Low: Image Builder security, bug fix, and enhancement update - Vulnerability in weldr-client
Summary
ALSA-2022:7950: Low: Image Builder security, bug fix, and enhancement update. Affects weldr-client versions < 35.5-4.el9. Fixed in 35.5-4.el9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The weldr-client package is a component of AlmaLinux 9 that provides the Image Builder service. This service is responsible for building customized OS artifacts, such as VM images and OSTree commits, using the osbuild tool. It is an essential part of the operating system's infrastructure for creating tailored OS artifacts.
Vulnerability Detail
The vulnerability identified in weldr-client (AlmaLinux 9) is related to the golang math/big package. Specifically, the decoding of big.Float and big.Rat types can lead to a panic if the encoded message is too short. This vulnerability, tracked as CVE-2022-32189, could potentially be exploited to cause a denial of service. The impact of this vulnerability is considered low. For more detailed information about the vulnerability, including the CVSS score and acknowledgments, please refer to the CVE page linked in the References section.
How To Fix
Minimum fixed version
35.5-4.el9
This is the first release that contains the fix.
sudo dnf update weldr-clientTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
In conclusion, the weldr-client package in AlmaLinux 9 is affected by a low-severity vulnerability related to the golang math/big package. To mitigate this vulnerability, it is crucial to update the weldr-client package to version 35.5-4.el9 or later. This update includes the necessary security fixes, bug fixes, and enhancements. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for weldr-client →
FAQ
weldr-client is a package in AlmaLinux 9 that provides the Image Builder service, allowing the creation of customized OS artifacts.
The impact of this vulnerability is considered low. It could potentially lead to a denial of service if exploited.
To fix this vulnerability, update the weldr-client package to version 35.5-4.el9 or later from the official AlmaLinux repositories.
No specific workarounds have been mentioned for this vulnerability. It is recommended to apply the official fix by updating the package.
For more detailed information about this vulnerability, including the CVSS score and acknowledgments, refer to the CVE page linked in the References section.
Related vulnerabilities
Recent vulnerabilities recorded for weldr-client.
