CVE-2024-24788

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

• golang: net: malformed DNS message can cause infinite loop (CVE-2024-24788)

• golang: archive/zip: Incorrect handling of certain ZIP files (CVE-2024-24789)

• golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses (CVE-2024-24790)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

• golang: net/http: memory exhaustion in Request.ParseMultipartForm (CVE-2023-45290)

• golang: crypto/x509: Verify panics on certificates with an unknown public key algorithm (CVE-2024-24783)

• golang: net/mail: comments in display names are incorrectly handled (CVE-2024-24784)

• golang: net: malformed DNS message can cause infinite loop (CVE-2024-24788)

• net/http: Denial of service due to improper 100-continue handling in net/http (CVE-2024-24791)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.

Security Fix(es):

• golang: crypto/tls: panic when processing post-handshake message on QUIC connections (CVE-2023-39321)

• golang: crypto/tls: lack of a limit on buffered post-handshake (CVE-2023-39322)

• golang: net: malformed DNS message can cause infinite loop (CVE-2024-24788)

• golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses (CVE-2024-24790)

• net/http: Denial of service due to improper 100-continue handling in net/http (CVE-2024-24791)

• golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 9 Release Notes linked from the References section.

A malformed DNS message in response to a query can cause the Lookup functions to get stuck in an infinite loop.

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

• golang: net: malformed DNS message can cause infinite loop (CVE-2024-24788)
• golang: archive/zip: Incorrect handling of certain ZIP files (CVE-2024-24789)
• golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses (CVE-2024-24790)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

• golang: net/http: memory exhaustion in Request.ParseMultipartForm (CVE-2023-45290)
• golang: crypto/x509: Verify panics on certificates with an unknown public key algorithm (CVE-2024-24783)
• golang: net/mail: comments in display names are incorrectly handled (CVE-2024-24784)
• golang: net: malformed DNS message can cause infinite loop (CVE-2024-24788)
• net/http: Denial of service due to improper 100-continue handling in net/http (CVE-2024-24791)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The Container Network Interface (CNI) project consists of a specification and libraries for writing plug-ins for configuring network interfaces in Linux containers, along with a number of supported plug-ins. CNI concerns itself only with network connectivity of containers and removing allocated resources when the container is deleted.

Security Fix(es):

• golang: net: malformed DNS message can cause infinite loop (CVE-2024-24788)
• net/http: Denial of service due to improper 100-continue handling in net/http (CVE-2024-24791)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files.

Security Fix(es):

• containers/image: digest type does not guarantee valid type (CVE-2024-3727)
• golang: net: malformed DNS message can cause infinite loop (CVE-2024-24788)
• go-retryablehttp: url might write sensitive information to log file (CVE-2024-6104)
• net/http: Denial of service due to improper 100-continue handling in net/http (CVE-2024-24791)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

• golang: net: malformed DNS message can cause infinite loop (CVE-2024-24788)
• golang: archive/zip: Incorrect handling of certain ZIP files (CVE-2024-24789)
• golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses (CVE-2024-24790)
• go-retryablehttp: url might write sensitive information to log file (CVE-2024-6104)
• net/http: Denial of service due to improper 100-continue handling in net/http (CVE-2024-24791)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Toolbox is a tool for Linux operating systems, which allows the use of containerized command line environments. It is built on top of Podman and other standard container technologies from OCI.

Security Fix(es):

• golang: net/http: golang: mime/multipart: golang: net/textproto: memory exhaustion in Request.ParseMultipartForm (CVE-2023-45290)
• golang: html/template: errors returned from MarshalJSON methods may break template escaping (CVE-2024-24785)
• golang: net: malformed DNS message can cause infinite loop (CVE-2024-24788)
• net/http: Denial of service due to improper 100-continue handling in net/http (CVE-2024-24791)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

The runC tool is a lightweight, portable implementation of the Open Container Format (OCF) that provides container runtime.

Security Fix(es):

• golang: net: malformed DNS message can cause infinite loop (CVE-2024-24788)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

OCI Hook to generate seccomp json files based on EBF syscalls used by container oci-seccomp-bpf-hook provides a library for applications looking to use the Container Pod concept popularized by Kubernetes.

Security Fix(es):

• golang: net: malformed DNS message can cause infinite loop (CVE-2024-24788)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.

