1. Home
  2. Security Advisories
  3. Rocky Linux
  4. RLSA-2022:7950

[RLSA-2022:7950] Image Builder security, bug fix, and enhancement update

Severity Low
Affected Packages 9
CVEs 1
Info Packages References Vulnerabilities

An update is available for cockpit-composer, weldr-client. This update affects Rocky Linux 9. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list

Image Builder is a service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood.

Security Fix(es):

  • golang: math/big: decoding big.Float and big.Rat types can panic if the encoded message is too short, potentially allowing a denial of service (CVE-2022-32189)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 9.1 Release Notes linked from the References section.

Package Affected Version
pkg:rpm/rockylinux/weldr-client?arch=x86_64&distro=rockylinux-9 < 35.5-4.el9
pkg:rpm/rockylinux/weldr-client?arch=aarch64&distro=rockylinux-9 < 35.5-4.el9
pkg:rpm/rockylinux/python3-osbuild?arch=noarch&distro=rockylinux-9 < 65-1.el9.rocky.0.1
pkg:rpm/rockylinux/osbuild?arch=noarch&distro=rockylinux-9 < 65-1.el9.rocky.0.1
pkg:rpm/rockylinux/osbuild-selinux?arch=noarch&distro=rockylinux-9 < 65-1.el9.rocky.0.1
pkg:rpm/rockylinux/osbuild-ostree?arch=noarch&distro=rockylinux-9 < 65-1.el9.rocky.0.1
pkg:rpm/rockylinux/osbuild-lvm2?arch=noarch&distro=rockylinux-9 < 65-1.el9.rocky.0.1
pkg:rpm/rockylinux/osbuild-luks2?arch=noarch&distro=rockylinux-9 < 65-1.el9.rocky.0.1
pkg:rpm/rockylinux/cockpit-composer?arch=noarch&distro=rockylinux-9 < 41-1.el9
ID
RLSA-2022:7950
Severity
low
URL
https://errata.rockylinux.org/RLSA-2022:7950
Published
2022-11-15T06:11:56
(22 months ago)
Modified
2023-02-02T14:07:22
(19 months ago)
Rights
Copyright 2023 Rocky Enterprise Software Foundation
Other Advisories
Type Package URL Namespace Name / Product Version Distribution / Platform Arch Patch / Fix
Affected pkg:rpm/rockylinux/weldr-client?arch=x86_64&distro=rockylinux-9 rockylinux weldr-client < 35.5-4.el9 rockylinux-9 x86_64
Affected pkg:rpm/rockylinux/weldr-client?arch=aarch64&distro=rockylinux-9 rockylinux weldr-client < 35.5-4.el9 rockylinux-9 aarch64
Affected pkg:rpm/rockylinux/python3-osbuild?arch=noarch&distro=rockylinux-9 rockylinux python3-osbuild < 65-1.el9.rocky.0.1 rockylinux-9 noarch
Affected pkg:rpm/rockylinux/osbuild?arch=noarch&distro=rockylinux-9 rockylinux osbuild < 65-1.el9.rocky.0.1 rockylinux-9 noarch
Affected pkg:rpm/rockylinux/osbuild-selinux?arch=noarch&distro=rockylinux-9 rockylinux osbuild-selinux < 65-1.el9.rocky.0.1 rockylinux-9 noarch
Affected pkg:rpm/rockylinux/osbuild-ostree?arch=noarch&distro=rockylinux-9 rockylinux osbuild-ostree < 65-1.el9.rocky.0.1 rockylinux-9 noarch
Affected pkg:rpm/rockylinux/osbuild-lvm2?arch=noarch&distro=rockylinux-9 rockylinux osbuild-lvm2 < 65-1.el9.rocky.0.1 rockylinux-9 noarch
Affected pkg:rpm/rockylinux/osbuild-luks2?arch=noarch&distro=rockylinux-9 rockylinux osbuild-luks2 < 65-1.el9.rocky.0.1 rockylinux-9 noarch
Affected pkg:rpm/rockylinux/cockpit-composer?arch=noarch&distro=rockylinux-9 rockylinux cockpit-composer < 41-1.el9 rockylinux-9 noarch
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories Exploits PoC Pubblication Date Modification Date
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories PoC Pubblication Date Modification Date