podman-gvproxy (AlmaLinux:9) — known CVEs & security advisories

Known CVE vulnerabilities and GitHub Security Advisories affecting the AlmaLinux:9 package podman-gvproxy, with affected version ranges, CVSS severity, EPSS exploit prediction, and CISA KEV status.

CVEs (30)

• CVE-2023-24540 — CVSS 9.8 (critical): Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the…
• CVE-2023-24538 — CVSS 9.8 (critical): Templates do not properly consider backticks (`) as Javascript string delimiters, and do not escape them as expected. Backticks are used…
• CVE-2020-28851 — CVSS 7.5 (high): In x/text in Go 1.15.4, an "index out of range" panic occurs in language.ParseAcceptLanguage while parsing the -u- extension…
• CVE-2020-28852 — CVSS 7.5 (high): In x/text in Go before v0.3.5, a "slice bounds out of range" panic occurs in language.ParseAcceptLanguage while processing a BCP 47 tag…
• CVE-2022-27191 — CVSS 7.5 (high): The golang.org/x/crypto/ssh package before 0.0.0-20220314234659-1baeb1ce4c0b for Go allows an attacker to crash a server in certain…
• CVE-2022-41723 — CVSS 7.5 (high): A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service…
• CVE-2022-41724 — CVSS 7.5 (high): Large handshake records may cause panics in crypto/tls. Both clients and servers may send large TLS handshake records which cause servers…
• CVE-2022-41725 — CVSS 7.5 (high): A denial of service is possible from excessive resource consumption in net/http and mime/multipart. Multipart form parsing with…
• CVE-2023-24534 — CVSS 7.5 (high): HTTP and MIME header parsing can allocate large amounts of memory, even when parsing small inputs, potentially leading to a denial of…
• CVE-2023-24536 — CVSS 7.5 (high): Multipart form parsing can consume large amounts of CPU and memory when processing form inputs containing very large numbers of parts. This…
• CVE-2023-24537 — CVSS 7.5 (high): Calling any of the Parse functions on Go source code which contains //line directives with very large line numbers can cause an infinite…
• CVE-2023-39321 — CVSS 7.5 (high): Processing an incomplete post-handshake message for a QUIC connection can cause a panic.
• CVE-2023-39322 — CVSS 7.5 (high): QUIC connections do not set an upper bound on the amount of data buffered when reading post-handshake messages, allowing a malicious QUIC…
• CVE-2023-24539 — CVSS 7.3 (high): Angle brackets (<>) are not considered dangerous characters when inserted into CSS contexts. Templates containing multiple actions…
• CVE-2023-29400 — CVSS 7.3 (high): Templates containing actions in unquoted HTML attributes (e.g. "attr={{.}}") executed with empty input can result in output with unexpected…
• CVE-2022-2990 — CVSS 7.1 (high): An incorrect handling of the supplementary groups in the Buildah container engine might lead to the sensitive information disclosure or…
• CVE-2022-2989 — CVSS 7.1 (high): An incorrect handling of the supplementary groups in the Podman container engine might lead to the sensitive information disclosure or…
• CVE-2023-29406 — CVSS 6.5 (medium): The HTTP/1 client does not fully validate the contents of the Host header. A maliciously crafted Host header can inject additional headers…
• CVE-2021-20291 — CVSS 6.5 (medium): A deadlock vulnerability was found in 'github.com/containers/storage' in versions before 1.28.1. When a container image is processed, each…
• CVE-2021-34558 — CVSS 6.5 (medium): The crypto/tls package of Go through 1.16.5 does not properly assert that the type of public key in an X.509 certificate matches the…
• CVE-2021-4024 — CVSS 6.5 (medium): A flaw was found in podman. The `podman machine` function (used to create and manage Podman virtual machine containing a Podman process)…
• CVE-2023-39319 — CVSS 6.1 (medium): The html/template package does not apply the proper rules for handling occurrences of "<script", "<!--", and "</script" within JS literals…
• CVE-2023-3978 — CVSS 6.1 (medium): Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to…
• CVE-2023-39318 — CVSS 6.1 (medium): The html/template package does not properly handle HTML-like "" comment tokens, nor hashbang "#!" comment tokens, in <script> contexts…
• CVE-2021-20199 — CVSS 5.9 (medium): Rootless containers run with Podman, receive all traffic with a source IP address of 127.0.0.1 (including from remote hosts). This impacts…
• CVE-2023-25173 — CVSS 5.3 (medium): containerd is an open source container runtime. A bug was found in containerd prior to versions 1.6.18 and 1.5.18 where supplementary…
• CVE-2023-29409 — CVSS 5.3 (medium): Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. With fix, the…
• CVE-2022-41717 — CVSS 5.3 (medium): An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP…
• CVE-2021-33197 — CVSS 5.3 (medium): In Go before 1.15.13 and 1.16.x before 1.16.5, some configurations of ReverseProxy (from net/http/httputil) result in a situation where an…
• CVE-2022-30629 — CVSS 3.1 (low): Non-random values for ticket_age_add in session tickets in crypto/tls before Go 1.17.11 and Go 1.18.3 allow an attacker that can observe…