Critical Security Update for osbuild-composer: Addressing Multiple Denial of Service Vulnerabilities
Summary
ALSA-2026:65153: Important: osbuild-composer security update. Affects osbuild-composer versions < 165.1-4.el9_8.1.alma.1. Fixed in 165.1-4.el9_8.1.alma.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
osbuild-composer is a service designed for building customized operating system artifacts, such as virtual machine images and OSTree commits. It utilizes osbuild to facilitate the creation of these images, which can be used locally or uploaded directly to cloud environments. The service is compatible with composer-cli and cockpit-composer clients, making it a versatile tool for developers and system administrators. However, recent vulnerabilities have been identified that could potentially compromise the security and stability of systems using this package.
Vulnerability Detail
The vulnerabilities in osbuild-composer stem from various components within the Go programming language libraries it utilizes. These include Denial of Service (DoS) vulnerabilities caused by pathological email address parsing, crafted email inputs, and excessive recursion in XML decoding. Additionally, issues related to privilege escalation and Cross-Site Scripting (XSS) have been identified. If exploited, these vulnerabilities could lead to service outages, unauthorized access, and potential data breaches, making it critical for users to address them promptly.
How To Fix
Minimum fixed version
165.1-4.el9_8.1.alma.1
This is the first release that contains the fix.
sudo dnf update osbuild-composerTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can limit the exposure of their systems by restricting access to the osbuild-composer service and monitoring for unusual activity. However, the most effective solution is to apply the available updates as soon as possible.
Conclusion
The recent vulnerabilities in osbuild-composer pose significant risks to users, including potential Denial of Service and unauthorized access. It is crucial for users to update to the latest patched version to mitigate these risks and ensure the security of their systems. Regular monitoring and utilizing tools like Vulert can help maintain awareness of vulnerabilities in open-source software.
See every vulnerability recorded for osbuild-composer →
FAQ
osbuild-composer is a service that builds customized OS artifacts, such as VM images and OSTree commits, using osbuild.
The vulnerabilities include Denial of Service, privilege escalation, and Cross-Site Scripting issues.
You can use Vulert's playground at Vulert Scanner to check for vulnerabilities without needing to sign up.
If immediate updates are not possible, consider restricting access to the service and monitoring for any unusual activity as a temporary workaround.
Detailed information about the vulnerabilities can be found on the CVE pages linked in the advisory.
Related vulnerabilities
Recent vulnerabilities recorded for osbuild-composer.
