chore(deps): update registry.redhat.io/openshift4/ose-tools-rhel8 docker digest to 5ad1360 [security] #554
Conversation
![red-hat-konflux-kflux-prd-rh02[bot]](https://avatars.githubusercontent.com/u/89927105?s=60&v=4){kind=small}
…ker digest to 5ad1360 [security] Signed-off-by: red-hat-konflux-kflux-prd-rh02 <190377777+red-hat-konflux-kflux-prd-rh02[bot]@users.noreply.github.com>
|
[APPROVALNOTIFIER] This PR is NOT APPROVED This pull-request has been approved by: red-hat-konflux-kflux-prd-rh02[bot] The full list of commands accepted by this bot can be found here.
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
Hi @red-hat-konflux-kflux-prd-rh02[bot]. Thanks for your PR. I'm waiting for a openshift-pipelines member to verify that this patch is reasonable to test. If it is, they should reply with Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
This PR contains the following updates:
898540b->5ad1360podman: buildah: Container breakout by using --jobs=2 and a race condition when building a malicious Containerfile
CVE-2024-11218
More information
Details
A vulnerability was found in
podman buildandbuildah.This issue occurs in a container breakout by using --jobs=2 and a race condition when building a malicious Containerfile. SELinux might mitigate it, but even with SELinux on, it still allows the enumeration of files and directories on the host.Severity
Important
References
libxml: use-after-free in xmlXIncludeAddNode
CVE-2022-49043
More information
Details
A flaw was found in libxml2 where improper handling of memory allocation failures in
libxml2can lead to crashes, memory leaks, or inconsistent states. While an attacker cannot directly control allocation failures, they may trigger denial-of-service conditions under extreme system stress.Severity
Important
References
libxslt: Use-After-Free in libxslt numbers.c
CVE-2025-24855
More information
Details
A flaw was found in libxslt numbers.c. This vulnerability allows a use-after-free, potentially leading to memory corruption or code execution via nested XPath evaluations where an XPath context node can be modified but not restored.
Severity
Important
References
libxml2: Stack-based buffer overflow in xmlSnprintfElements of libxml2
CVE-2025-24928
More information
Details
A flaw was found in libxml2. This vulnerability allows a stack-based buffer overflow via DTD validation of an untrusted document or untrusted DTD.
Severity
Important
References
freetype: OOB write when attempting to parse font subglyph structures related to TrueType GX and variable font files
CVE-2025-27363
More information
Details
A flaw was found in FreeType. In affected versions, an out-of-bounds write condition may be triggered when attempting to parse font subglyph structures related to TrueType GX and variable font files. The vulnerable code assigns a signed short value to an unsigned long and then adds a static value, causing it to wrap around and allocate a heap buffer that is too small. The code then writes up to 6 signed long integers out of bounds relative to this buffer. This issue could result in arbitrary code execution or other undefined behavior.
Severity
Important
References
golang.org/x/net/html: Non-linear parsing of case-insensitive content in golang.org/x/net/html
CVE-2024-45338
More information
Details
A flaw was found in golang.org/x/net/html. This flaw allows an attacker to craft input to the parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This issue can cause a denial of service.
Severity
Important
References
golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing
CVE-2025-30204
More information
Details
A flaw was found in the golang-jwt implementation of JSON Web Tokens (JWT). In affected versions, a malicious request with specially crafted Authorization header data may trigger an excessive consumption of resources on the host system. This issue can cause significant performance degradation or an application crash, leading to a denial of service.
Severity
Important
References
libxml2: Use-After-Free in libxml2
CVE-2024-56171
More information
Details
A flaw was found in libxml2. This vulnerability allows a use-after-free via a crafted XML document validated against an XML schema with certain identity constraints or a crafted XML schema.
Severity
Important
References
golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh
CVE-2025-22869
More information
Details
A flaw was found in the golang.org/x/crypto/ssh package. SSH clients and servers are vulnerable to increased resource consumption, possibly leading to memory exhaustion and a DoS. This can occur during key exchange when the other party is slow to respond during key exchange.
