Open Source Vulnerability in custodia package
Summary
ALBA-2019:4268: idm:DL1 bug fix update. Affects custodia across 2 version ranges.
< 0.6.0-3.module_el8.5.0+2603+92118e57
< 0.6.0-3.module_el8.6.0+2881+2f24dc92
Fixed in 0.6.0-3.module_el8.5.0+2603+92118e57 or 0.6.0-3.module_el8.6.0+2881+2f24dc92, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The custodia package is a component of the AlmaLinux:8 ecosystem. It provides functionality for managing secrets and encryption keys. The package is vulnerable to a bug that causes IPA upgrades to fail when the latest ipa package is installed with adtrust. This vulnerability can impact the stability and functionality of the IPA upgrade process.
Vulnerability Detail
The vulnerability arises from a bug in the custodia package. When adtrust is installed along with the latest ipa package, IPA upgrades fail. This can lead to issues with the overall system stability and functionality. The bug has been identified and documented in the AlmaLinux vulnerability database.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
sudo dnf update custodia-
< 0.6.0-3.module_el8.5.0+2603+92118e570.6.0-3.module_el8.5.0+2603+92118e57 -
< 0.6.0-3.module_el8.6.0+2881+2f24dc920.6.0-3.module_el8.6.0+2881+2f24dc92
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The custodia package in the AlmaLinux:8 ecosystem is vulnerable to a bug that causes IPA upgrades to fail when adtrust is installed. To mitigate this vulnerability, it is recommended to update the custodia package to version 0.6.0-3.module_el8.6.0+2881+2f24dc92 or higher. For further support and assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for custodia →
FAQ
The vulnerability can cause IPA upgrades to fail when adtrust is installed, leading to potential stability and functionality issues.
You can use the Vulert Playground at Vulert Scanner to check if your system is affected by this vulnerability. Simply upload your package-lock.json file and the playground will provide real-time alerts for open-source vulnerabilities.
There are no known exploits for this vulnerability at the moment. However, it is important to apply the recommended fix to ensure system security and stability.
No, the recommended fix for this vulnerability is to update the custodia package to the specified version or higher. Manual fixes may not address the underlying issue and could lead to further complications.
You can find more information about this vulnerability in the AlmaLinux vulnerability database. The specific advisory can be accessed at the following link: https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALBA-2019:4268.json
Related vulnerabilities
Recent vulnerabilities recorded for custodia.
