Summary
The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files.
Security Fix(es):
* net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)
* docker: Moby/Docker Engine: Arbitrary Code Execution via malicious container image and compressed archive upload (CVE-2026-41567)
Bug Fix(es) and Enhancement(s):
* Update skopeo to 1.22.2 [rhel-9.9] (JIRA:Rocky Linux-170520)
* update to the latest upstream release (JIRA:Rocky Linux-185740)
* switch skopeo to sustaining-engineering GitLab release-1.22 branch and bump epoch (JIRA:Rocky Linux-220456)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Rocky Linux 9 Release Notes linked from the References section.
Fixed packages 16
| Release | Package | Fixed in |
|---|---|---|
| Rocky Linux · 9 | skopeo | 3:1.22.2-4.el9 |
| Rocky Linux · 9 | skopeo | 3:1.22.2-4.el9 |
| Rocky Linux · 9 | skopeo | 3:1.22.2-4.el9 |
| Rocky Linux · 9 | skopeo | 3:1.22.2-4.el9 |
| Rocky Linux · 9 | skopeo-debuginfo | 3:1.22.2-4.el9 |
| Rocky Linux · 9 | skopeo-debuginfo | 3:1.22.2-4.el9 |
| Rocky Linux · 9 | skopeo-debuginfo | 3:1.22.2-4.el9 |
| Rocky Linux · 9 | skopeo-debuginfo | 3:1.22.2-4.el9 |
| Rocky Linux · 9 | skopeo-debugsource | 3:1.22.2-4.el9 |
| Rocky Linux · 9 | skopeo-debugsource | 3:1.22.2-4.el9 |
| Rocky Linux · 9 | skopeo-debugsource | 3:1.22.2-4.el9 |
| Rocky Linux · 9 | skopeo-debugsource | 3:1.22.2-4.el9 |
| Rocky Linux · 9 | skopeo-tests | 3:1.22.2-4.el9 |
| Rocky Linux · 9 | skopeo-tests | 3:1.22.2-4.el9 |
| Rocky Linux · 9 | skopeo-tests | 3:1.22.2-4.el9 |
| Rocky Linux · 9 | skopeo-tests | 3:1.22.2-4.el9 |
Vulnerabilities 2
-
High 7.5
Crash when handling long CNAME response in net
When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.
-
High 7.2CVE-2026-41567 Public exploit
Docker: `PUT /containers/{id}/archive` executes container binary on the host
Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to v2.0.0-beta.14, when a compressed archive is uploaded to a container via `PUT /containers/{id}/archive` or piped through `docker cp -`, the daemon resolves de…