Red Hat Product Errata RHSA-2025:19566 - Security Advisory
Issued:
2025-11-04
Updated:
2025-11-04

RHSA-2025:19566 - Security Advisory

Synopsis

Moderate: osbuild-composer security update

Type/Severity

Security Advisory: Moderate

Red Hat Lightspeed patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for osbuild-composer is now available for Red Hat Enterprise Linux 10.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients.

Security Fix(es):

  • go-jose: Go JOSE's Parsing Vulnerable to Denial of Service (CVE-2025-27144)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 10 x86_64
  • Red Hat Enterprise Linux for x86_64 - Extended Update Support 10.0 x86_64
  • Red Hat Enterprise Linux for IBM z Systems 10 s390x
  • Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 10.0 s390x
  • Red Hat Enterprise Linux for Power, little endian 10 ppc64le
  • Red Hat Enterprise Linux for Power, little endian - Extended Update Support 10.0 ppc64le
  • Red Hat Enterprise Linux for ARM 64 10 aarch64
  • Red Hat Enterprise Linux for ARM 64 - Extended Update Support 10.0 aarch64
  • Red Hat Enterprise Linux for ARM 64 - 4 years of updates 10.0 aarch64
  • Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 10.0 s390x
  • Red Hat Enterprise Linux for Power, little endian - 4 years of support 10.0 ppc64le
  • Red Hat Enterprise Linux for x86_64 - 4 years of updates 10.0 x86_64

Fixes

  • BZ - 2347423 - CVE-2025-27144 go-jose: Go JOSE's Parsing Vulnerable to Denial of Service
  • RHEL-121533 - backport 10.0.z: fix unclosed logrus logging pipes

Red Hat Enterprise Linux for x86_64 10

SRPM
osbuild-composer-134.1-3.el10_0.src.rpm SHA-256: 5b2d8fda7962a336383f96d4854d0ab49ee02e20380492a55b2b016c15634ff5
x86_64
osbuild-composer-134.1-3.el10_0.x86_64.rpm SHA-256: 482eeb1870b254f322414790cc1ff2545b9121702c5acc9d0ee018c4b9ffe622
osbuild-composer-core-134.1-3.el10_0.x86_64.rpm SHA-256: 15c4506ef0551a007b7aa21e76c2053b35fd48e6ed44d5952bf596a961a7fd5c
osbuild-composer-core-debuginfo-134.1-3.el10_0.x86_64.rpm SHA-256: 78f9a3ed146b3617a1fdf5d1f16284462530f8baf140f2f2980632564e6c7b2c
osbuild-composer-debugsource-134.1-3.el10_0.x86_64.rpm SHA-256: 0e951783edc55e993719b4a8b3876b5a6a357edaab8632b8d25fc6286e44c625
osbuild-composer-tests-debuginfo-134.1-3.el10_0.x86_64.rpm SHA-256: 229c0487e80d0f513aeca1172f8d3509a2264530765c980810ae7a434f5f4b42
osbuild-composer-worker-134.1-3.el10_0.x86_64.rpm SHA-256: cb7cec5d7cd4b548d91efd4a4c90835463a78012e0cc13503fb926e70811dede
osbuild-composer-worker-debuginfo-134.1-3.el10_0.x86_64.rpm SHA-256: fd93905694ed99cbeed8ac85e7c93b0f1b703972406d90e27613d9646b6cf235

Red Hat Enterprise Linux for x86_64 - Extended Update Support 10.0

SRPM
osbuild-composer-134.1-3.el10_0.src.rpm SHA-256: 5b2d8fda7962a336383f96d4854d0ab49ee02e20380492a55b2b016c15634ff5
x86_64
osbuild-composer-134.1-3.el10_0.x86_64.rpm SHA-256: 482eeb1870b254f322414790cc1ff2545b9121702c5acc9d0ee018c4b9ffe622
osbuild-composer-core-134.1-3.el10_0.x86_64.rpm SHA-256: 15c4506ef0551a007b7aa21e76c2053b35fd48e6ed44d5952bf596a961a7fd5c
osbuild-composer-core-debuginfo-134.1-3.el10_0.x86_64.rpm SHA-256: 78f9a3ed146b3617a1fdf5d1f16284462530f8baf140f2f2980632564e6c7b2c
osbuild-composer-debugsource-134.1-3.el10_0.x86_64.rpm SHA-256: 0e951783edc55e993719b4a8b3876b5a6a357edaab8632b8d25fc6286e44c625
osbuild-composer-tests-debuginfo-134.1-3.el10_0.x86_64.rpm SHA-256: 229c0487e80d0f513aeca1172f8d3509a2264530765c980810ae7a434f5f4b42
osbuild-composer-worker-134.1-3.el10_0.x86_64.rpm SHA-256: cb7cec5d7cd4b548d91efd4a4c90835463a78012e0cc13503fb926e70811dede
osbuild-composer-worker-debuginfo-134.1-3.el10_0.x86_64.rpm SHA-256: fd93905694ed99cbeed8ac85e7c93b0f1b703972406d90e27613d9646b6cf235

