{ "document": { "aggregate_severity": { "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" }, { "category": "details", "text": "CVE-2024-6104: backport go-retryablehttp URL redaction so basic-auth\n credentials embedded in request URLs are not written to logs/errors\n- CVE-2024-28180: backport go-jose decompression-bomb fix to both\n vendored major versions (github.com/go-jose/go-jose/v3 and\n gopkg.in/square/go-jose.v2)", "title": "Details" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "https://cve.tuxcare.com/els/releases/CLSA-2026:1778239845", "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1778239845" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_os/almalinux9.2esu/advisories/2026/clsa-2026_1778239845.json" } ], "tracking": { "current_release_date": "2026-05-08T11:31:33Z", "generator": { "date": "2026-05-08T11:31:33Z", "engine": { "name": "pyCSAF" } }, "id": "CLSA-2026:1778239845", "initial_release_date": "2026-05-08T11:31:33Z", "revision_history": [ { "date": "2026-05-08T11:31:33Z", "number": "1", "summary": "Initial version" } ], "status": "final", "version": "1" }, "title": "skopeo: Fix of 2 CVEs" }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "AlmaLinux 9.2", "product": { "name": "AlmaLinux 9.2", "product_id": "AlmaLinux-9.2", "product_identification_helper": { "cpe": "cpe:2.3:o:almalinux:almalinux:9.2:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "AlmaLinux" } ], "category": "vendor", "name": "AlmaLinux OS Foundation" }, { "branches": [ { "branches": [ { "category": "product_version", "name": "skopeo-2:1.11.2-0.1.el9.tuxcare.els4.x86_64", "product": { "name": "skopeo-2:1.11.2-0.1.el9.tuxcare.els4.x86_64", "product_id": "skopeo-2:1.11.2-0.1.el9.tuxcare.els4.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/skopeo@1.11.2-0.1.el9.tuxcare.els4?arch=x86_64&epoch=2" } } }, { "category": "product_version", "name": "skopeo-tests-2:1.11.2-0.1.el9.tuxcare.els4.x86_64", "product": { "name": "skopeo-tests-2:1.11.2-0.1.el9.tuxcare.els4.x86_64", "product_id": "skopeo-tests-2:1.11.2-0.1.el9.tuxcare.els4.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/skopeo-tests@1.11.2-0.1.el9.tuxcare.els4?arch=x86_64&epoch=2" } } }, { "category": "product_version", "name": "skopeo-2:1.11.2-0.1.el9.tuxcare.els3.x86_64", "product": { "name": "skopeo-2:1.11.2-0.1.el9.tuxcare.els3.x86_64", "product_id": "skopeo-2:1.11.2-0.1.el9.tuxcare.els3.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/skopeo@1.11.2-0.1.el9.tuxcare.els3?arch=x86_64&epoch=2" } } }, { "category": "product_version", "name": "skopeo-tests-2:1.11.2-0.1.el9.tuxcare.els3.x86_64", "product": { "name": "skopeo-tests-2:1.11.2-0.1.el9.tuxcare.els3.x86_64", "product_id": "skopeo-tests-2:1.11.2-0.1.el9.tuxcare.els3.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/skopeo-tests@1.11.2-0.1.el9.tuxcare.els3?arch=x86_64&epoch=2" } } }, { "category": "product_version", "name": "skopeo-tests-2:1.11.2-0.1.el9.tuxcare.els2.x86_64", "product": { "name": "skopeo-tests-2:1.11.2-0.1.el9.tuxcare.els2.x86_64", "product_id": "skopeo-tests-2:1.11.2-0.1.el9.tuxcare.els2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/skopeo-tests@1.11.2-0.1.el9.tuxcare.els2?arch=x86_64&epoch=2" } } }, { "category": "product_version", "name": "skopeo-2:1.11.2-0.1.el9.tuxcare.els2.x86_64", "product": { "name": "skopeo-2:1.11.2-0.1.el9.tuxcare.els2.x86_64", "product_id": "skopeo-2:1.11.2-0.1.el9.tuxcare.els2.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/skopeo@1.11.2-0.1.el9.tuxcare.els2?arch=x86_64&epoch=2" } } }, { "category": "product_version", "name": "skopeo-tests-2:1.11.2-0.1.el9.tuxcare.els1.x86_64", "product": { "name": "skopeo-tests-2:1.11.2-0.1.el9.tuxcare.els1.x86_64", "product_id": "skopeo-tests-2:1.11.2-0.1.el9.