Oracle Linux: CVE-2024-24786: ELSA-2024-12329: cri-o security update (IMPORTANT) (Multiple Advisories)
Description
The protojson.Unmarshal function can enter an infinite loop when unmarshaling certain forms of invalid JSON. This condition can occur when unmarshaling into a message which contains a google.protobuf.Any value, or when the UnmarshalOptions.DiscardUnknown option is set. A flaw was found in Golang's protobuf module, where the unmarshal function can enter an infinite loop when processing certain invalid inputs. This issue occurs during unmarshaling into a message that includes a google.protobuf.Any or when the UnmarshalOptions.DiscardUnknown option is enabled. This flaw allows an attacker to craft malicious input tailored to trigger the identified flaw in the unmarshal function. By providing carefully constructed invalid inputs, they could potentially cause the function to enter an infinite loop, resulting in a denial of service condition or other unintended behaviors in the affected system.
Solution(s)
- oracle-linux-upgrade-aardvark-dns
- oracle-linux-upgrade-buildah
- oracle-linux-upgrade-buildah-tests
- oracle-linux-upgrade-cockpit-podman
- oracle-linux-upgrade-conmon
- oracle-linux-upgrade-containernetworking-plugins
- oracle-linux-upgrade-containers-common
- oracle-linux-upgrade-container-selinux
- oracle-linux-upgrade-cri-o
- oracle-linux-upgrade-crit
- oracle-linux-upgrade-cri-tools
- oracle-linux-upgrade-criu
- oracle-linux-upgrade-criu-devel
- oracle-linux-upgrade-criu-libs
- oracle-linux-upgrade-crun
- oracle-linux-upgrade-etcd
- oracle-linux-upgrade-firefox
- oracle-linux-upgrade-fuse-overlayfs
- oracle-linux-upgrade-istio
- oracle-linux-upgrade-istio-istioctl
- oracle-linux-upgrade-kernel-uek-devel
- oracle-linux-upgrade-kubeadm
- oracle-linux-upgrade-kubectl
- oracle-linux-upgrade-kubelet
- oracle-linux-upgrade-libslirp
- oracle-linux-upgrade-libslirp-devel
- oracle-linux-upgrade-netavark
- oracle-linux-upgrade-oci-seccomp-bpf-hook
- oracle-linux-upgrade-olcne-agent
- oracle-linux-upgrade-olcne-api-server
- oracle-linux-upgrade-olcne-calico-chart
- oracle-linux-upgrade-olcnectl
- oracle-linux-upgrade-olcne-gluster-chart
- oracle-linux-upgrade-olcne-grafana-chart
- oracle-linux-upgrade-olcne-istio-chart
- oracle-linux-upgrade-olcne-kubevirt-chart
- oracle-linux-upgrade-olcne-metallb-chart
- oracle-linux-upgrade-olcne-multus-chart
- oracle-linux-upgrade-olcne-nginx
- oracle-linux-upgrade-olcne-oci-ccm-chart
- oracle-linux-upgrade-olcne-olm-chart
- oracle-linux-upgrade-olcne-prometheus-chart
- oracle-linux-upgrade-olcne-rook-chart
- oracle-linux-upgrade-olcne-utils
- oracle-linux-upgrade-podman
- oracle-linux-upgrade-podman-catatonit
- oracle-linux-upgrade-podman-docker
- oracle-linux-upgrade-podman-gvproxy
- oracle-linux-upgrade-podman-plugins
- oracle-linux-upgrade-podman-remote
- oracle-linux-upgrade-podman-tests
- oracle-linux-upgrade-postgresql-pltcl
- oracle-linux-upgrade-python38-atomicwrites
- oracle-linux-upgrade-python3-criu
- oracle-linux-upgrade-python3-podman
- oracle-linux-upgrade-ri-o
- oracle-linux-upgrade-runc
- oracle-linux-upgrade-skopeo
- oracle-linux-upgrade-skopeo-tests
- oracle-linux-upgrade-slirp4netns
- oracle-linux-upgrade-udica
- Lightweight Endpoint Agent
- Live Dashboards
- Real Risk Prioritization
- IT-Integrated Remediation Projects
- Cloud, Virtual, and Container Assessment
- Integrated Threat Feeds
- Easy-to-Use RESTful API
- Automation-Assisted Patching
- Automated Containment
With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.
– Scott Cheney, Manager of Information Security, Sierra View Medical Center