Summary
The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files.
Security Fix(es):
* docker: Moby/Docker Engine: Arbitrary Code Execution via malicious container image and compressed archive upload (CVE-2026-41567)
Bug Fix(es) and Enhancement(s):
* update to the latest upstream release (JIRA:Rocky Linux-185735)
* skopeo: Bump epoch to preserve upgrade path (JIRA:Rocky Linux-220536)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Rocky Linux 10 Release Notes linked from the References section.
Fixed packages 16
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 10 | skopeo | 3:1.24.0-2.el10 |
| Rocky Linux · 10 | skopeo | 3:1.24.0-2.el10 |
| Rocky Linux · 10 | skopeo | 3:1.24.0-2.el10 |
| Rocky Linux · 10 | skopeo | 3:1.24.0-2.el10 |
| Rocky Linux · 10 | skopeo-debuginfo | 3:1.24.0-2.el10 |
| Rocky Linux · 10 | skopeo-debuginfo | 3:1.24.0-2.el10 |
| Rocky Linux · 10 | skopeo-debuginfo | 3:1.24.0-2.el10 |
| Rocky Linux · 10 | skopeo-debuginfo | 3:1.24.0-2.el10 |
| Rocky Linux · 10 | skopeo-debugsource | 3:1.24.0-2.el10 |
| Rocky Linux · 10 | skopeo-debugsource | 3:1.24.0-2.el10 |
| Rocky Linux · 10 | skopeo-debugsource | 3:1.24.0-2.el10 |
| Rocky Linux · 10 | skopeo-debugsource | 3:1.24.0-2.el10 |
| Rocky Linux · 10 | skopeo-tests | 3:1.24.0-2.el10 |
| Rocky Linux · 10 | skopeo-tests | 3:1.24.0-2.el10 |
| Rocky Linux · 10 | skopeo-tests | 3:1.24.0-2.el10 |
| Rocky Linux · 10 | skopeo-tests | 3:1.24.0-2.el10 |
Vulnerabilities 1
-
High 7.2CVE-2026-41567 Public exploit
Docker: `PUT /containers/{id}/archive` executes container binary on the host
Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to v2.0.0-beta.14, when a compressed archive is uploaded to a container via `PUT /containers/{id}/archive` or piped through `docker cp -`, the daemon resolves de…