1. Home
  2. Security Advisories
  3. Red Hat
  4. RHSA-2023:7763

[RHSA-2023:7763] runc security update

Severity Moderate
Affected Packages 4
CVEs 3
Info Packages References Vulnerabilities

The runC tool is a lightweight, portable implementation of the Open Container Format (OCF) that provides container runtime.

Security Fix(es):

  • golang: crypto/tls: slow verification of certificate chains containing large RSA keys (CVE-2023-29409)

  • golang: crypto/tls: panic when processing post-handshake message on QUIC connections (CVE-2023-39321)

  • golang: crypto/tls: lack of a limit on buffered post-handshake (CVE-2023-39322)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Package Affected Version
pkg:rpm/redhat/runc?arch=x86_64&distro=redhat-9.3 < 1.1.9-2.el9_3
pkg:rpm/redhat/runc?arch=s390x&distro=redhat-9.3 < 1.1.9-2.el9_3
pkg:rpm/redhat/runc?arch=ppc64le&distro=redhat-9.3 < 1.1.9-2.el9_3
pkg:rpm/redhat/runc?arch=aarch64&distro=redhat-9.3 < 1.1.9-2.el9_3
ID
RHSA-2023:7763
Severity
moderate
URL
https://access.redhat.com/errata/RHSA-2023:7763
Published
2023-12-12T00:00:00
(9 months ago)
Modified
2023-12-12T00:00:00
(9 months ago)
Rights
Copyright 2023 Red Hat, Inc.
Other Advisories
Type Package URL Namespace Name / Product Version Distribution / Platform Arch Patch / Fix
Affected pkg:rpm/redhat/runc?arch=x86_64&distro=redhat-9.3 redhat runc < 1.1.9-2.el9_3 redhat-9.3 x86_64
Affected pkg:rpm/redhat/runc?arch=s390x&distro=redhat-9.3 redhat runc < 1.1.9-2.el9_3 redhat-9.3 s390x
Affected pkg:rpm/redhat/runc?arch=ppc64le&distro=redhat-9.3 redhat runc < 1.1.9-2.el9_3 redhat-9.3 ppc64le
Affected pkg:rpm/redhat/runc?arch=aarch64&distro=redhat-9.3 redhat runc < 1.1.9-2.el9_3 redhat-9.3 aarch64
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories Exploits PoC Pubblication Date Modification Date
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories PoC Pubblication Date Modification Date