Summary
[1.43.1-3.0.1]
- Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117178]
[2:1.43.1-3]
- bump golang.org/x/crypto to v0.53.0 to fix CVE-2026-39832 and CVE-2026-39835
- Resolves: RHEL-188733 RHEL-190066
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | buildah | 2:1.43.1-3.0.1.el9_8 |
| Oracle Linux · 9 | buildah-tests | 2:1.43.1-3.0.1.el9_8 |
Vulnerabilities 2
-
Critical 9.1
Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent
When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote…
-
Medium 5.3
Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh
SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.