Critical Security Update for osbuild and osbuild-composer: Addressing Multiple Vulnerabilities
Summary
ALSA-2025:7118: Important: osbuild and osbuild-composer security update. Affects osbuild versions < 141-1.el9.alma.1. Fixed in 141-1.el9.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
osbuild and osbuild-composer are essential tools for building customized OS artifacts, such as virtual machine images and OSTree commits. They facilitate the creation of images for local use and allow direct uploads to cloud environments. These packages are compatible with composer-cli and cockpit-composer clients, making them integral to modern software deployment and management workflows.
Vulnerability Detail
The identified vulnerabilities in osbuild and osbuild-composer stem from issues in the underlying Golang libraries. Notably, memory leaks in the RSA payload encryption and decryption process (CVE-2024-1394) can lead to resource exhaustion. Additionally, a stack exhaustion panic can occur when parsing deeply nested build tag expressions (CVE-2024-34158). The Golang FIPS implementation also has a vulnerability related to zeroed buffers (CVE-2024-9355), which could potentially expose sensitive data.
How To Fix
Minimum fixed version
141-1.el9.alma.1
This is the first release that contains the fix.
sudo dnf update osbuildTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updates cannot be applied, consider limiting the usage of the affected packages or isolating them in a controlled environment until the patches are applied. Regularly monitor for updates and apply them as soon as they are available.
Conclusion
The security vulnerabilities in osbuild and osbuild-composer pose significant risks that can affect the integrity and security of systems using these tools. It is essential to apply the recommended updates promptly to mitigate these risks and ensure the continued safe operation of your software environment.
See every vulnerability recorded for osbuild →
FAQ
They are tools used for building customized OS artifacts, enabling the creation of VM images and other deployment formats.
Memory leaks, stack exhaustion, and zeroed buffer issues in the Golang libraries used by osbuild and osbuild-composer.
You can use the Vulert playground at Vulert Scanner to check for vulnerabilities without needing to sign up.
Consider limiting the usage of the affected packages and monitor for updates until you can apply the patches.
Detailed information can be found on the CVE pages linked in the advisory and through the AlmaLinux release notes.
Related vulnerabilities
Recent vulnerabilities recorded for osbuild.
