红帽产品勘误 RHSA-2026:0226 - Security Advisory
发布：
2026-01-07
已更新：
2026-01-07

RHSA-2026:0226 - Security Advisory

概述

Moderate: osbuild-composer security update

类型/严重性

Security Advisory: Moderate

Red Hat Lightspeed patch analysis

识别并修复受此公告影响的系统。

查看受影响的系统

标题

An update for osbuild-composer is now available for Red Hat Enterprise Linux 9.4 Extended Update Support.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

描述

A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients.

Security Fix(es):

  • golang: archive/tar: Unbounded allocation when parsing GNU sparse map (CVE-2025-58183)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

解决方案

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

受影响的产品

  • Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.4 x86_64
  • Red Hat Enterprise Linux Server - AUS 9.4 x86_64
  • Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.4 s390x
  • Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.4 ppc64le
  • Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.4 aarch64
  • Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.4 ppc64le
  • Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.4 x86_64
  • Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.4 aarch64
  • Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.4 s390x

修复

  • BZ - 2407258 - CVE-2025-58183 golang: archive/tar: Unbounded allocation when parsing GNU sparse map

Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.4

SRPM
osbuild-composer-101.3-3.el9_4.src.rpm SHA-256: 11f1d4afbd07369434f257402c87dc30ed510df41e85283f7762040f3ae39c1b
x86_64
osbuild-composer-101.3-3.el9_4.x86_64.rpm SHA-256: b10f1f5e0de361b4499e702707dc84e237305c8886818965dae929af55af66e7
osbuild-composer-core-101.3-3.el9_4.x86_64.rpm SHA-256: 7350d8dc7a30a4e1a94c8ed416ee379c3cef8d0e482edc1cd6736ac727a1e7c4
osbuild-composer-core-debuginfo-101.3-3.el9_4.x86_64.rpm SHA-256: d357a26d4cc146be788884861a2c3e279bb073e89c8facbdbc4bfbbdee0347de
osbuild-composer-debuginfo-101.3-3.el9_4.x86_64.rpm SHA-256: c42d83e2e5c852b828bb0b078559e880317df7a46423ca64813127d28d030d3b
osbuild-composer-debugsource-101.3-3.el9_4.x86_64.rpm SHA-256: 2516e0d41d57bd9f3a6ccfe00cc408a59c0fe704af1e3c542e974d11f7c83502
osbuild-composer-tests-debuginfo-101.3-3.el9_4.x86_64.rpm SHA-256: 44675daa96a3cf1e74ffb6ca091179a0aa05be6a411b1d9b8d84a583c2f513b0
osbuild-composer-worker-101.3-3.el9_4.x86_64.rpm SHA-256: 211082f2c0f65e75caa63f2d1762a3ee80a7bcd4f96712370b89301f32698505
osbuild-composer-worker-debuginfo-101.3-3.el9_4.x86_64.rpm SHA-256: 9ae835d89270af968bbca2c59bc673740cbdae506324acac0e8983c509833f2d

Red Hat Enterprise Linux Server - AUS 9.4

SRPM
osbuild-composer-101.3-3.el9_4.src.rpm SHA-256: 11f1d4afbd07369434f257402c87dc30ed510df41e85283f7762040f3ae39c1b
x86_64
osbuild-composer-101.3-3.el9_4.x86_64.rpm SHA-256: b10f1f5e0de361b4499e702707dc84e237305c8886818965dae929af55af66e7
osbuild-composer-core-101.3-3.el9_4.x86_64.rpm SHA-256: 7350d8dc7a30a4e1a94c8ed416ee379c3cef8d0e482edc1cd6736ac727a1e7c4
osbuild-composer-core-debuginfo-101.3-3.el9_4.x86_64.rpm SHA-256: d357a26d4cc146be788884861a2c3e279bb073e89c8facbdbc4bfbbdee0347de
osbuild-composer-debuginfo-101.3-3.el9_4.x86_64.rpm SHA-256: c42d83e2e5c852b828bb0b078559e880317df7a46423ca64813127d28d030d3b
osbuild-composer-debugsource-101.3-3.el9_4.x86_64.rpm SHA-256: 2516e0d41d57bd9f3a6ccfe00cc408a59c0fe704af1e3c542e974d11f7c83502
osbuild-composer-tests-debuginfo-101.3-3.el9_4.x86_64.rpm SHA-256: 44675daa96a3cf1e74ffb6ca091179a0aa05be6a411b1d9b8d84a583c2f513b0
osbuild-composer-worker-101.3-3.el9_4.x86_64.rpm SHA-256: 211082f2c0f65e75caa63f2d1762a3ee80a7bcd4f96712370b89301f32698505
osbuild-composer-worker-debuginfo-101.3-3.el9_4.x86_64.rpm SHA-256: 9ae835d89270af968bbca2c59bc673740cbdae506324acac0e8983c509833f2d

