Red Hat Security AdvisoryRHSA-2026:36199
buildah security update
Released 2026-07-07 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 10) buildah-2:1.43.1-3.el10_2, buildah-tests-2:1.43.1-3.el10_2
Fixes 4 records
Priority MEDIUM 48
When adding a key to a remote agent constraint extensions such as [email protected] were not serialized in the request.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00683 · Published 2026-05-22 · Partial fix · 0.52.0 CWE-502
Priority MEDIUM 46
A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection's read loop.
CVSS 3.1CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.00683 · Published 2026-05-22 · Partial fix · 0.52.0 CWE-119
Priority LOW 39
The RSA and DSA public key parsers did not enforce size limits on key parameters.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00467 · Published 2026-05-22 · Partial fix · 0.52.0 CWE-347
Priority LOW 25
SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00504 · Published 2026-05-22 · Partial fix · 0.52.0 CWE-295
THREATIST.IORead the docs