ALSA-2022:7955

Source
https://errata.almalinux.org/9/ALSA-2022-7955.html
Import Source
https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux9/ALSA-2022:7955.json
JSON Data
https://api.osv.dev/v1/vulns/ALSA-2022:7955
Related
Published
2022-11-15T00:00:00Z
Modified
2022-11-18T05:44:13Z
Summary
Moderate: skopeo security and bug fix update
Details

The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files.

Security Fix(es):

  • containers/storage: DoS via malicious image (CVE-2021-20291)
  • golang: math/big.Rat: may cause a panic or an unrecoverable fatal error if passed inputs with very large exponents (CVE-2021-33198)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

References

Affected packages

AlmaLinux:9 / skopeo

Package

Name
skopeo

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2:1.9.2-1.el9

AlmaLinux:9 / skopeo-tests

Package

Name
skopeo-tests

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2:1.9.2-1.el9