabilities
Recent vulnerabilities recorded for containernetworking-plugins.
