Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | osbuild-composer | 0:134.1-6.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | osbuild-composer-core | 0:134.1-6.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | osbuild-composer-core-debuginfo | 0:134.1-6.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | osbuild-composer-debugsource | 0:134.1-6.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | osbuild-composer-tests-debuginfo | 0:134.1-6.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | osbuild-composer-worker | 0:134.1-6.el10_0 |
| Red Hat · RHEL 10.0 EUS enterprise_linux_eus:10.0 | osbuild-composer-worker-debuginfo | 0:134.1-6.el10_0 |
Vulnerabilities 1
-
Critical 9.1
Unexpected session resumption in crypto/tls
During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user ca…
References
-
article
https://access.redhat.com/security/updates/classification/#moderate
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2437111
-
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_17686.json
-
report
https://access.redhat.com/security/cve/CVE-2025-68121
-
advisory
https://www.cve.org/CVERecord?id=CVE-2025-68121
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2025-68121
-
article
https://go.dev/cl/737700
-
article
https://go.dev/issue/77217
-
article
https://groups.google.com/g/golang-announce/c/K09ubi9FQFk
-
advisory
https://pkg.go.dev/vuln/GO-2026-4337