buildah-1.43.1-3.el9_8
エラータID: AXSA:2026-1490:06
リリース日:
2026/08/07 Friday - 19:23
題名:
buildah-1.43.1-3.el9_8
影響のあるチャネル:
MIRACLE LINUX 9 for x86_64
Severity:
High
Description:
以下項目について対処しました。
[Security Fix]
- Golang には、ファイルのアクセス権限の処理に不備があり、意図
されたセキュリティ制御を回避してしまう問題があるため、リモートの
攻撃者により、情報の漏洩、およびデータ破壊を可能とする脆弱性が存在
します。(CVE-2026-39832)
- Golang の crypto/ssh パッケージには、NULL ポインタデリファレンス
の問題があるため、リモートの攻撃者により、サービス拒否攻撃を可能と
する脆弱性が存在します。(CVE-2026-39835)
解決策:
パッケージをアップデートしてください。
CVE:
CVE-2026-39832
When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.
When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.
CVE-2026-39835
SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.
SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.
追加情報:
N/A
ダウンロード:
SRPMS
- buildah-1.43.1-3.el9_8.src.rpm
MD5: bc059e5d43fed749088ffb3ad2386f30
SHA-256: b6a5a073d593fea8035ce24c44be838d154203e739030f491b9fa3487eb607d6
Size: 10.65 MB
Asianux Server 9 for x86_64
- buildah-1.43.1-3.el9_8.x86_64.rpm
MD5: be927735124942bafba93e4302d879d7
SHA-256: 741f01d6ec018cd5d1f9b234df512e1a8386d5eabf9cff6ea4fa2192729baaf5
Size: 10.63 MB - buildah-tests-1.43.1-3.el9_8.x86_64.rpm
MD5: 267b6312f684d68daeff701c66eec688
SHA-256: d4e16e2aebcf743167f1ae0dee180f45e8328dfee7dc052441b497ed660b0ae3
Size: 30.77 MB
English