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/skopeo-tests@1.11.2-0.1.el9.tuxcare.els1?arch=x86_64&epoch=2" } } }, { "category": "product_version", "name": "skopeo-2:1.11.2-0.1.el9.tuxcare.els1.x86_64", "product": { "name": "skopeo-2:1.11.2-0.1.el9.tuxcare.els1.x86_64", "product_id": "skopeo-2:1.11.2-0.1.el9.tuxcare.els1.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/skopeo@1.11.2-0.1.el9.tuxcare.els1?arch=x86_64&epoch=2" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "TuxCare" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "skopeo-2:1.11.2-0.1.el9.tuxcare.els4.x86_64 as a component of AlmaLinux 9.2", "product_id": "AlmaLinux-9.2:skopeo-2:1.11.2-0.1.el9.tuxcare.els4.x86_64" }, "product_reference": "skopeo-2:1.11.2-0.1.el9.tuxcare.els4.x86_64", "relates_to_product_reference": "AlmaLinux-9.2" }, { "category": "default_component_of", "full_product_name": { "name": "skopeo-tests-2:1.11.2-0.1.el9.tuxcare.els4.x86_64 as a component of AlmaLinux 9.2", "product_id": "AlmaLinux-9.2:skopeo-tests-2:1.11.2-0.1.el9.tuxcare.els4.x86_64" }, "product_reference": "skopeo-tests-2:1.11.2-0.1.el9.tuxcare.els4.x86_64", "relates_to_product_reference": "AlmaLinux-9.2" }, { "category": "default_component_of", "full_product_name": { "name": "skopeo-2:1.11.2-0.1.el9.tuxcare.els3.x86_64 as a component of AlmaLinux 9.2", "product_id": "AlmaLinux-9.2:skopeo-2:1.11.2-0.1.el9.tuxcare.els3.x86_64" }, "product_reference": "skopeo-2:1.11.2-0.1.el9.tuxcare.els3.x86_64", "relates_to_product_reference": "AlmaLinux-9.2" }, { "category": "default_component_of", "full_product_name": { "name": "skopeo-tests-2:1.11.2-0.1.el9.tuxcare.els3.x86_64 as a component of AlmaLinux 9.2", "product_id": "AlmaLinux-9.2:skopeo-tests-2:1.11.2-0.1.el9.tuxcare.els3.x86_64" }, "product_reference": "skopeo-tests-2:1.11.2-0.1.el9.tuxcare.els3.x86_64", "relates_to_product_reference": "AlmaLinux-9.2" }, { "category": "default_component_of", "full_product_name": { "name": "skopeo-tests-2:1.11.2-0.1.el9.tuxcare.els2.x86_64 as a component of AlmaLinux 9.2", "product_id": "AlmaLinux-9.2:skopeo-tests-2:1.11.2-0.1.el9.tuxcare.els2.x86_64" }, "product_reference": "skopeo-tests-2:1.11.2-0.1.el9.tuxcare.els2.x86_64", "relates_to_product_reference": "AlmaLinux-9.2" }, { "category": "default_component_of", "full_product_name": { "name": "skopeo-2:1.11.2-0.1.el9.tuxcare.els2.x86_64 as a component of AlmaLinux 9.2", "product_id": "AlmaLinux-9.2:skopeo-2:1.11.2-0.1.el9.tuxcare.els2.x86_64" }, "product_reference": "skopeo-2:1.11.2-0.1.el9.tuxcare.els2.x86_64", "relates_to_product_reference": "AlmaLinux-9.2" }, { "category": "default_component_of", "full_product_name": { "name": "skopeo-tests-2:1.11.2-0.1.el9.tuxcare.els1.x86_64 as a component of AlmaLinux 9.2", "product_id": "AlmaLinux-9.2:skopeo-tests-2:1.11.2-0.1.el9.tuxcare.els1.x86_64" }, "product_reference": "skopeo-tests-2:1.11.2-0.1.el9.tuxcare.els1.x86_64", "relates_to_product_reference": "AlmaLinux-9.2" }, { "category": "default_component_of", "full_product_name": { "name": "skopeo-2:1.11.2-0.1.el9.tuxcare.els1.x86_64 as a component of AlmaLinux 9.2", "product_id": "AlmaLinux-9.2:skopeo-2:1.11.2-0.1.el9.tuxcare.els1.x86_64" }, "product_reference": "skopeo-2:1.11.2-0.1.el9.tuxcare.els1.x86_64", "relates_to_product_reference": "AlmaLinux-9.2" } ] }, "vulnerabilities": [ { "cve": "CVE-2024-6104", "cwe": { "id": "CWE-532", "name": "Insertion of Sensitive Information into Log File" }, "notes": [ { "category": "description", "text": "go-retryablehttp prior to 0.7.7 did not sanitize urls when writing them to its log file. This could lead to go-retryablehttp writing sensitive HTTP basic auth credentials to its log file. This vulnerability, CVE-2024-6104, was fixed in go-retryablehttp 0.7.7.