skopeo-1.14.5-2.el9_4

エラータID: AXSA:2024-8905:05

Release date: 
Thursday, October 17, 2024 - 12:00
Subject: 
skopeo-1.14.5-2.el9_4
Affected Channels: 
MIRACLE LINUX 9 for x86_64
Severity: 
High
Description: 

The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files.

Security Fix(es):

* encoding/gob: golang: Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion (CVE-2024-34156)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

CVE-2024-34156
Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635.

Solution: 

Update packages.

CVEs: 
CVE-2024-34156
Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a follow-up to CVE-2022-30635.
Additional Info: 

N/A

Download: 

SRPMS
  1. skopeo-1.14.5-2.el9_4.src.rpm
    MD5: 54a4cc664b9fc6ea98094b2e97533a77
    SHA-256: b84bc2a5477105c1290922d46ac12dced7f8ab888a8f9b485464d18d8e51f3cf
    Size: 9.98 MB

Asianux Server 9 for x86_64
  1. skopeo-1.14.5-2.el9_4.x86_64.rpm
    MD5: 947584a32d8a30236c37596a301355e9
    SHA-256: be49cc514f0c33b75915ab6ed9efb801f3fa5e43468c69d5b4d6791bbe1e9235
    Size: 8.54 MB
  2. skopeo-tests-1.14.5-2.el9_4.x86_64.rpm
    MD5: a265c62c0b2281668148ccda628b3ad5
    SHA-256: ccb58f9aaafbb680bde586cf05f99700ef6656f922ca30f290cc1cc9019483f6
    Size: 764.74 kB