Allocation of Resources Without Limits or Throttling Affecting container-tools:rhel8/podman-catatonit package, versions <3:4.4.1-22.module+el8.8.0+22142+4cbed6b3


Severity

Recommended
0.0
high
0
10

Based on Red Hat Enterprise Linux security rating.

Threat Intelligence

EPSS
0.05% (18th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Allocation of Resources Without Limits or Throttling vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-RHEL8-CONTAINERTOOLS-7676007
  • published12 Aug 2024
  • disclosed30 Jun 2024

Introduced: 30 Jun 2024

CVE-2024-37298  (opens in a new tab)
CWE-770  (opens in a new tab)

How to fix?

Upgrade RHEL:8 container-tools:rhel8/podman-catatonit to version 3:4.4.1-22.module+el8.8.0+22142+4cbed6b3 or higher.
This issue was patched in RHSA-2024:5194.

NVD Description

Note: Versions mentioned in the description apply only to the upstream container-tools:rhel8/podman-catatonit package and not the container-tools:rhel8/podman-catatonit package as distributed by RHEL. See How to fix? for RHEL:8 relevant fixed versions and status.

gorilla/schema converts structs to and from form values. Prior to version 1.4.1 Running schema.Decoder.Decode() on a struct that has a field of type []struct{...} opens it up to malicious attacks regarding memory allocations, taking advantage of the sparse slice functionality. Any use of schema.Decoder.Decode() on a struct with arrays of other structs could be vulnerable to this memory exhaustion vulnerability. Version 1.4.1 contains a patch for the issue.

CVSS Scores

version 3.1