Summary
cockpit-composer
[45-1.0.1]
- Make per page documentation links point to Oracle Linux [Orabug: 32013095], [Orabug:34398922]
[45-1]
- New upstream release
[44-1]
- New upstream release
[43-1]
- New upstream release
[42-1]
- New upstream release
osbuild
[81-1]
- New upstream release
[80-1]
- New upstream release
[79-1]
- New upstream release
[78-1]
- New upstream release
[77-1]
- New upstream release
[76-1]
- New upstream release
[75-1]
- New upstream release
[74-1]
- New upstream release
[73-1]
- New upstream release
[72-1]
- New upstream release
[71-1]
- New upstream release
[70-1]
- New upstream release
[69-1]
- New upstream release
osbuild-composer
[76-2]
- distro/rhel: add payload repos to os package set (rhbz#2177699)
- Manifest: always set kernel options in grub2 stage (rhbz#2162299)
[76-1]
- New upstream release
[75-1]
- New upstream release
[74-1]
- New upstream release
[73-1]
- New upstream release
[72-1]
- New upstream release
[71-1]
- New upstream release
[70-1]
- New upstream release
[69-1]
- New upstream release
[68-1]
- New upstream release
[67-2]
- Fix functional tests to make them pass in RHEL-9.2 gating
[67-1]
- New upstream release
[62-1]
- New upstream release
[60-1]
- New upstream release
[59-1]
- New upstream release
[58-1]
- New upstream release
[57-1]
- New upstream release
[55-1]
- New upstream release
[54-1]
- New upstream release
[53-1]
- New upstream release
[51-1]
- New upstream release
[46-1]
- New upstream release
[45-1]
- New upstream release
[44-1]
- New upstream release
[43-1]
- New upstream release
[42-1]
- New upstream release
[41-1]
- New upstream release
[40-1]
- New upstream release
[39-1]
- New upstream release
[38-1]
- New upstream release
* Tue Nov 02 2021 lavocatt - 37-1
- New upstream release
[36-1]
- New upstream release
[33-1]
- New upstream release
[32-1]
- New upstream release
[31-1]
- New upstream release
[30-2]
- Rebuilt for IMA sigs, glibc 2.34, aarch64 flags
Related: rhbz#1991688
[30-1]
- New upstream release
[29-3]
- Rebuilt for RHEL 9 BETA for openssl 3.0
Related: rhbz#1971065
[29-2]
- Rebuilt for RHEL 9 BETA on Apr 15th 2021. Related: rhbz#1947937
weldr-client
[35.9-1]
- Copy rhel-92.json test repository from osbuild-composer
- Update osbuild-composer test repositories from osbuild-composer
- New release: 35.9 (bcl)
Resolves: rhbz#2164560
- tests: Replace os.MkdirTemp with t.TempDir (bcl)
- blueprint save: Allow overriding bad blueprint names (bcl)
- tests: Clean up checking err in tests (bcl)
- composer-cli: Implement blueprints diff (bcl)
- saveBlueprint: Return the filename to the caller (bcl)
- composer-cli: Add tests for using --commit with old servers (bcl)
- weldr: Return error about the blueprints change route (bcl)
- weldr: Save the http status code as part of APIResponse (bcl)
- Add --commit support to blueprints save (bcl)
- Add --commit to blueprints show (bcl)
- gitleaks: Exclude the test password used in tests (bcl)
- ci: add tags to AWS instances (tlavocat)
- Update github.com/BurntSushi/toml to 1.2.1
- Update github.com/stretchr/testify to 1.8.1
- Update bump github.com/spf13/cobra to 1.6.1
- New release: 35.8 (bcl)
- completion: Remove providers from bash completion script (bcl)
- completion: Filter out new headers from compose list (bcl)
- docs: Remove unneeded Long descriptions (bcl)
- docs: Use a custom help template (bcl)
- docs: Add more command documentation (bcl)
- cmdline: Add package glob support to modules list command (bcl)
- workflow: Add govulncheck on go v1.18 (bcl)
- tests: Update to use golangci-lint 1.49.0 (bcl)
- New release: 35.7 (bcl)
- spec: Move %gometa macro above %gourl (bcl)
- weldr: When starting a compose pass size as bytes, not MiB (bcl)
- tests: Use correct size value in bytes for test (bcl)
- workflow: Add Go 1.18 to text matrix (bcl)
- Replace deprecated ioutil functions (bcl)
- New release: 35.6 (bcl)
- tests: Update tests for osbuild-composer changes (bcl)
- CMD: Compose status format (eloy.coto)
- CMD: Compose list format (eloy.coto)
- tests: Update tests to check for JSON list output (bcl)
- composer-cli: Change JSON output to be a list of objects (bcl)
- weldr: Simplify the old ComposeLog, etc. functions (bcl)
- composer-cli: Add --filename to blueprints freeze save command (bcl)
- composer-cli: Add --filename to blueprints save command (bcl)
- composer-cli: Add --filename to compose logs command (bcl)
- composer-cli: Add --filename to compose image command (bcl)
- composer-cli: Add --filename to compose metadata command (bcl)
- composer-cli: Add --filename to compose results command (bcl)
- weldr: Add saving to a new filename to GetFilePath function (bcl)
- github: Fix issue with codecov and forced pushes in PRs (bcl)
- Use golangci-lint 1.45.2 in workflow (bcl)
- Run workflow tests for go 1.16.x and 1.17.x (bcl)
- Move go.mod to go 1.16 (bcl)
- workflows/trigger-gitlab: run Gitlab CI in new image-builder project (jrusz)
- Update GitHub actions/setup-go to 3
- Update GitHub actions/checkout to 3
Fixed packages 12
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | cockpit-composer | 0:45-1.0.1.el9_2 |
| Oracle Linux · 9 | osbuild | 0:81-1.el9 |
| Oracle Linux · 9 | osbuild-composer | 0:76-2.el9_2 |
| Oracle Linux · 9 | osbuild-composer-core | 0:76-2.el9_2 |
| Oracle Linux · 9 | osbuild-composer-dnf-json | 0:76-2.el9_2 |
| Oracle Linux · 9 | osbuild-composer-worker | 0:76-2.el9_2 |
| Oracle Linux · 9 | osbuild-luks2 | 0:81-1.el9 |
| Oracle Linux · 9 | osbuild-lvm2 | 0:81-1.el9 |
| Oracle Linux · 9 | osbuild-ostree | 0:81-1.el9 |
| Oracle Linux · 9 | osbuild-selinux | 0:81-1.el9 |
| Oracle Linux · 9 | python3-osbuild | 0:81-1.el9 |
| Oracle Linux · 9 | weldr-client | 0:35.9-1.el9 |
Vulnerabilities 5
-
High 7.5
golang.org/x/net/http2 Denial of Service vulnerability
In net/http in Go before 1.18.6 and 1.19.x before 1.19.1, attackers can cause a denial of service because an HTTP/2 connection can hang during closing if shutdown were preempted by a fatal error.
-
Medium 5.3CVE-2022-41717 Public exploit
Excessive memory growth in net/http and golang.org/x/net/http2
An attacker can cause excessive memory growth in a Go server accepting HTTP/2 requests. HTTP/2 server connections contain a cache of HTTP header keys sent by the client. While the total number of entries in this cache is capped, an attacker sending very large…
-
Unscored —
Unbounded memory consumption when reading headers in archive/tar
Reader.Read does not set a limit on the maximum size of file headers. A maliciously crafted archive could cause Read to allocate unbounded amounts of memory, potentially causing resource exhaustion or panics. After fix, Reader.Read limits the maximum size of …
-
Unscored —
Incorrect sanitization of forwarded query parameters in net/http/httputil
Requests forwarded by ReverseProxy include the raw query parameters from the inbound request, including unparsable parameters rejected by net/http. This could permit query parameter smuggling when a Go proxy forwards a parameter with an unparsable value. Afte…
-
Unscored —
Memory exhaustion when compiling regular expressions in regexp/syntax
Programs which compile regular expressions from untrusted sources may be vulnerable to memory exhaustion or denial of service. The parsed regexp representation is linear in the size of the input, but in some cases the constant factor can be as high as 40,000,…