Critical Security Update for osbuild-composer: Addressing Multiple Vulnerabilities
Summary
ALSA-2026:66016: Important: osbuild-composer security update. Affects osbuild-composer versions < 101.5-2.el8_10.alma.1. Fixed in 101.5-2.el8_10.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
osbuild-composer is a service designed for building customized operating system artifacts, such as virtual machine images and OSTree commits. It leverages osbuild for its operations and supports direct uploads of images to cloud environments. The service is compatible with composer-cli and cockpit-composer clients, making it a versatile tool for developers and system administrators. However, recent vulnerabilities have been identified that could compromise the security and functionality of the service.
Vulnerability Detail
The vulnerabilities in osbuild-composer stem from various components of the Go programming language and its libraries. These include issues such as Denial of Service (DoS) attacks via crafted email inputs, privilege escalation through incorrect Punycode label processing, and cross-site scripting vulnerabilities. The vulnerabilities can lead to significant security risks, including unauthorized access, service disruptions, and potential data breaches.
How To Fix
Minimum fixed version
101.5-2.el8_10.alma.1
This is the first release that contains the fix.
sudo dnf update osbuild-composerTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can restrict access to the osbuild-composer service to trusted networks only. Additionally, consider implementing web application firewalls to filter out malicious traffic until the update can be applied.
Conclusion
The identified vulnerabilities in osbuild-composer pose significant risks to users and systems. It is crucial to apply the recommended updates promptly to ensure the security and integrity of your applications. By following the outlined steps and utilizing available resources like Vulert, you can effectively manage and mitigate these vulnerabilities.
See every vulnerability recorded for osbuild-composer →
FAQ
osbuild-composer is a service that builds customized OS artifacts, such as VM images and OSTree commits, using osbuild.
The vulnerabilities include Denial of Service attacks, privilege escalation, and cross-site scripting issues associated with various Go libraries.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by these vulnerabilities without needing to sign up.
If immediate updates are not possible, implement access restrictions and use web application firewalls as a temporary workaround.
Detailed information about the vulnerabilities can be found on the CVE pages listed in the related section of the advisory.
Related vulnerabilities
Recent vulnerabilities recorded for osbuild-composer.
