RHSA-2023:2253: Moderate: buildah security and bug fix update
The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. Security Fix(es): golang: net/http: An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests (CVE-2022-41717) golang: crypto/tls: session tickets lack random ticketageadd (CVE-2022-30629) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Additional Changes:For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.2 Release Notes linked from the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/buildahto a version that resolves this vulnerability.Fixed in 1.29.1-1.el9 - Upgrade
Upgrade
redhat/buildah-debuginfoto a version that resolves this vulnerability.Fixed in 1.29.1-1.el9 - Upgrade
Upgrade
redhat/buildah-debugsourceto a version that resolves this vulnerability.Fixed in 1.29.1-1.el9 - Upgrade
Upgrade
redhat/buildah-teststo a version that resolves this vulnerability.Fixed in 1.29.1-1.el9 - Upgrade
Upgrade
redhat/buildah-tests-debuginfoto a version that resolves this vulnerability.Fixed in 1.29.1-1.el9 - Upgrade
Upgrade
redhat/buildahto a version that resolves this vulnerability.Fixed in 1.29.1-1.el9.aa - Upgrade
Upgrade
redhat/buildah-debuginfoto a version that resolves this vulnerability.Fixed in 1.29.1-1.el9.aa - Upgrade
Upgrade
redhat/buildah-debugsourceto a version that resolves this vulnerability.Fixed in 1.29.1-1.el9.aa - Upgrade
Upgrade
redhat/buildah-teststo a version that resolves this vulnerability.Fixed in 1.29.1-1.el9.aa - Upgrade
Upgrade
redhat/buildah-tests-debuginfoto a version that resolves this vulnerability.Fixed in 1.29.1-1.el9.aa - Upgrade
Upgrade
buildahto a version that resolves this vulnerability.Fixed in 1.29.1-1.el9 - Upgrade
Upgrade
buildah-debuginfoto a version that resolves this vulnerability.Fixed in 1.29.1-1.el9 - Upgrade
Upgrade
buildah-debugsourceto a version that resolves this vulnerability.Fixed in 1.29.1-1.el9 - Upgrade
Upgrade
buildah-teststo a version that resolves this vulnerability.Fixed in 1.29.1-1.el9 - Upgrade
Upgrade
buildah-tests-debuginfoto a version that resolves this vulnerability.Fixed in 1.29.1-1.el9
Event History
Frequently Asked Questions
What is the severity of RHSA-2023:2253?
The severity of RHSA-2023:2253 is classified as important.
How do I fix the vulnerability identified in RHSA-2023:2253?
To fix the vulnerability in RHSA-2023:2253, update the buildah package to version 1.29.1-1.el9.
Which packages are affected by RHSA-2023:2253?
The affected packages include buildah, buildah-debuginfo, buildah-debugsource, and buildah-tests.
Is RHSA-2023:2253 related to container security?
Yes, RHSA-2023:2253 pertains to vulnerabilities in the buildah package used for building OCI container images.
What platforms does the fix for RHSA-2023:2253 apply to?
The fix for RHSA-2023:2253 applies to Red Hat Enterprise Linux 9 on multiple architectures, including x86_64 and ppc64le.