Red Hat Enterprise Linux for IBM z Systems 10

SRPM
osbuild-composer-134.1-3.el10_0.src.rpm SHA-256: 5b2d8fda7962a336383f96d4854d0ab49ee02e20380492a55b2b016c15634ff5
s390x
osbuild-composer-134.1-3.el10_0.s390x.rpm SHA-256: b975aac55aae32248de56b400c86c30511dc70b0a00fa9827da9332be66030ae
osbuild-composer-core-134.1-3.el10_0.s390x.rpm SHA-256: 254489f47811f9253bb8e4b842f51bddb11e6c2beae8002b706dacaef92a255c
osbuild-composer-core-debuginfo-134.1-3.el10_0.s390x.rpm SHA-256: b629c1d3752391f40cda1f5f330c08f3fefe9abc7c2e6712e4fe1f4aaa1779ab
osbuild-composer-debugsource-134.1-3.el10_0.s390x.rpm SHA-256: c003a62ff176b64705d7b57786ba212327e813e06eae3d6a3a01f71d9516ca22
osbuild-composer-tests-debuginfo-134.1-3.el10_0.s390x.rpm SHA-256: 2bbc94ae4e50d5b04f32d4cb76c95a4696e20f5fce1b0121d75efec0fd260151
osbuild-composer-worker-134.1-3.el10_0.s390x.rpm SHA-256: dccbee25d737c6511bb7dbd3250d7a907f88dbfd589cfaa66e3af947eab84c8b
osbuild-composer-worker-debuginfo-134.1-3.el10_0.s390x.rpm SHA-256: 6cec41698a641f824d36a65f54e64b47c3fd4789dac152d0527cda2fdc168bce

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 10.0

SRPM
osbuild-composer-134.1-3.el10_0.src.rpm SHA-256: 5b2d8fda7962a336383f96d4854d0ab49ee02e20380492a55b2b016c15634ff5
s390x
osbuild-composer-134.1-3.el10_0.s390x.rpm SHA-256: b975aac55aae32248de56b400c86c30511dc70b0a00fa9827da9332be66030ae
osbuild-composer-core-134.1-3.el10_0.s390x.rpm SHA-256: 254489f47811f9253bb8e4b842f51bddb11e6c2beae8002b706dacaef92a255c
osbuild-composer-core-debuginfo-134.1-3.el10_0.s390x.rpm SHA-256: b629c1d3752391f40cda1f5f330c08f3fefe9abc7c2e6712e4fe1f4aaa1779ab
osbuild-composer-debugsource-134.1-3.el10_0.s390x.rpm SHA-256: c003a62ff176b64705d7b57786ba212327e813e06eae3d6a3a01f71d9516ca22
osbuild-composer-tests-debuginfo-134.1-3.el10_0.s390x.rpm SHA-256: 2bbc94ae4e50d5b04f32d4cb76c95a4696e20f5fce1b0121d75efec0fd260151
osbuild-composer-worker-134.1-3.el10_0.s390x.rpm SHA-256: dccbee25d737c6511bb7dbd3250d7a907f88dbfd589cfaa66e3af947eab84c8b
osbuild-composer-worker-debuginfo-134.1-3.el10_0.s390x.rpm SHA-256: 6cec41698a641f824d36a65f54e64b47c3fd4789dac152d0527cda2fdc168bce