Security Fix(es):

• golang: crypto/tls: panic when processing post-handshake message on QUIC connections (CVE-2023-39321)
• golang: crypto/tls: lack of a limit on buffered post-handshake (CVE-2023-39322)
• golang: net: malformed DNS message can cause infinite loop (CVE-2024-24788)
• golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses (CVE-2024-24790)
• net/http: Denial of service due to improper 100-continue handling in net/http (CVE-2024-24791)
• golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinuxRelease Notes linked from the References section.

A malformed DNS message in response to a query can cause the Lookup functions to get stuck in an infinite loop.

A malformed DNS message in response to a query can cause the Lookup functions to get stuck in an infinite loop.

A malformed DNS message in response to a query can cause the Lookup functions to get stuck in an infinite loop.

A malformed DNS message in response to a query can cause the Lookup functions to get stuck in an infinite loop.

A malformed DNS message in response to a query can cause the Lookup functions to get stuck in an infinite loop.

A malformed DNS message in response to a query can cause the Lookup functions to get stuck in an infinite loop.

A malformed DNS message in response to a query can cause the Lookup functions to get stuck in an infinite loop.

A malformed DNS message in response to a query can cause the Lookup functions to get stuck in an infinite loop.

• rebuild with newer golang to fix multiple security vulnerabilities:
• CVE-2023-24534: fix HTTP/2 rapid reset attack leading to denial of service
• CVE-2023-29400: fix HTTP/2 frame processing panic leading to denial of service
• CVE-2022-41725: fix HTTP/2 server connection handling causing premature closure
• CVE-2022-41724: fix HTTP/2 server connection misuse causing resource exhaustion
• CVE-2023-24538: fix HTTP/2 request handling causing denial of service
• CVE-2023-39322: fix HTTP/2 connection resource exhaustion and denial of service
• CVE-2023-24539: fix HTTP/2 request handling causing excessive memory consumption
• CVE-2023-39321: fix HTTP/2 frame processing causing panic and denial of service
• CVE-2024-24788: fix HTTP/2 connection handling causing denial of service
• CVE-2022-41723: fix HTTP/2 server connection handling causing resource exhaustion
• CVE-2023-45287: fix RSA-based TLS key exchange timing attack vulnerability
• CVE-2024-34156: fix HTTP/2 connection resource exhaustion and denial of service
• CVE-2023-24536: fix HTTP/2 request handling causing denial of service

• Rebuild with golang >= 1.22.5.tuxcare.els7 to fix CVE-2024-24790, CVE-2024-34156, CVE-2023-45288, CVE-2023-39322, CVE-2023-39321, CVE-2024-24788

• rebuild with newer golang to fix security vulnerabilities:
• CVE-2023-45287: fix RSA-based TLS key exchange timing attack vulnerability
• CVE-2024-24788: fix DNS resolver infinite loop causing denial of service
• CVE-2023-39321: fix QUIC post-handshake message processing causing panic and denial of service

A malformed DNS message in response to a query can cause the Lookup functions to get stuck in an infinite loop.

A malformed DNS message in response to a query can cause the Lookup functions to get stuck in an infinite loop.

A malformed DNS message in response to a query can cause the Lookup functions to get stuck in an infinite loop. (CVE-2024-24788)

These are all security issues fixed in the go1.22-1.22.3-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the forgejo-7.0.3-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the traefik-3.0.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the traefik2-2.11.5-1.1 package on the GA media of openSUSE Tumbleweed.

Toolbox is a tool for Linux operating systems, which allows the use of containerized command line environments. It is built on top of Podman and other standard container technologies from OCI.

Security Fix(es):

• golang: net/http: golang: mime/multipart: golang: net/textproto: memory exhaustion in Request.ParseMultipartForm (CVE-2023-45290)

• golang: html/template: errors returned from MarshalJSON methods may break template escaping (CVE-2024-24785)

• golang: net: malformed DNS message can cause infinite loop (CVE-2024-24788)

• net/http: Denial of service due to improper 100-continue handling in net/http (CVE-2024-24791)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 9.5 Release Notes linked from the References section.

The runC tool is a lightweight, portable implementation of the Open Container Format (OCF) that provides container runtime.

Security Fix(es):

• golang: net: malformed DNS message can cause infinite loop (CVE-2024-24788)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 9.5 Release Notes linked from the References section.

OCI Hook to generate seccomp json files based on EBF syscalls used by container oci-seccomp-bpf-hook provides a library for applications looking to use the Container Pod concept popularized by Kubernetes.

Security Fix(es):

• golang: net: malformed DNS message can cause infinite loop (CVE-2024-24788)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 9.5 Release Notes linked from the References section.