1. Home
  2. Security Advisories
  3. Rocky Linux
  4. RLSA-2024:2549

[RLSA-2024:2549] skopeo security and bug fix update

Severity Moderate
Affected Packages 4
CVEs 2
Info Packages References Vulnerabilities

An update is available for skopeo. This update affects Rocky Linux 9. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list

The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files.

Security Fix(es):

  • golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON (CVE-2024-24786)

Bug Fix(es):

  • TRIAGE CVE-2024-24786 skopeo: golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON [rhel-9] - Rocky Linux 9.4 0day (JIRA:Rocky Linux-28235)

  • skopeo: jose-go: improper handling of highly compressed data rhel-9

Package Affected Version
pkg:rpm/rockylinux/skopeo?arch=x86_64&distro=rockylinux-9.4 < 1.14.3-2.el9_4
pkg:rpm/rockylinux/skopeo?arch=aarch64&distro=rockylinux-9.4 < 1.14.3-2.el9_4
pkg:rpm/rockylinux/skopeo-tests?arch=x86_64&distro=rockylinux-9.4 < 1.14.3-2.el9_4
pkg:rpm/rockylinux/skopeo-tests?arch=aarch64&distro=rockylinux-9.4 < 1.14.3-2.el9_4
ID
RLSA-2024:2549
Severity
moderate
URL
https://errata.rockylinux.org/RLSA-2024:2549
Published
2024-05-10T14:32:42
(4 months ago)
Modified
2024-05-10T14:34:29
(4 months ago)
Rights
Copyright 2024 Rocky Enterprise Software Foundation
Other Advisories
Type Package URL Namespace Name / Product Version Distribution / Platform Arch Patch / Fix
Affected pkg:rpm/rockylinux/skopeo?arch=x86_64&distro=rockylinux-9.4 rockylinux skopeo < 1.14.3-2.el9_4 rockylinux-9.4 x86_64
Affected pkg:rpm/rockylinux/skopeo?arch=aarch64&distro=rockylinux-9.4 rockylinux skopeo < 1.14.3-2.el9_4 rockylinux-9.4 aarch64
Affected pkg:rpm/rockylinux/skopeo-tests?arch=x86_64&distro=rockylinux-9.4 rockylinux skopeo-tests < 1.14.3-2.el9_4 rockylinux-9.4 x86_64
Affected pkg:rpm/rockylinux/skopeo-tests?arch=aarch64&distro=rockylinux-9.4 rockylinux skopeo-tests < 1.14.3-2.el9_4 rockylinux-9.4 aarch64
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories Exploits PoC Pubblication Date Modification Date
# CVE Description CVSS EPSS EPSS Trend (30 days) Affected Products Weaknesses Security Advisories PoC Pubblication Date Modification Date