High ELSA-2024-9456 1 CVE

Important: osbuild-composer security update (Oracle Linux 9)

Published Nov 20, 2024 · Updated Nov 20, 2024

Ecosystem: Oracle Linux

Summary

[118-2.0.1]
- Simplify repository names [JIRA: OLDIS-35893]

[118-2]
- Ensure build on latest golang: CVE-2024-34156

Fixed packages 3

Release	Package	Fixed in
Oracle Linux · 9	osbuild-composer	0:118-2.0.1.el9_5
Oracle Linux · 9	osbuild-composer-core	0:118-2.0.1.el9_5
Oracle Linux · 9	osbuild-composer-worker	0:118-2.0.1.el9_5

Vulnerabilities 1

High 7.5

CVE-2024-34156

Stack exhaustion in Decoder.Decode in encoding/gob

Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635.

Go standard library encoding/gob katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go

Sep 6, 2024