Refresh RPM lockfiles [SECURITY] - #14958
Conversation
|
Hi @red-hat-konflux-kflux-prd-rh02[bot]. Thanks for your PR. I'm waiting for a ComplianceAsCode member to verify that this patch is reasonable to test. If it is, they should reply with Regular contributors should join the org to skip this step. Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
82e7bdb to
648b2a7
Compare
648b2a7 to
5190538
Compare
|
@red-hat-konflux-kflux-prd-rh02[bot]: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
Signed-off-by: red-hat-konflux-kflux-prd-rh02 <190377777+red-hat-konflux-kflux-prd-rh02[bot]@users.noreply.github.com>
5190538 to
11fc5ae
Compare
We can add them to the ignore list https://yamllint.readthedocs.io/en/stable/configuration.html#ignoring-paths. |
2 participants
This PR contains the following updates:
File Dockerfiles/konflux/rpms.in.yaml:
3.26.5-2.el9->3.31.8-3.el93.26.5-2.el9->3.31.8-3.el93.26.5-2.el9->3.31.8-3.el91:27.2-14.el9_6.2->1:27.2-18.el91.1.34-13.el9_6->1.1.34-14.el9_8.11:1.3.12-1.el9_6->1:1.3.14-1.el9_81:1.3.12-1.el9_6->1:1.3.14-1.el9_83.9.21-2.el9_6.1->3.9.25-7.el9_8.22.3.1-4.el9->2.4.0-1.el9_82.9.6-27.el9->2.9.6-28.el92.9.6-27.el9->2.9.6-28.el92.5.0-5.el9_6->2.5.0-6.el9_8.128-10.el9->28-11.el90.4.1-4.el9->0.4.1-7.el9_82.37.4-21.el9->2.37.4-25.el91:3.2.2-6.el9_5.1->1:3.5.5-6.el9_81.5.1-25.el9_6->1.5.1-28.el93.9.21-2.el9_6.1->3.9.25-7.el9_8.23.9.21-2.el9_6.1->3.9.25-7.el9_8.221.3.1-1.el9->21.3.1-2.el9_853.0.0-13.el9_6.1->53.0.0-15.el953.0.0-13.el9_6.1->53.0.0-15.el9252-51.el9_6.1->252-67.el9_8.4252-51.el9_6.1->252-67.el9_8.4252-51.el9_6.1->252-67.el9_8.42.37.4-21.el9->2.37.4-25.el92.37.4-21.el9->2.37.4-25.el92:8.2.2637-22.el9_6->2:8.2.2637-26.el9_8.132.0.6-1.el9->2.0.6-3.el9libxslt: use-after-free with key data stored cross-RVT
CVE-2025-10911
More information
Details
A use-after-free vulnerability was found in libxslt while parsing xsl nodes that may lead to the dereference of expired pointers and application crash.
Severity
Moderate
References
python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations
CVE-2026-15308
More information
Details
A flaw was found in Python. Its incremental HTML parser can be exploited by a remote attacker. By sending specially crafted, uncontrolled data with repeated, incomplete markup declarations, the attacker can cause the system to consume excessive central processing unit (CPU) resources. This leads to a denial of service, making the affected system unresponsive.
Severity
Important
References
python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API
CVE-2026-4786
More information
Details
A flaw was found in the Python webbrowser.open() API. If a specially crafted URL containing "%action" is processed, an attacker could bypass a previous mitigation for CVE-2026-4519. This bypass allows for command injection into the underlying shell, potentially leading to arbitrary code execution.
Severity
Important
References
python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules
CVE-2026-6100
More information
Details
A flaw was found in Python's decompression modules, including
lzma.LZMADecompressor,bz2.BZ2Decompressor, andgzip.GzipFile. This vulnerability, a use-after-free, can occur if a program attempts to re-use a decompression object after a memory allocation error, especially when the system is experiencing high memory usage. Exploitation of this flaw could potentially allow an attacker to execute arbitrary code or access sensitive data. The vulnerability is only present if the program re-uses decompressor instances across multiple decompression calls even after aMemoryErroris raised during decompression. Using the helper functions to one-shot decompress data such aslzma.decompress(),bz2.decompress(),gzip.decompress(), andzlib.decompress()are not affected as a new decompressor instance is used per call. If the decompressor instance is not re-used after an error condition, this usage is similarly not vulnerable.Severity
Important
References
python: Python: Command-line option injection in webbrowser.open() via crafted URLs
CVE-2026-4519
More information
Details
A flaw was found in Python. The
webbrowser.open()API, used to launch web browsers, does not properly sanitize input. This allows a remote attacker to craft a malicious URL containing leading dashes. When such a URL is opened, certain web browsers may interpret these dashes as command-line options, which could lead to unexpected behavior, information disclosure, or potentially arbitrary code execution, impacting the integrity of the system.Severity
Important
References
cpython: wsgiref.headers.Headers allows header newline injection in Python
CVE-2026-0865
More information
Details
Missing newline filtering has been discovered in Python. User-controlled header names and values containing newlines can allow injecting HTTP headers.
Severity
Moderate
References
acl: Symlink traversal privilege escalation via libacl functions
CVE-2026-54369
More information
Details
A flaw was found in the
aclpackage, specifically within itslibaclpathname-based functions. A local attacker could exploit this vulnerability by using a symbolic link to replace a pathname component. This could allow the attacker to redirect access control list (ACL) read or write operations to arbitrary files or directories, leading to unauthorized manipulation of ACLs and ultimately local privilege escalation.Severity
Important
References
acl: TOCTOU Symlink Traversal via getfacl/setfacl
CVE-2026-54370
More information
Details
A time-of-check to time-of-use (TOCTOU) race condition vulnerability was found in
acl. By replacing a pathname component with a symbolic link between a security check and subsequent file operations, an attacker can redirect file access control list operations. This occurs when privileged processes invokegetfaclorsetfaclover an attacker-controlled path, potentially leading to local privilege escalation.Severity
Important
References
libexpat: denial of service via crafted XML input
CVE-2026-45186
More information
Details
A flaw was found in libexpat. When processing a specially crafted XML input containing a specific pattern of attributes, the parsing time increases quadratically due to checks for attribute name collisions. This consumes excessive CPU resources and eventually results in a denial of service.
Severity
Important
References
systemd: systemd: Arbitrary code execution or Denial of Service via spurious IPC API call data
CVE-2026-29111
More information
Details
A flaw was found in systemd, a system and service manager. An unprivileged user can exploit this vulnerability by making an Inter-Process Communication (IPC) API call with spurious data. In older versions (v249 and earlier), this can lead to stack overwriting with attacker-controlled content, potentially enabling arbitrary code execution or privilege escalation. In newer versions (v250 and later), the flaw causes systemd to assert and freeze, resulting in a Denial of Service (DoS).
Severity
Moderate
References
🔧 This Pull Request updates lock files to use the latest dependency versions.
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
To execute skipped test pipelines write comment
/ok-to-test.Documentation
Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.