CVE-2024-34156 Affecting containernetworking-plugins package, versions <1:1.4.0-6.el9_4
Threat Intelligence
EPSS
0.05% (17th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-ALMALINUX9-CONTAINERNETWORKINGPLUGINS-8224878
- published 16 Oct 2024
- disclosed 12 Nov 2024
Introduced: 16 Oct 2024
CVE-2024-34156 Open this link in a new tabHow to fix?
Upgrade AlmaLinux:9
containernetworking-plugins
to version 1:1.4.0-6.el9_4 or higher.
This issue was patched in ALSA-2024:8110
.
NVD Description
Note: Versions mentioned in the description apply only to the upstream containernetworking-plugins
package and not the containernetworking-plugins
package as distributed by AlmaLinux
.
See How to fix?
for AlmaLinux:9
relevant fixed versions and status.
Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635.
References
- https://errata.almalinux.org/8/ALSA-2024-6908.html
- https://errata.almalinux.org/9/ALSA-2024-6913.html
- https://errata.almalinux.org/9/ALSA-2024-6946.html
- https://errata.almalinux.org/9/ALSA-2024-6947.html
- https://errata.almalinux.org/8/ALSA-2024-7135.html
- https://errata.almalinux.org/9/ALSA-2024-7136.html
- https://errata.almalinux.org/9/ALSA-2024-7204.html
- https://errata.almalinux.org/8/ALSA-2024-7262.html
- https://errata.almalinux.org/8/ALSA-2024-8038.html
- https://errata.almalinux.org/9/ALSA-2024-8039.html
- https://errata.almalinux.org/9/ALSA-2024-8110.html
- https://errata.almalinux.org/9/ALSA-2024-8111.html
- https://errata.almalinux.org/9/ALSA-2024-8112.html
- https://errata.almalinux.org/9/ALSA-2024-9454.html
- https://errata.almalinux.org/9/ALSA-2024-9456.html
- https://errata.almalinux.org/9/ALSA-2024-9459.html
- https://errata.almalinux.org/9/ALSA-2024-9472.html
- https://errata.almalinux.org/9/ALSA-2024-9473.html
- https://access.redhat.com/security/cve/CVE-2024-34156
- https://access.redhat.com/errata/RHSA-2024:6908
- https://access.redhat.com/errata/RHSA-2024:6913
- https://access.redhat.com/errata/RHSA-2024:6946
- https://access.redhat.com/errata/RHSA-2024:6947
- https://access.redhat.com/errata/RHSA-2024:7135
- https://access.redhat.com/errata/RHSA-2024:7136
- https://access.redhat.com/errata/RHSA-2024:7204
- https://access.redhat.com/errata/RHSA-2024:7262
- https://access.redhat.com/errata/RHSA-2024:8038
- https://access.redhat.com/errata/RHSA-2024:8039
- https://access.redhat.com/errata/RHSA-2024:8110
- https://access.redhat.com/errata/RHSA-2024:8111
- https://access.redhat.com/errata/RHSA-2024:8112
- https://access.redhat.com/errata/RHSA-2024:9454
- https://access.redhat.com/errata/RHSA-2024:9456
- https://access.redhat.com/errata/RHSA-2024:9459
- https://access.redhat.com/errata/RHSA-2024:9472
- https://access.redhat.com/errata/RHSA-2024:9473
- https://go.dev/cl/611239
- https://go.dev/issue/69139
- https://groups.google.com/g/golang-dev/c/S9POB9NCTdk
- https://pkg.go.dev/vuln/GO-2024-3106
- https://security.netapp.com/advisory/ntap-20240926-0004/
CVSS Scores
version 3.1