Security Bulletin
This security bulletin contains information about 2 vulnerabilities.
EUVDB-ID: #VU87326
Risk: Medium
CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2024-24786
CWE-ID:
CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to infinite loop when parsing data in an invalid JSON format within the protojson.Unmarshal() function. A remote attacker can consume all available system resources and cause denial of service conditions.
MitigationUpdate the affected package podman to the latest version.
Vulnerable software versionsContainers Module: 15-SP5 - 15-SP6
SUSE Linux Enterprise Real Time 15: SP5 - SP6
openSUSE Leap: 15.5 - 15.6
SUSE Linux Enterprise Server for SAP Applications 15: SP5 - SP6
SUSE Linux Enterprise Server 15: SP5 - SP6
SUSE Linux Enterprise Micro: 5.5
SUSE Linux Enterprise High Performance Computing 15: SP5
podman-docker: before 4.9.5-150500.3.12.1
podman-remote: before 4.9.5-150500.3.12.1
podman-remote-debuginfo: before 4.9.5-150500.3.12.1
podman-debuginfo: before 4.9.5-150500.3.12.1
podman: before 4.9.5-150500.3.12.1
podmansh: before 4.9.5-150500.3.12.1
CPE2.3http://www.suse.com/support/update/announcement/2024/suse-su-20242031-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU89685
Risk: Medium
CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2024-3727
CWE-ID:
CWE-354 - Improper Validation of Integrity Check Value
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to compromise the affected system.
The vulnerability exists due to improper validation of integrity check. A remote attacker can trick the victim into providing authenticated registry accesses, causing resource exhaustion, local path traversal, and other attacks.
MitigationUpdate the affected package podman to the latest version.
Vulnerable software versionsContainers Module: 15-SP5 - 15-SP6
SUSE Linux Enterprise Real Time 15: SP5 - SP6
openSUSE Leap: 15.5 - 15.6
SUSE Linux Enterprise Server for SAP Applications 15: SP5 - SP6
SUSE Linux Enterprise Server 15: SP5 - SP6
SUSE Linux Enterprise Micro: 5.5
SUSE Linux Enterprise High Performance Computing 15: SP5
podman-docker: before 4.9.5-150500.3.12.1
podman-remote: before 4.9.5-150500.3.12.1
podman-remote-debuginfo: before 4.9.5-150500.3.12.1
podman-debuginfo: before 4.9.5-150500.3.12.1
podman: before 4.9.5-150500.3.12.1
podmansh: before 4.9.5-150500.3.12.1
CPE2.3http://www.suse.com/support/update/announcement/2024/suse-su-20242031-1/
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.