The container-tools module in Red Hat Enterprise Linux 8, which includes podman, buildah, skopeo, and runc, contains vulnerabilities related to the jose-go library. Specifically, CVE-2024-28180 involves improper handling of highly compressed data, and CVE-2024-28176 involves resource exhaustion. These vulnerabilities affect multiple container tools and could cause denial-of-service conditions. Red Hat has issued an update to address these issues in affected versions of the container-tools module.

The vulnerabilities could allow an attacker to cause resource exhaustion or improper processing of highly compressed data in container tools, potentially leading to denial-of-service conditions. There is no indication of code execution or data breach. The severity is rated moderate by Red Hat.

Red Hat has released updated packages for the container-tools module in Red Hat Enterprise Linux 8 that fix these vulnerabilities. Users should apply the update RHSA-2024:3968 after ensuring all previous relevant errata are applied. No additional mitigation steps are indicated by the vendor advisory.