Red Hat Enterprise Linux for Power, little endian 10

SRPM
osbuild-composer-134.1-3.el10_0.src.rpm SHA-256: 5b2d8fda7962a336383f96d4854d0ab49ee02e20380492a55b2b016c15634ff5
ppc64le
osbuild-composer-134.1-3.el10_0.ppc64le.rpm SHA-256: df5d2712c65eb36c2907979261d8502613dbe1f23c6dfcf373ce2b700b1cc4ac
osbuild-composer-core-134.1-3.el10_0.ppc64le.rpm SHA-256: 3fe6b05eeaf74a5e04ce8fa051f58b8ed46faec6b91a0979cfe792de333bb09c
osbuild-composer-core-debuginfo-134.1-3.el10_0.ppc64le.rpm SHA-256: 5bbe584d0e5aa481c27b9522466a534598836ff41ff2986b80b4cfc620245ebe
osbuild-composer-debugsource-134.1-3.el10_0.ppc64le.rpm SHA-256: 4699ee9857f591e5afcf2f7afee6a73195bddff6abc7483f577d275cdbc820e1
osbuild-composer-tests-debuginfo-134.1-3.el10_0.ppc64le.rpm SHA-256: 8f85527b6bd9483831349286feb1779121dd5d7bf46a73ec2455922095e26603
osbuild-composer-worker-134.1-3.el10_0.ppc64le.rpm SHA-256: b7b41b61e9a5f45f504e766accec8aaac96a428067b81ed445e2f1ac36d44ac8
osbuild-composer-worker-debuginfo-134.1-3.el10_0.ppc64le.rpm SHA-256: 910044e4a5b700e26b2c3085ebb9ebb0f3967303f22605e076d15639afbe1103

Red Hat Enterprise Linux for Power, little endian - Extended Update Support 10.0

SRPM
osbuild-composer-134.1-3.el10_0.src.rpm SHA-256: 5b2d8fda7962a336383f96d4854d0ab49ee02e20380492a55b2b016c15634ff5
ppc64le
osbuild-composer-134.1-3.el10_0.ppc64le.rpm SHA-256: df5d2712c65eb36c2907979261d8502613dbe1f23c6dfcf373ce2b700b1cc4ac
osbuild-composer-core-134.1-3.el10_0.ppc64le.rpm SHA-256: 3fe6b05eeaf74a5e04ce8fa051f58b8ed46faec6b91a0979cfe792de333bb09c
osbuild-composer-core-debuginfo-134.1-3.el10_0.ppc64le.rpm SHA-256: 5bbe584d0e5aa481c27b9522466a534598836ff41ff2986b80b4cfc620245ebe
osbuild-composer-debugsource-134.1-3.el10_0.ppc64le.rpm SHA-256: 4699ee9857f591e5afcf2f7afee6a73195bddff6abc7483f577d275cdbc820e1
osbuild-composer-tests-debuginfo-134.1-3.el10_0.ppc64le.rpm SHA-256: 8f85527b6bd9483831349286feb1779121dd5d7bf46a73ec2455922095e26603
osbuild-composer-worker-134.1-3.el10_0.ppc64le.rpm SHA-256: b7b41b61e9a5f45f504e766accec8aaac96a428067b81ed445e2f1ac36d44ac8
osbuild-composer-worker-debuginfo-134.1-3.el10_0.ppc64le.rpm SHA-256: 910044e4a5b700e26b2c3085ebb9ebb0f3967303f22605e076d15639afbe1103

Red Hat Enterprise Linux for ARM 64 10

SRPM
osbuild-composer-134.1-3.el10_0.src.rpm SHA-256: 5b2d8fda7962a336383f96d4854d0ab49ee02e20380492a55b2b016c15634ff5
aarch64
osbuild-composer-134.1-3.el10_0.aarch64.rpm SHA-256: 0c6b749d51a76a0cce7255a4a0dc3a38034a55d43194a84b0f0374167c854a0b
osbuild-composer-core-134.1-3.el10_0.aarch64.rpm SHA-256: 266ffc783324ffc3c88dc3a40d61115cb8b5cbbc0ad2049cbf669462d5cabf0d
osbuild-composer-core-debuginfo-134.1-3.el10_0.aarch64.rpm SHA-256: 2294413884b2fc0c2576a7e81b4aec4ea4652559940a186accf2adaa299b8ff7
osbuild-composer-debugsource-134.1-3.el10_0.aarch64.rpm SHA-256: 7769bc3cd0683b105169b54a3a22faefb1ae93ddfef8fd3a1fb099bb1b2a52d9
osbuild-composer-tests-debuginfo-134.1-3.el10_0.aarch64.rpm SHA-256: 0e585f80aacf6bed86cf3ebfd434e03989b7e50c4f09eefb1aeb0f759ecb76df
osbuild-composer-worker-134.1-3.el10_0.aarch64.rpm SHA-256: cc75aa14a8ec0ba7344737db0fbece74a6808e384472c0602fe3f3bd1cbcb656
osbuild-composer-worker-debuginfo-134.1-3.el10_0.aarch64.rpm SHA-256: e0c85c82b621eaf95f672ed6cb37448066fc2a8d9b05115c3bedbcddcc003ae4

