Red Hat Product Errata RHSA-2024:7206 - Security Advisory
Issued:
2024-09-26
Updated:
2024-09-26

RHSA-2024:7206 - Security Advisory

Synopsis

Important: osbuild-composer security update

Type/Severity

Security Advisory: Important

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for osbuild-composer is now available for Red Hat Enterprise Linux 8.8 Extended Update Support.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients.

Security Fix(es):

  • encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion (CVE-2024-34156)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 - Extended Update Support Extension 8.8 x86_64
  • Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.8 x86_64
  • Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.8 s390x
  • Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.8 ppc64le
  • Red Hat Enterprise Linux Server - TUS 8.8 x86_64
  • Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.8 aarch64
  • Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.8 ppc64le
  • Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.8 x86_64

Fixes

  • BZ - 2310528 - CVE-2024-34156 encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion

Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.8

SRPM
osbuild-composer-75-2.el8_8.src.rpm SHA-256: b39b31dbbaadbb60a749bab621cc00944721a0f06ec15de3a9a8d41e0e39a534
x86_64
osbuild-composer-75-2.el8_8.x86_64.rpm SHA-256: cd5bf8d9a185b8c90254ec29cccc77c5d63ac378ac8ed5cfe590fd7dfb79f553
osbuild-composer-core-75-2.el8_8.x86_64.rpm SHA-256: da0f6bb907806fabe91fa12df119ff6a1105f60c248fec372b9297394b7e7202
osbuild-composer-core-debuginfo-75-2.el8_8.x86_64.rpm SHA-256: 54cc62442e999f0fcb1d9059ebcae9ee36660a4693b4001ddf64e3a51e426b88
osbuild-composer-debuginfo-75-2.el8_8.x86_64.rpm SHA-256: 2b28013539edd5f12962a9be6ced164c3988bba63d071cb46b48f957b7f52eef
osbuild-composer-debugsource-75-2.el8_8.x86_64.rpm SHA-256: 4f752498e2b0fd2aa7e49fb966c1b2b341ee225a1a6b71b96f09d1d2856825c7
osbuild-composer-dnf-json-75-2.el8_8.x86_64.rpm SHA-256: 204a99c38d8e5182dc3b53daabd2714871406eb80fe0ad9f4664ecd115e3767f
osbuild-composer-tests-debuginfo-75-2.el8_8.x86_64.rpm SHA-256: 0c0bd1fd87bee8dde5180a7921b13d7ca71d9efc47eccc392ffa2458b76c04e5
osbuild-composer-worker-75-2.el8_8.x86_64.rpm SHA-256: b42fbe2c999196ccec1cff30738b49153ebbeec2642cc4c5fa78cbfba6ab7ab6
osbuild-composer-worker-debuginfo-75-2.el8_8.x86_64.rpm SHA-256: 807669f01b1d2978090554ed755b6002dfb2f1688349f8b16228b8108fab5178

Red Hat Enterprise Linux for x86_64 - Extended Update Support Extension 8.8

SRPM
osbuild-composer-75-2.el8_8.src.rpm SHA-256: b39b31dbbaadbb60a749bab621cc00944721a0f06ec15de3a9a8d41e0e39a534
x86_64
osbuild-composer-75-2.el8_8.x86_64.rpm SHA-256: cd5bf8d9a185b8c90254ec29cccc77c5d63ac378ac8ed5cfe590fd7dfb79f553
osbuild-composer-core-75-2.el8_8.x86_64.rpm SHA-256: da0f6bb907806fabe91fa12df119ff6a1105f60c248fec372b9297394b7e7202
osbuild-composer-core-debuginfo-75-2.el8_8.x86_64.rpm SHA-256: 54cc62442e999f0fcb1d9059ebcae9ee36660a4693b4001ddf64e3a51e426b88
osbuild-composer-debuginfo-75-2.el8_8.x86_64.rpm SHA-256: 2b28013539edd5f12962a9be6ced164c3988bba63d071cb46b48f957b7f52eef
osbuild-composer-debugsource-75-2.el8_8.x86_64.rpm SHA-256: 4f752498e2b0fd2aa7e49fb966c1b2b341ee225a1a6b71b96f09d1d2856825c7
osbuild-composer-dnf-json-75-2.el8_8.x86_64.rpm SHA-256: 204a99c38d8e5182dc3b53daabd2714871406eb80fe0ad9f4664ecd115e3767f
osbuild-composer-tests-debuginfo-75-2.el8_8.x86_64.rpm SHA-256: 0c0bd1fd87bee8dde5180a7921b13d7ca71d9efc47eccc392ffa2458b76c04e5
osbuild-composer-worker-75-2.el8_8.x86_64.rpm SHA-256: b42fbe2c999196ccec1cff30738b49153ebbeec2642cc4c5fa78cbfba6ab7ab6
osbuild-composer-worker-debuginfo-75-2.el8_8.x86_64.rpm SHA-256: 807669f01b1d2978090554ed755b6002dfb2f1688349f8b16228b8108fab5178