Severity
Important
References
libxslt: Use-After-Free in libxslt (xsltGetInheritedNsList)
CVE-2024-55549
More information
Details
A flaw was found in libxslt. This vulnerability allows an attacker to trigger a use-after-free issue by excluding result prefixes.
Severity
Important
References
golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2/jws
CVE-2025-22868
More information
Details
A flaw was found in the
golang.org/x/oauth2/jwspackage in the token parsing component. This vulnerability is made possible because of the use ofstrings.Split(token, ".")to split JWT tokens, which can lead to excessive memory consumption when processing maliciously crafted tokens with a large number of.characters. An attacker could exploit this functionality by sending numerous malformed tokens and can trigger memory exhaustion and a Denial of Service.Severity
Important
References
grub2: net: Out-of-bounds write in grub_net_search_config_file()
CVE-2025-0624
More information
Details
A flaw was found in grub2. During the network boot process, when trying to search for the configuration file, grub copies data from a user controlled environment variable into an internal buffer using the grub_strcpy() function. During this step, it fails to consider the environment variable length when allocating the internal buffer, resulting in an out-of-bounds write. If correctly exploited, this issue may result in remote code execution through the same network segment grub is searching for the boot information, which can be used to by-pass secure boot protections.
Severity
Important
References
kernel: HID: core: zero-initialize the report buffer
CVE-2024-50302
More information
Details
A vulnerability was found in the Linux kernel's driver for Human Interface Devices. This flaw allows an attacker to use a malicious input device to read information from the report buffer. This could be used to leak kernel memory, enabling the exploitation of additional vulnerabilities.
Severity
Important
References
kernel: media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format
CVE-2024-53104
More information
Details
A vulnerability was found in the Linux kernel's USB Video Class driver. A buffer for video frame data is allocated, which does not account for all of the frame formats contained in a video stream, leading to an out-of-bounds write when a stream includes frames with an undefined format. An attacker who is able to influence the format of video streams captured by a system's USB video device could exploit this flaw to alter system memory and potentially escalate their privileges or execute arbitrary code.
Severity
Important
References
baremetal-operator/apis: Bare Metal Operator (BMO) can expose any secret from other namespaces via BMCEventSubscription CRD
CVE-2025-29781
More information
Details
A flaw was found in the Bare Metal Operator (BMO) Kubernetes API component. BMO enables users to load Secrets from arbitrary namespaces upon deployment of the namespace-scoped Custom Resource
BMCEventSubscription. In affected versions, an adversary using a Kubernetes account with only namespace level roles (e.g. a tenant controlling a namespace) may create aBMCEventSubscriptionin their authorized namespace and then load Secrets from their unauthorized namespaces to another authorized namespace via the Baremetal Operator, which can lead to the exposure of secrets and credential information.Severity
Important
References
kernel: ALSA: usb-audio: Fix out of bounds reads when finding clock sources
CVE-2024-53150
More information
Details
A vulnerability was found in the Linux kernel's USB Audio driver. This flaw can allow an attacker with physical access to the system to use a malicious USB device to gain additional access. This is possible by reading arbitrary system memory.
Severity
Important
References
kernel: ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices
CVE-2024-53197
More information
Details
A vulnerability was found in the Linux kernel's USB Audio driver. This flaw allows an attacker with physical access to the system to use a malicious USB device to gain additional access. This is possible by manipulating system memory, potentially escalating privileges, or executing arbitrary code.
Severity
Important
References
bind: bind9: Many records in the additional section cause CPU exhaustion
CVE-2024-11187
More information
Details
A flaw was found in the bind package where a crafted DNS zone may generate numerous records in the 'Additional' section of the response. This flaw allows an attacker to send a large amount of such queries, which may lead either the authoritative server or an independent resolver to run into an uncontrolled CPU resource scenario, ultimately resulting in the server not being able to attend new requests and causing a denial of service as a consequence.
Severity
Important
References
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
To execute skipped test pipelines write comment
/ok-to-test.This PR has been generated by MintMaker (powered by Renovate Bot).