Red Hat Enterprise Linux for ARM 64 - Extended Update Support 10.0

SRPM
osbuild-composer-134.1-3.el10_0.src.rpm SHA-256: 5b2d8fda7962a336383f96d4854d0ab49ee02e20380492a55b2b016c15634ff5
aarch64
osbuild-composer-134.1-3.el10_0.aarch64.rpm SHA-256: 0c6b749d51a76a0cce7255a4a0dc3a38034a55d43194a84b0f0374167c854a0b
osbuild-composer-core-134.1-3.el10_0.aarch64.rpm SHA-256: 266ffc783324ffc3c88dc3a40d61115cb8b5cbbc0ad2049cbf669462d5cabf0d
osbuild-composer-core-debuginfo-134.1-3.el10_0.aarch64.rpm SHA-256: 2294413884b2fc0c2576a7e81b4aec4ea4652559940a186accf2adaa299b8ff7
osbuild-composer-debugsource-134.1-3.el10_0.aarch64.rpm SHA-256: 7769bc3cd0683b105169b54a3a22faefb1ae93ddfef8fd3a1fb099bb1b2a52d9
osbuild-composer-tests-debuginfo-134.1-3.el10_0.aarch64.rpm SHA-256: 0e585f80aacf6bed86cf3ebfd434e03989b7e50c4f09eefb1aeb0f759ecb76df
osbuild-composer-worker-134.1-3.el10_0.aarch64.rpm SHA-256: cc75aa14a8ec0ba7344737db0fbece74a6808e384472c0602fe3f3bd1cbcb656
osbuild-composer-worker-debuginfo-134.1-3.el10_0.aarch64.rpm SHA-256: e0c85c82b621eaf95f672ed6cb37448066fc2a8d9b05115c3bedbcddcc003ae4

Red Hat Enterprise Linux for ARM 64 - 4 years of updates 10.0

SRPM
osbuild-composer-134.1-3.el10_0.src.rpm SHA-256: 5b2d8fda7962a336383f96d4854d0ab49ee02e20380492a55b2b016c15634ff5
aarch64
osbuild-composer-134.1-3.el10_0.aarch64.rpm SHA-256: 0c6b749d51a76a0cce7255a4a0dc3a38034a55d43194a84b0f0374167c854a0b
osbuild-composer-core-134.1-3.el10_0.aarch64.rpm SHA-256: 266ffc783324ffc3c88dc3a40d61115cb8b5cbbc0ad2049cbf669462d5cabf0d
osbuild-composer-core-debuginfo-134.1-3.el10_0.aarch64.rpm SHA-256: 2294413884b2fc0c2576a7e81b4aec4ea4652559940a186accf2adaa299b8ff7
osbuild-composer-debugsource-134.1-3.el10_0.aarch64.rpm SHA-256: 7769bc3cd0683b105169b54a3a22faefb1ae93ddfef8fd3a1fb099bb1b2a52d9
osbuild-composer-tests-debuginfo-134.1-3.el10_0.aarch64.rpm SHA-256: 0e585f80aacf6bed86cf3ebfd434e03989b7e50c4f09eefb1aeb0f759ecb76df
osbuild-composer-worker-134.1-3.el10_0.aarch64.rpm SHA-256: cc75aa14a8ec0ba7344737db0fbece74a6808e384472c0602fe3f3bd1cbcb656
osbuild-composer-worker-debuginfo-134.1-3.el10_0.aarch64.rpm SHA-256: e0c85c82b621eaf95f672ed6cb37448066fc2a8d9b05115c3bedbcddcc003ae4

Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 10.0

SRPM
osbuild-composer-134.1-3.el10_0.src.rpm SHA-256: 5b2d8fda7962a336383f96d4854d0ab49ee02e20380492a55b2b016c15634ff5
s390x
osbuild-composer-134.1-3.el10_0.s390x.rpm SHA-256: b975aac55aae32248de56b400c86c30511dc70b0a00fa9827da9332be66030ae
osbuild-composer-core-134.1-3.el10_0.s390x.rpm SHA-256: 254489f47811f9253bb8e4b842f51bddb11e6c2beae8002b706dacaef92a255c
osbuild-composer-core-debuginfo-134.1-3.el10_0.s390x.rpm SHA-256: b629c1d3752391f40cda1f5f330c08f3fefe9abc7c2e6712e4fe1f4aaa1779ab
osbuild-composer-debugsource-134.1-3.el10_0.s390x.rpm SHA-256: c003a62ff176b64705d7b57786ba212327e813e06eae3d6a3a01f71d9516ca22
osbuild-composer-tests-debuginfo-134.1-3.el10_0.s390x.rpm SHA-256: 2bbc94ae4e50d5b04f32d4cb76c95a4696e20f5fce1b0121d75efec0fd260151
osbuild-composer-worker-134.1-3.el10_0.s390x.rpm SHA-256: dccbee25d737c6511bb7dbd3250d7a907f88dbfd589cfaa66e3af947eab84c8b
osbuild-composer-worker-debuginfo-134.1-3.el10_0.s390x.rpm SHA-256: 6cec41698a641f824d36a65f54e64b47c3fd4789dac152d0527cda2fdc168bce

Red Hat Enterprise Linux for Power, little endian - 4 years of support 10.0

SRPM
osbuild-composer-134.1-3.el10_0.src.rpm SHA-256: 5b2d8fda7962a336383f96d4854d0ab49ee02e20380492a55b2b016c15634ff5
ppc64le
osbuild-composer-134.1-3.el10_0.ppc64le.rpm SHA-256: df5d2712c65eb36c2907979261d8502613dbe1f23c6dfcf373ce2b700b1cc4ac
osbuild-composer-core-134.1-3.el10_0.ppc64le.rpm SHA-256: 3fe6b05eeaf74a5e04ce8fa051f58b8ed46faec6b91a0979cfe792de333bb09c
osbuild-composer-core-debuginfo-134.1-3.el10_0.ppc64le.rpm SHA-256: 5bbe584d0e5aa481c27b9522466a534598836ff41ff2986b80b4cfc620245ebe
osbuild-composer-debugsource-134.1-3.el10_0.ppc64le.rpm SHA-256: 4699ee9857f591e5afcf2f7afee6a73195bddff6abc7483f577d275cdbc820e1
osbuild-composer-tests-debuginfo-134.1-3.el10_0.ppc64le.rpm SHA-256: 8f85527b6bd9483831349286feb1779121dd5d7bf46a73ec2455922095e26603
osbuild-composer-worker-134.1-3.el10_0.ppc64le.rpm SHA-256: b7b41b61e9a5f45f504e766accec8aaac96a428067b81ed445e2f1ac36d44ac8
osbuild-composer-worker-debuginfo-134.1-3.el10_0.ppc64le.rpm SHA-256: 910044e4a5b700e26b2c3085ebb9ebb0f3967303f22605e076d15639afbe1103

Red Hat Enterprise Linux for x86_64 - 4 years of updates 10.0

SRPM
osbuild-composer-134.1-3.el10_0.src.rpm SHA-256: 5b2d8fda7962a336383f96d4854d0ab49ee02e20380492a55b2b016c15634ff5
x86_64
osbuild-composer-134.1-3.el10_0.x86_64.rpm SHA-256: 482eeb1870b254f322414790cc1ff2545b9121702c5acc9d0ee018c4b9ffe622
osbuild-composer-core-134.1-3.el10_0.x86_64.rpm SHA-256: 15c4506ef0551a007b7aa21e76c2053b35fd48e6ed44d5952bf596a961a7fd5c
osbuild-composer-core-debuginfo-134.1-3.el10_0.x86_64.rpm SHA-256: 78f9a3ed146b3617a1fdf5d1f16284462530f8baf140f2f2980632564e6c7b2c
osbuild-composer-debugsource-134.1-3.el10_0.x86_64.rpm SHA-256: 0e951783edc55e993719b4a8b3876b5a6a357edaab8632b8d25fc6286e44c625
osbuild-composer-tests-debuginfo-134.1-3.el10_0.x86_64.rpm SHA-256: 229c0487e80d0f513aeca1172f8d3509a2264530765c980810ae7a434f5f4b42
osbuild-composer-worker-134.1-3.el10_0.x86_64.rpm SHA-256: cb7cec5d7cd4b548d91efd4a4c90835463a78012e0cc13503fb926e70811dede
osbuild-composer-worker-debuginfo-134.1-3.el10_0.x86_64.rpm SHA-256: fd93905694ed99cbeed8ac85e7c93b0f1b703972406d90e27613d9646b6cf235

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.