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.8

SRPM
osbuild-composer-75-2.el8_8.src.rpm SHA-256: b39b31dbbaadbb60a749bab621cc00944721a0f06ec15de3a9a8d41e0e39a534
s390x
osbuild-composer-75-2.el8_8.s390x.rpm SHA-256: 2cb6e5ee81544b3e63113c50ed4c5ca42bdf5e75455695dcba14a758d0a73e0d
osbuild-composer-core-75-2.el8_8.s390x.rpm SHA-256: b0d4f3c792607cdf9932f3efca9ba18f12c9b32297bd49c29fde0081dbfadfe7
osbuild-composer-core-debuginfo-75-2.el8_8.s390x.rpm SHA-256: 5e7854b7e868857f73c81bfc55ea6d7e332c5c4ee63202cd38cf4ddad8e2af45
osbuild-composer-debuginfo-75-2.el8_8.s390x.rpm SHA-256: cae094dd529593ff3755e8fc19f4a228fcd49029b58004e781b4fe49407f9f8d
osbuild-composer-debugsource-75-2.el8_8.s390x.rpm SHA-256: 0be33e5025e4b09335a961bdfe5250ac62cf67956d986fcfc8d09dadfbefc816
osbuild-composer-dnf-json-75-2.el8_8.s390x.rpm SHA-256: e06a44ddcc00e7c229b1903a1234d4d1f1b0a0d0fad4963de657b2db90e6312b
osbuild-composer-tests-debuginfo-75-2.el8_8.s390x.rpm SHA-256: d8b2dc9b6b52b1381fd15f217bbeeffa8ae890276eebc153f4ea596707f4170b
osbuild-composer-worker-75-2.el8_8.s390x.rpm SHA-256: 15e0253c2596309f01ce02c86069c0b21ca016383c55eaa9d852404de2c45e61
osbuild-composer-worker-debuginfo-75-2.el8_8.s390x.rpm SHA-256: 6db9140973d4d674ced6cd2fe86ded92b10ea6d55f8db26ae00af25939ccca66

Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.8

SRPM
osbuild-composer-75-2.el8_8.src.rpm SHA-256: b39b31dbbaadbb60a749bab621cc00944721a0f06ec15de3a9a8d41e0e39a534
ppc64le
osbuild-composer-75-2.el8_8.ppc64le.rpm SHA-256: 1ed937c2b1b98fda6c211102649dbe503b9bcd6a91b001420cf712bc37e299eb
osbuild-composer-core-75-2.el8_8.ppc64le.rpm SHA-256: 1e478c002025c895f8e0cdf4cda2598eeaca3e95fa613715fb0b4b3ea719a9c1
osbuild-composer-core-debuginfo-75-2.el8_8.ppc64le.rpm SHA-256: bbe0e1362adf0c2121a5622bd7be6a62ad65defc0414fb3c0e9090bf7bec5344
osbuild-composer-debuginfo-75-2.el8_8.ppc64le.rpm SHA-256: d057ffd8f841255187a5644bcb0d75f0e20b3738f1857f47704288d56a53a5e3
osbuild-composer-debugsource-75-2.el8_8.ppc64le.rpm SHA-256: c5285e302bb12490b38ceb862e885ef6ed2a8c99b423744b95ee055eec3560b9
osbuild-composer-dnf-json-75-2.el8_8.ppc64le.rpm SHA-256: 38f895a14f90e0cba6f90e40cc28caa63b562520b7c998f7a36ce2dcb5298354
osbuild-composer-tests-debuginfo-75-2.el8_8.ppc64le.rpm SHA-256: 7e3671d9e0286311fb2f6fe170feda3de4a08c591ad5a922e35e5996d283341b
osbuild-composer-worker-75-2.el8_8.ppc64le.rpm SHA-256: e81cd4ce047a3f1718d0ada00323b18dcc8a6d583dfff15e98e75ac78b5fbb4b
osbuild-composer-worker-debuginfo-75-2.el8_8.ppc64le.rpm SHA-256: 1e84167578f1f839b889ba75ba989cb70c58d9a1abb4716bf6ce3824bfdf6d40