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.4

SRPM
osbuild-composer-101.3-3.el9_4.src.rpm SHA-256: 11f1d4afbd07369434f257402c87dc30ed510df41e85283f7762040f3ae39c1b
s390x
osbuild-composer-101.3-3.el9_4.s390x.rpm SHA-256: 7c55750f3b0c4e1a409aac6331506be17fb924a9f7f9b98055305c5e47756617
osbuild-composer-core-101.3-3.el9_4.s390x.rpm SHA-256: abd07c277d80b1dc29e4d8637fc5a86fda11e76c971a882877ceca58d5cddfaf
osbuild-composer-core-debuginfo-101.3-3.el9_4.s390x.rpm SHA-256: 18e1efb5168e86b316171c5c8bd683c3eda1459233bbbe31fd48eee215bcaf02
osbuild-composer-debuginfo-101.3-3.el9_4.s390x.rpm SHA-256: 9f07cecb52728a1d2db555b04e364147229eaac9c476f7b1b878ae4c32576ef5
osbuild-composer-debugsource-101.3-3.el9_4.s390x.rpm SHA-256: c03bad4de0835987305f88629cec9e6a863b1ebc8aa1674912c046632e5198ab
osbuild-composer-tests-debuginfo-101.3-3.el9_4.s390x.rpm SHA-256: 06862c29fce7bf74b41bbc2c7cca590c92b2332df3fb699cb3da9ad008a2da51
osbuild-composer-worker-101.3-3.el9_4.s390x.rpm SHA-256: 3320f727d7376a7ec1774fb126678e0af8685fd3b96b1b6dbb7ad0e7f4ed568f
osbuild-composer-worker-debuginfo-101.3-3.el9_4.s390x.rpm SHA-256: 016debe54eddb961c4168f1df513bde24a8d394def0929e669a60e914f665583

Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.4

SRPM
osbuild-composer-101.3-3.el9_4.src.rpm SHA-256: 11f1d4afbd07369434f257402c87dc30ed510df41e85283f7762040f3ae39c1b
ppc64le
osbuild-composer-101.3-3.el9_4.ppc64le.rpm SHA-256: c41781d98be2db22018341942e0dfe3108d1b077e48a3732f1edb82cc0bb388a
osbuild-composer-core-101.3-3.el9_4.ppc64le.rpm SHA-256: fc6719802dd23a455b098b6f267ee0f1600a14bcd2731c028402fbdab3ad07dc
osbuild-composer-core-debuginfo-101.3-3.el9_4.ppc64le.rpm SHA-256: 443c6937d7b707b46a8aa0348f3ec34c07002f022b17c96f7cd8f71375ed7e2b
osbuild-composer-debuginfo-101.3-3.el9_4.ppc64le.rpm SHA-256: dc2810e358801e27151bc4362f983e4ca0053717b36551b565d21e88f5374e1b
osbuild-composer-debugsource-101.3-3.el9_4.ppc64le.rpm SHA-256: 28b625465ba4f711ebd5f55b5af5ebe7d3dcd15716fe11c3085b82bd8d0bbad6
osbuild-composer-tests-debuginfo-101.3-3.el9_4.ppc64le.rpm SHA-256: b3f2ee861ad73211266a17ace943a2c05d9096da21f422d453810a24b8533068
osbuild-composer-worker-101.3-3.el9_4.ppc64le.rpm SHA-256: 8fdd57423819664fe51f594a22220cb438e63b1ba9ae027257573275fe520cd0
osbuild-composer-worker-debuginfo-101.3-3.el9_4.ppc64le.rpm SHA-256: 05f015be0cdc2930dbbd6fc357a4e89df97d70c06ed602fa16600c690f6b78c5

Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.4

SRPM
osbuild-composer-101.3-3.el9_4.src.rpm SHA-256: 11f1d4afbd07369434f257402c87dc30ed510df41e85283f7762040f3ae39c1b
aarch64
osbuild-composer-101.3-3.el9_4.aarch64.rpm SHA-256: 55d47dc4a8a517365b0cc8df2c31f81c2e8964aca9df6f57def0fdf52b7b3e19
osbuild-composer-core-101.3-3.el9_4.aarch64.rpm SHA-256: ec7abbdb23b51e56daad6fd477cf8ce69b04f1ed503f13e6045d4540b17c188f
osbuild-composer-core-debuginfo-101.3-3.el9_4.aarch64.rpm SHA-256: 53627f181a6535a59431146a7ee1836da7a129150e1f6684d13dca8bcf4d55c9
osbuild-composer-debuginfo-101.3-3.el9_4.aarch64.rpm SHA-256: d2584c4b0b27df8711667a6d720d805aadff3cb7a82e30d5bd9ebfacecca91de
osbuild-composer-debugsource-101.3-3.el9_4.aarch64.rpm SHA-256: 0c44e6d6763f6e14ce8acc1df3ca3d3e3f42d86354d0a5155047fc6980c824d6
osbuild-composer-tests-debuginfo-101.3-3.el9_4.aarch64.rpm SHA-256: a674ca204a68a0b9820f2e3254c3da9c6282261d93fcf30fe1edc6b10bc666f6
osbuild-composer-worker-101.3-3.el9_4.aarch64.rpm SHA-256: c8cce85f27b501e19e8ab0b5de99bcbf506eb0411fd6c649fbf130ccc1d10451
osbuild-composer-worker-debuginfo-101.3-3.el9_4.aarch64.rpm SHA-256: 402ceb966a70e7463ed38e22987368af3c8d3ffc8386bac86191805799e3ae4f

Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.4

SRPM
osbuild-composer-101.3-3.el9_4.src.rpm SHA-256: 11f1d4afbd07369434f257402c87dc30ed510df41e85283f7762040f3ae39c1b
ppc64le
osbuild-composer-101.3-3.el9_4.ppc64le.rpm SHA-256: c41781d98be2db22018341942e0dfe3108d1b077e48a3732f1edb82cc0bb388a
osbuild-composer-core-101.3-3.el9_4.ppc64le.rpm SHA-256: fc6719802dd23a455b098b6f267ee0f1600a14bcd2731c028402fbdab3ad07dc
osbuild-composer-core-debuginfo-101.3-3.el9_4.ppc64le.rpm SHA-256: 443c6937d7b707b46a8aa0348f3ec34c07002f022b17c96f7cd8f71375ed7e2b
osbuild-composer-debuginfo-101.3-3.el9_4.ppc64le.rpm SHA-256: dc2810e358801e27151bc4362f983e4ca0053717b36551b565d21e88f5374e1b
osbuild-composer-debugsource-101.3-3.el9_4.ppc64le.rpm SHA-256: 28b625465ba4f711ebd5f55b5af5ebe7d3dcd15716fe11c3085b82bd8d0bbad6
osbuild-composer-tests-debuginfo-101.3-3.el9_4.ppc64le.rpm SHA-256: b3f2ee861ad73211266a17ace943a2c05d9096da21f422d453810a24b8533068
osbuild-composer-worker-101.3-3.el9_4.ppc64le.rpm SHA-256: 8fdd57423819664fe51f594a22220cb438e63b1ba9ae027257573275fe520cd0
osbuild-composer-worker-debuginfo-101.3-3.el9_4.ppc64le.rpm SHA-256: 05f015be0cdc2930dbbd6fc357a4e89df97d70c06ed602fa16600c690f6b78c5

Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.4

SRPM
osbuild-composer-101.3-3.el9_4.src.rpm SHA-256: 11f1d4afbd07369434f257402c87dc30ed510df41e85283f7762040f3ae39c1b
x86_64
osbuild-composer-101.3-3.el9_4.x86_64.rpm SHA-256: b10f1f5e0de361b4499e702707dc84e237305c8886818965dae929af55af66e7
osbuild-composer-core-101.3-3.el9_4.x86_64.rpm SHA-256: 7350d8dc7a30a4e1a94c8ed416ee379c3cef8d0e482edc1cd6736ac727a1e7c4
osbuild-composer-core-debuginfo-101.3-3.el9_4.x86_64.rpm SHA-256: d357a26d4cc146be788884861a2c3e279bb073e89c8facbdbc4bfbbdee0347de
osbuild-composer-debuginfo-101.3-3.el9_4.x86_64.rpm SHA-256: c42d83e2e5c852b828bb0b078559e880317df7a46423ca64813127d28d030d3b
osbuild-composer-debugsource-101.3-3.el9_4.x86_64.rpm SHA-256: 2516e0d41d57bd9f3a6ccfe00cc408a59c0fe704af1e3c542e974d11f7c83502
osbuild-composer-tests-debuginfo-101.3-3.el9_4.x86_64.rpm SHA-256: 44675daa96a3cf1e74ffb6ca091179a0aa05be6a411b1d9b8d84a583c2f513b0
osbuild-composer-worker-101.3-3.el9_4.x86_64.rpm SHA-256: 211082f2c0f65e75caa63f2d1762a3ee80a7bcd4f96712370b89301f32698505
osbuild-composer-worker-debuginfo-101.3-3.el9_4.x86_64.rpm SHA-256: 9ae835d89270af968bbca2c59bc673740cbdae506324acac0e8983c509833f2d

Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.4

SRPM
osbuild-composer-101.3-3.el9_4.src.rpm SHA-256: 11f1d4afbd07369434f257402c87dc30ed510df41e85283f7762040f3ae39c1b
aarch64
osbuild-composer-101.3-3.el9_4.aarch64.rpm SHA-256: 55d47dc4a8a517365b0cc8df2c31f81c2e8964aca9df6f57def0fdf52b7b3e19
osbuild-composer-core-101.3-3.el9_4.aarch64.rpm SHA-256: ec7abbdb23b51e56daad6fd477cf8ce69b04f1ed503f13e6045d4540b17c188f
osbuild-composer-core-debuginfo-101.3-3.el9_4.aarch64.rpm SHA-256: 53627f181a6535a59431146a7ee1836da7a129150e1f6684d13dca8bcf4d55c9
osbuild-composer-debuginfo-101.3-3.el9_4.aarch64.rpm SHA-256: d2584c4b0b27df8711667a6d720d805aadff3cb7a82e30d5bd9ebfacecca91de
osbuild-composer-debugsource-101.3-3.el9_4.aarch64.rpm SHA-256: 0c44e6d6763f6e14ce8acc1df3ca3d3e3f42d86354d0a5155047fc6980c824d6
osbuild-composer-tests-debuginfo-101.3-3.el9_4.aarch64.rpm SHA-256: a674ca204a68a0b9820f2e3254c3da9c6282261d93fcf30fe1edc6b10bc666f6
osbuild-composer-worker-101.3-3.el9_4.aarch64.rpm SHA-256: c8cce85f27b501e19e8ab0b5de99bcbf506eb0411fd6c649fbf130ccc1d10451
osbuild-composer-worker-debuginfo-101.3-3.el9_4.aarch64.rpm SHA-256: 402ceb966a70e7463ed38e22987368af3c8d3ffc8386bac86191805799e3ae4f

Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.4

SRPM
osbuild-composer-101.3-3.el9_4.src.rpm SHA-256: 11f1d4afbd07369434f257402c87dc30ed510df41e85283f7762040f3ae39c1b
s390x
osbuild-composer-101.3-3.el9_4.s390x.rpm SHA-256: 7c55750f3b0c4e1a409aac6331506be17fb924a9f7f9b98055305c5e47756617
osbuild-composer-core-101.3-3.el9_4.s390x.rpm SHA-256: abd07c277d80b1dc29e4d8637fc5a86fda11e76c971a882877ceca58d5cddfaf
osbuild-composer-core-debuginfo-101.3-3.el9_4.s390x.rpm SHA-256: 18e1efb5168e86b316171c5c8bd683c3eda1459233bbbe31fd48eee215bcaf02
osbuild-composer-debuginfo-101.3-3.el9_4.s390x.rpm SHA-256: 9f07cecb52728a1d2db555b04e364147229eaac9c476f7b1b878ae4c32576ef5
osbuild-composer-debugsource-101.3-3.el9_4.s390x.rpm SHA-256: c03bad4de0835987305f88629cec9e6a863b1ebc8aa1674912c046632e5198ab
osbuild-composer-tests-debuginfo-101.3-3.el9_4.s390x.rpm SHA-256: 06862c29fce7bf74b41bbc2c7cca590c92b2332df3fb699cb3da9ad008a2da51
osbuild-composer-worker-101.3-3.el9_4.s390x.rpm SHA-256: 3320f727d7376a7ec1774fb126678e0af8685fd3b96b1b6dbb7ad0e7f4ed568f
osbuild-composer-worker-debuginfo-101.3-3.el9_4.s390x.rpm SHA-256: 016debe54eddb961c4168f1df513bde24a8d394def0929e669a60e914f665583

Red Hat 安全团队联络方式为 secalert@redhat.com。 更多联络细节请参考 https://access.redhat.com/security/team/contact/。