Summary
[134.1-3.0.1]
- Add OL10 support
- Update repository URLs for baseos, appstream and UERK
- Fix the label for UEKR repository
- Simplify repository names [JIRA: OLDIS-35893]
- Ensure build on latest golang: CVE-2024-34156
- Refactor patches to fix some naming and set a correct kernel for Oracle Linux [Orabug: 37253643]
- Support using OCI variables inside built images [JIRA: OLDIS-35302]
- Support using repository definitons with OCI variables [JIRA: OLDIS-38657]
- Update repositories to contain OCI variables
- Remove image types Minimal-raw and wsl [JIRA: OLDIS-38123]
- Increase default /boot size to 1GB [Orabug: 36827079]
- Add support for OCI hybrid images [JIRA: OLDIS-33593]
- enable aarch64 OCI image builds [JIRA: OLDIS-33593]
- support for building OL8/9 images on Oracle Linux 9 [Orabug: 36400619]
- Rebuild for CVE-2025-22871
[134.1-3]
- Fix json tailoring blueprint conversion
Resolves: RHEL-115392
- Fix unclosed logrus logging pipes
Resolves: RHEL-121533
- Update go-jose dependency
Resolves: RHEL-82957 (CVE-2025-27144)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 10 | osbuild-composer | 0:134.1-3.0.1.el10_0 |
| Oracle Linux · 10 | osbuild-composer-core | 0:134.1-3.0.1.el10_0 |
| Oracle Linux · 10 | osbuild-composer-worker | 0:134.1-3.0.1.el10_0 |
Vulnerabilities 1
-
Medium 6.6
Go JOSE's Parsing Vulnerable to Denial of Service
Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. In versions on the 4.x branch prior to ve…