Red Hat Enterprise Linux Server - TUS 8.8

SRPM
osbuild-composer-75-2.el8_8.src.rpm SHA-256: b39b31dbbaadbb60a749bab621cc00944721a0f06ec15de3a9a8d41e0e39a534
x86_64
osbuild-composer-75-2.el8_8.x86_64.rpm SHA-256: cd5bf8d9a185b8c90254ec29cccc77c5d63ac378ac8ed5cfe590fd7dfb79f553
osbuild-composer-core-75-2.el8_8.x86_64.rpm SHA-256: da0f6bb907806fabe91fa12df119ff6a1105f60c248fec372b9297394b7e7202
osbuild-composer-core-debuginfo-75-2.el8_8.x86_64.rpm SHA-256: 54cc62442e999f0fcb1d9059ebcae9ee36660a4693b4001ddf64e3a51e426b88
osbuild-composer-debuginfo-75-2.el8_8.x86_64.rpm SHA-256: 2b28013539edd5f12962a9be6ced164c3988bba63d071cb46b48f957b7f52eef
osbuild-composer-debugsource-75-2.el8_8.x86_64.rpm SHA-256: 4f752498e2b0fd2aa7e49fb966c1b2b341ee225a1a6b71b96f09d1d2856825c7
osbuild-composer-dnf-json-75-2.el8_8.x86_64.rpm SHA-256: 204a99c38d8e5182dc3b53daabd2714871406eb80fe0ad9f4664ecd115e3767f
osbuild-composer-tests-debuginfo-75-2.el8_8.x86_64.rpm SHA-256: 0c0bd1fd87bee8dde5180a7921b13d7ca71d9efc47eccc392ffa2458b76c04e5
osbuild-composer-worker-75-2.el8_8.x86_64.rpm SHA-256: b42fbe2c999196ccec1cff30738b49153ebbeec2642cc4c5fa78cbfba6ab7ab6
osbuild-composer-worker-debuginfo-75-2.el8_8.x86_64.rpm SHA-256: 807669f01b1d2978090554ed755b6002dfb2f1688349f8b16228b8108fab5178

Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.8

SRPM
osbuild-composer-75-2.el8_8.src.rpm SHA-256: b39b31dbbaadbb60a749bab621cc00944721a0f06ec15de3a9a8d41e0e39a534
aarch64
osbuild-composer-75-2.el8_8.aarch64.rpm SHA-256: b9f4c3658613563c01ec3a6261d4eabd3c359dc149d8f1f21f24b3e2044dc771
osbuild-composer-core-75-2.el8_8.aarch64.rpm SHA-256: 2f6999a772019ce1604bac2cf26335f6fe93a1913a8e3388033de997948b304f
osbuild-composer-core-debuginfo-75-2.el8_8.aarch64.rpm SHA-256: e5e2a283ee92273ce650f04b0d0fe39c27d26e5e96e57cba71e08772b73c8ab0
osbuild-composer-debuginfo-75-2.el8_8.aarch64.rpm SHA-256: 417fd692a7e11f564f98b2ed12afd1477792846a38319d5d2d9dc364ab0e439d
osbuild-composer-debugsource-75-2.el8_8.aarch64.rpm SHA-256: 0cdeda3dc17437cad3211198ab4d3aef06f52a428aa2cb7fa5071038edde2809
osbuild-composer-dnf-json-75-2.el8_8.aarch64.rpm SHA-256: 1bc0eda505cacbb200738a606990ccedd455158bf078700267d4e020e8dfa98c
osbuild-composer-tests-debuginfo-75-2.el8_8.aarch64.rpm SHA-256: 8af33d560c532f3dd028e1c6d58c65a72c2fb742f4ae724e96df34cd31fdc68f
osbuild-composer-worker-75-2.el8_8.aarch64.rpm SHA-256: 00b9eb729c9c72b37bbcd871ff9b10cb14ddb9df1281bd4aa77b001465a2e1ac
osbuild-composer-worker-debuginfo-75-2.el8_8.aarch64.rpm SHA-256: 66c6a7b510b17789c25d545e443c94a04a3069677fc112c7b22eb22fd5535ae1

Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.8

SRPM
osbuild-composer-75-2.el8_8.src.rpm SHA-256: b39b31dbbaadbb60a749bab621cc00944721a0f06ec15de3a9a8d41e0e39a534
ppc64le
osbuild-composer-75-2.el8_8.ppc64le.rpm SHA-256: 1ed937c2b1b98fda6c211102649dbe503b9bcd6a91b001420cf712bc37e299eb
osbuild-composer-core-75-2.el8_8.ppc64le.rpm SHA-256: 1e478c002025c895f8e0cdf4cda2598eeaca3e95fa613715fb0b4b3ea719a9c1
osbuild-composer-core-debuginfo-75-2.el8_8.ppc64le.rpm SHA-256: bbe0e1362adf0c2121a5622bd7be6a62ad65defc0414fb3c0e9090bf7bec5344
osbuild-composer-debuginfo-75-2.el8_8.ppc64le.rpm SHA-256: d057ffd8f841255187a5644bcb0d75f0e20b3738f1857f47704288d56a53a5e3
osbuild-composer-debugsource-75-2.el8_8.ppc64le.rpm SHA-256: c5285e302bb12490b38ceb862e885ef6ed2a8c99b423744b95ee055eec3560b9
osbuild-composer-dnf-json-75-2.el8_8.ppc64le.rpm SHA-256: 38f895a14f90e0cba6f90e40cc28caa63b562520b7c998f7a36ce2dcb5298354
osbuild-composer-tests-debuginfo-75-2.el8_8.ppc64le.rpm SHA-256: 7e3671d9e0286311fb2f6fe170feda3de4a08c591ad5a922e35e5996d283341b
osbuild-composer-worker-75-2.el8_8.ppc64le.rpm SHA-256: e81cd4ce047a3f1718d0ada00323b18dcc8a6d583dfff15e98e75ac78b5fbb4b
osbuild-composer-worker-debuginfo-75-2.el8_8.ppc64le.rpm SHA-256: 1e84167578f1f839b889ba75ba989cb70c58d9a1abb4716bf6ce3824bfdf6d40

Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.8

SRPM
osbuild-composer-75-2.el8_8.src.rpm SHA-256: b39b31dbbaadbb60a749bab621cc00944721a0f06ec15de3a9a8d41e0e39a534
x86_64
osbuild-composer-75-2.el8_8.x86_64.rpm SHA-256: cd5bf8d9a185b8c90254ec29cccc77c5d63ac378ac8ed5cfe590fd7dfb79f553
osbuild-composer-core-75-2.el8_8.x86_64.rpm SHA-256: da0f6bb907806fabe91fa12df119ff6a1105f60c248fec372b9297394b7e7202
osbuild-composer-core-debuginfo-75-2.el8_8.x86_64.rpm SHA-256: 54cc62442e999f0fcb1d9059ebcae9ee36660a4693b4001ddf64e3a51e426b88
osbuild-composer-debuginfo-75-2.el8_8.x86_64.rpm SHA-256: 2b28013539edd5f12962a9be6ced164c3988bba63d071cb46b48f957b7f52eef
osbuild-composer-debugsource-75-2.el8_8.x86_64.rpm SHA-256: 4f752498e2b0fd2aa7e49fb966c1b2b341ee225a1a6b71b96f09d1d2856825c7
osbuild-composer-dnf-json-75-2.el8_8.x86_64.rpm SHA-256: 204a99c38d8e5182dc3b53daabd2714871406eb80fe0ad9f4664ecd115e3767f
osbuild-composer-tests-debuginfo-75-2.el8_8.x86_64.rpm SHA-256: 0c0bd1fd87bee8dde5180a7921b13d7ca71d9efc47eccc392ffa2458b76c04e5
osbuild-composer-worker-75-2.el8_8.x86_64.rpm SHA-256: b42fbe2c999196ccec1cff30738b49153ebbeec2642cc4c5fa78cbfba6ab7ab6
osbuild-composer-worker-debuginfo-75-2.el8_8.x86_64.rpm SHA-256: 807669f01b1d2978090554ed755b6002dfb2f1688349f8b16228b8108fab5178

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.