Summary
[1.41.6-1.0.1]
- Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117178]
[2:1.41.6-1]
- update to the latest content of https://github.com/containers/buildah/tree/release-1.41
(https://github.com/containers/buildah/commit/2ece502)
- fixes '[Minor Incident] CVE-2025-52881 buildah: container escape and denial of service due to arbitrary write gadgets and procfs write redirects [rhel-10.1.z]'
- Resolves: RHEL-126634
[2:1.41.4-3]
- rebuild for CVE-2025-58183
- Resolves: RHEL-125628
[2:1.41.4-2]
- rebuild as the last build was built in the wrong tag
- Related: RHEL-115167
[2:1.41.4-1]
- update to the latest content of https://github.com/containers/buildah/tree/release-1.41
(https://github.com/containers/buildah/commit/ee5b574)
- fixes 'buildah: create parent directories of mount targets with mode 0755 - [RHEL-10.1] 0day'
- Resolves: RHEL-115167
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 10 | buildah | 2:1.41.6-1.0.1.el10_1 |
| Oracle Linux · 10 | buildah-tests | 2:1.41.6-1.0.1.el10_1 |
Vulnerabilities 2
-
High 7.3CVE-2025-52881 Public exploit
runc: LSM labels can be bypassed with malicious config using dummy procfs files
runc is a CLI tool for spawning and running containers according to the OCI specification. In versions 1.2.7, 1.3.2 and 1.4.0-rc.2, an attacker can trick runc into misdirecting writes to /proc to other procfs files through the use of a racing container with s…
-
Medium 4.3
Unbounded allocation when parsing GNU sparse map in archive/tar
tar.Reader does not set a maximum size on the number of sparse region data blocks in GNU tar pax 1.0 sparse files. A maliciously-crafted archive containing a large number of sparse regions can cause a Reader to read an unbounded amount of data from the archiv…