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AlmaLinux-9.2:skopeo-2:1.11.2-0.1.el9.tuxcare.els4.x86_64", "AlmaLinux-9.2:skopeo-tests-2:1.11.2-0.1.el9.tuxcare.els4.x86_64" ], "known_affected": [ "AlmaLinux-9.2:skopeo-2:1.11.2-0.1.el9.tuxcare.els1.x86_64", "AlmaLinux-9.2:skopeo-2:1.11.2-0.1.el9.tuxcare.els2.x86_64", "AlmaLinux-9.2:skopeo-2:1.11.2-0.1.el9.tuxcare.els3.x86_64", "AlmaLinux-9.2:skopeo-tests-2:1.11.2-0.1.el9.tuxcare.els1.x86_64", "AlmaLinux-9.2:skopeo-tests-2:1.11.2-0.1.el9.tuxcare.els2.x86_64", "AlmaLinux-9.2:skopeo-tests-2:1.11.2-0.1.el9.tuxcare.els3.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2024-6104" }, { "category": "external", "summary": "https://discuss.hashicorp.com/c/security", "url": "https://discuss.hashicorp.com/c/security" } ], "release_date": "2024-06-24T17:15:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-05-08T11:30:48.634737Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1778239845", "product_ids": [ "AlmaLinux-9.2:skopeo-2:1.11.2-0.1.el9.tuxcare.els4.x86_64", "AlmaLinux-9.2:skopeo-tests-2:1.11.2-0.1.el9.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1778239845" }, { "category": "none_available", "date": "2024-06-24T17:15:00Z", "details": "Affected", "product_ids": [ "AlmaLinux-9.2:skopeo-2:1.11.2-0.1.el9.tuxcare.els1.x86_64", "AlmaLinux-9.2:skopeo-2:1.11.2-0.1.el9.tuxcare.els2.x86_64", "AlmaLinux-9.2:skopeo-2:1.11.2-0.1.el9.tuxcare.els3.x86_64", "AlmaLinux-9.2:skopeo-tests-2:1.11.2-0.1.el9.tuxcare.els1.x86_64", "AlmaLinux-9.2:skopeo-tests-2:1.11.2-0.1.el9.tuxcare.els2.x86_64", "AlmaLinux-9.2:skopeo-tests-2:1.11.2-0.1.el9.tuxcare.els3.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "AlmaLinux-9.2:skopeo-2:1.11.2-0.1.el9.tuxcare.els4.x86_64", "AlmaLinux-9.2:skopeo-tests-2:1.11.2-0.1.el9.tuxcare.els4.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ] }, { "cve": "CVE-2024-28180", "cwe": { "id": "CWE-409", "name": "Improper Handling of Highly Compressed Data (Data Amplification)" }, "notes": [ { "category": "description", "text": "Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AlmaLinux-9.2:skopeo-2:1.11.2-0.1.el9.tuxcare.els4.x86_64", "AlmaLinux-9.2:skopeo-tests-2:1.11.2-0.1.el9.tuxcare.els4.x86_64" ], "known_affected": [ "AlmaLinux-9.2:skopeo-2:1.11.2-0.1.el9.tuxcare.els1.x86_64", "AlmaLinux-9.2:skopeo-2:1.11.2-0.1.el9.tuxcare.els2.x86_64", "AlmaLinux-9.2:skopeo-2:1.11.2-0.1.el9.tuxcare.els3.x86_64", "AlmaLinux-9.2:skopeo-tests-2:1.11.2-0.1.el9.tuxcare.els1.x86_64", "AlmaLinux-9.2:skopeo-tests-2:1.11.2-0.1.el9.tuxcare.els2.x86_64", "AlmaLinux-9.2:skopeo-tests-2:1.11.2-0.1.el9.tuxcare.els3.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2024-28180" } ], "release_date": "2024-03-09T00:00:00Z", "remediations": [ { "category": "vendor_fix", "date": "2026-05-08T11:30:48.634737Z", "details": "Details on how to apply the fix are available at: https://cve.tuxcare.com/els/releases/CLSA-2026:1778239845", "product_ids": [ "AlmaLinux-9.2:skopeo-2:1.11.2-0.1.el9.tuxcare.els4.x86_64", "AlmaLinux-9.2:skopeo-tests-2:1.11.2-0.1.el9.tuxcare.els4.x86_64" ], "url": "https://cve.tuxcare.com/els/releases/CLSA-2026:1778239845" }, { "category": "none_available", "date": "2024-03-09T00:00:00Z", "details": "Affected", "product_ids": [ "AlmaLinux-9.2:skopeo-2:1.11.2-0.1.el9.tuxcare.els1.x86_64", "AlmaLinux-9.2:skopeo-2:1.11.2-0.1.el9.tuxcare.els2.x86_64", "AlmaLinux-9.2:skopeo-2:1.11.2-0.1.el9.tuxcare.els3.x86_64", "AlmaLinux-9.2:skopeo-tests-2:1.11.2-0.1.el9.tuxcare.els1.x86_64", "AlmaLinux-9.2:skopeo-tests-2:1.11.2-0.1.el9.tuxcare.els2.x86_64", "AlmaLinux-9.2:skopeo-tests-2:1.11.2-0.1.el9.tuxcare.els3.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "AlmaLinux-9.2:skopeo-2:1.11.2-0.1.el9.tuxcare.els4.x86_64", "AlmaLinux-9.2:skopeo-tests-2:1.11.2-0.1.el9.tuxcare.els4.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ] } ] }