Moderate: toolbox security and bug fix update
Summary
ALSA-2022:8098: Moderate: toolbox security and bug fix update. Affects toolbox versions < 0.0.99.3-5.el9. Fixed in 0.0.99.3-5.el9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Toolbox is a tool for Linux operating systems that enables the use of containerized command line environments. It is built on top of Podman and other standard container technologies from OCI.
Vulnerability Detail
The toolbox package is affected by several security vulnerabilities:
- CVE-2022-1705: Improper sanitization of Transfer-Encoding header in golang net/http.
- CVE-2022-30630: Stack exhaustion in Glob function in golang io/fs.
- CVE-2022-30631: Stack exhaustion in Reader.Read function in golang compress/gzip.
- CVE-2022-30632: Stack exhaustion in Glob function in golang path/filepath.
These vulnerabilities can lead to various security issues, including potential remote code execution, denial of service, and information disclosure.
How To Fix
Minimum fixed version
0.0.99.3-5.el9
This is the first release that contains the fix.
sudo dnf update toolboxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The toolbox package is affected by multiple security vulnerabilities that can have serious consequences. It is crucial to update the package to the latest version to mitigate these risks. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for toolbox →
FAQ
Toolbox is a tool for Linux operating systems that allows the use of containerized command line environments.
The security vulnerabilities in Toolbox include improper sanitization of Transfer-Encoding header, stack exhaustion in Glob and Reader.Read functions.
These vulnerabilities can lead to remote code execution, denial of service, and information disclosure.
To fix these vulnerabilities, update the toolbox package to version 0.0.99.3-5.el9 or later.
No workaround is mentioned for these vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for toolbox.
