Critical Denial of Service Vulnerabilities in Image-Builder Package
Summary
RLSA-2026:65534: Important: image-builder security update. Affects image-builder versions < 0:52.1-1.el10_2.2.rocky.0.1. Fixed in 0:52.1-1.el10_2.2.rocky.0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The image-builder package is a local binary designed for creating customized operating system artifacts, such as virtual machine images and OSTree commits. It leverages the osbuild tool under the hood to facilitate these operations. This package is crucial for developers and system administrators who need to automate the deployment of OS images in various environments. However, it has been found to contain multiple security vulnerabilities that could lead to denial of service attacks, impacting the availability of services relying on this package.
Vulnerability Detail
The vulnerabilities identified in the image-builder package stem from various components of the Go programming language, particularly in its crypto, net, and html/template packages. These vulnerabilities include denial of service attacks due to inefficient certificate chain validation, incorrect DNS constraint application, and pathological email address parsing. The ramifications of these vulnerabilities can lead to service disruptions, allowing attackers to exploit the package's weaknesses to render services unavailable. The vulnerabilities have been assigned a CVSS score of 8.8, indicating a high severity level.
How To Fix
Minimum fixed version
0:52.1-1.el10_2.2.rocky.0.1
This is the first release that contains the fix.
sudo dnf update image-builderTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider implementing input validation and sanitization in applications that utilize the image-builder package to mitigate potential exploitation of the vulnerabilities until a proper update can be applied.
Conclusion
The image-builder package has been found to contain critical vulnerabilities that could lead to denial of service attacks. It is imperative for users to update to the latest patched version to mitigate these risks. Additionally, implementing workarounds can provide temporary relief until the update is applied. Regular monitoring for vulnerabilities using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for image-builder →
FAQ
The image-builder package is a tool used for creating customized OS artifacts, such as VM images and OSTree commits, primarily for automation in deployment processes.
The vulnerabilities include denial of service attacks due to inefficient processing in various components of the Go programming language, affecting certificate validation, email parsing, and more.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By utilizing the Vulert playground, you can check if your application is affected without needing to sign up.
Implement input validation and sanitization in your applications to reduce the risk of exploitation until you can apply the necessary updates.
The vulnerabilities have a CVSS score of 8.8, indicating a high severity level that requires prompt attention.
References
Related vulnerabilities
Recent vulnerabilities recorded for image-builder.
