Red Hat Security Advisory: osbuild and osbuild-composer security update

Fixed packages 8

Vulnerabilities 3

• High 7.5
  CVE-2024-1394

  Golang-fips/openssl: memory leaks in code encrypting and decrypting rsa payloads

  A memory leak flaw was found in Golang in the RSA encrypting/decrypting code, which might lead to a resource exhaustion vulnerability using attacker-controlled inputs​. The memory leak happens in github.com/golang-fips/openssl/openssl/rsa.go#L113. The objects…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Azure Linux Go
  Mar 21, 2024
• High 7.5
  CVE-2024-34158

  Stack exhaustion in Parse in go/build/constraint

  Calling Parse on a "// +build" build tag line with deeply nested expressions can cause a panic due to stack exhaustion.

  Go standard library go/build/constraint katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Sep 6, 2024
• Medium 6.5
  CVE-2024-9355

  Golang-fips: golang fips zeroed buffer

  A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non…

  Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Azure Linux Go
  Oct 1, 2024

References

• article
  https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/9.6_release_notes/index
• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2262921
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2310529
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2315719
• article
  https://issues.redhat.com/browse/RHEL-16396
• article
  https://issues.redhat.com/browse/RHEL-4570
• article
  https://issues.redhat.com/browse/RHEL-4617
• article
  https://issues.redhat.com/browse/RHEL-4636
• article
  https://issues.redhat.com/browse/RHEL-56049
• article
  https://issues.redhat.com/browse/RHEL-78659
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_7118.json
• report
  https://access.redhat.com/security/cve/CVE-2024-1394
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-1394
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-1394
• article
  https://github.com/golang-fips/openssl/commit/85d31d0d257ce842c8a1e63c4d230ae850348136
• article
  https://github.com/golang-fips/openssl/security/advisories/GHSA-78hx-gp6g-7mj6
• article
  https://github.com/microsoft/go-crypto-openssl/commit/104fe7f6912788d2ad44602f77a0a0a62f1f259f
• advisory
  https://pkg.go.dev/vuln/GO-2024-2660
• article
  https://vuln.go.dev/ID/GO-2024-2660.json
• report
  https://access.redhat.com/security/cve/CVE-2024-9355
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-9355
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-9355
• article
  https://github.com/golang-fips/openssl/pull/198
• report
  https://access.redhat.com/security/cve/CVE-2024-34158
• advisory
  https://www.cve.org/CVERecord?id=CVE-2024-34158
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2024-34158
• article
  https://go.dev/cl/611240
• article
  https://go.dev/issue/69141
• article
  https://groups.google.com/g/golang-dev/c/S9POB9NCTdk
• advisory
  https://pkg.go.dev/vuln/GO-2024-3107