ELSA-2025-9623

Опубликовано: 01 июл. 2025

Источник: oracle-oval

Платформа: Oracle Linux 10

Описание

ELSA-2025-9623: osbuild-composer security update (MODERATE)

[134.1-2.0.1]

Add OL10 support
Update repository URLs for baseos, appstream and UERK
Fix the label for UEKR repository
Simplify repository names [JIRA: OLDIS-35893]
Ensure build on latest golang: CVE-2024-34156
Refactor patches to fix some naming and set a correct kernel for Oracle Linux [Orabug: 37253643]
Support using OCI variables inside built images [JIRA: OLDIS-35302]
Support using repository definitons with OCI variables [JIRA: OLDIS-38657]
Update repositories to contain OCI variables
Remove image types Minimal-raw and wsl [JIRA: OLDIS-38123]
Increase default /boot size to 1GB [Orabug: 36827079]
Add support for OCI hybrid images [JIRA: OLDIS-33593]
enable aarch64 OCI image builds [JIRA: OLDIS-33593]
support for building OL8/9 images on Oracle Linux 9 [Orabug: 36400619]

[134.1-2]

Rebuild for CVE-2025-22871

[134.1-1]

Import upstream 134.1

Обновленные пакеты

Oracle Linux 10

Oracle Linux aarch64

osbuild-composer

134.1-2.0.1.el10_0

osbuild-composer-core

134.1-2.0.1.el10_0

osbuild-composer-worker

134.1-2.0.1.el10_0

Oracle Linux x86_64

osbuild-composer

134.1-2.0.1.el10_0

osbuild-composer-core

134.1-2.0.1.el10_0

osbuild-composer-worker

134.1-2.0.1.el10_0

Связанные CVE

CVE-2025-22871

Ссылки на источники

Связанные уязвимости

CVE-2025-22871

CVSS3: 9.1

ubuntu

4 месяца назад

The net/http package improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext.