RHSA-2022:7955: Moderate: skopeo security and bug fix update
The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files. Security Fix(es): containers/storage: DoS via malicious image (CVE-2021-20291) golang: math/big.Rat: may cause a panic or an unrecoverable fatal error if passed inputs with very large exponents (CVE-2021-33198) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Additional Changes:For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.1 Release Notes linked from the References section.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2022:7955?
The severity of RHSA-2022:7955 is critical due to a denial of service vulnerability in skopeo.
How do I fix RHSA-2022:7955?
To fix RHSA-2022:7955, update the skopeo package to version 1.9.2-1.el9 or later.
What systems are affected by RHSA-2022:7955?
RHSA-2022:7955 affects the skopeo package across various architectures including x86_64, ppc64le, and ARM.
What is the impact of the vulnerability in RHSA-2022:7955?
The vulnerability in RHSA-2022:7955 can lead to a denial of service if a malicious image is processed.
Are there any workarounds for RHSA-2022:7955?
There are no specific workarounds for RHSA-2022:7955; updating to the latest version is recommended.