Skip to content
OpenAdvisories
Medium RLSA-2025:7397 1 CVE

Moderate: skopeo security update

Published Oct 4, 2025 · Updated Oct 7, 2025

Ecosystem: Rocky Linux

Summary

The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files.

Security Fix(es):

* go-jose: Go JOSE's Parsing Vulnerable to Denial of Service (CVE-2025-27144)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Fixed packages 1

ReleasePackageFixed in
Rocky Linux · 9 skopeo 2:1.18.1-1.el9_6

Vulnerabilities 1

  • Medium 6.6
    CVE-2025-27144

    Go JOSE's Parsing Vulnerable to Denial of Service

    Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. In versions on the 4.x branch prior to ve…

    go-jose go-jose zot kubescape Debian Ubuntu Azure Linux Wolfi Go

References

  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2347423