SUSE-SU-2024:1497-1 Security update for skopeo
Not scored
Published
Check this codebase for SUSE-SU-2024:1497-1 and fix it if it is affected.
What it is: SUSE-SU-2024:1497-1 is a vulnerability in skopeo, published on 6 May 2024.
Exploitation: There is no known exploitation of SUSE-SU-2024:1497-1 in the wild and no public exploit code.
Affected product: skopeo. No package-level version data is available, so check the vendor advisory linked from the reference page.
Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.
Reference: https://insights.sbomify.com/SUSE-SU-2024-1497-1/ (Markdown: https://insights.sbomify.com/SUSE-SU-2024-1497-1/index.md)
Security update for skopeo addressing dependency vulnerabilities, requiring users to upgrade to the latest version.
- Exploited in the wild
- Not known
- Login needed
- Not stated
- Attackable
- Not stated
- Victim action needed
- Not stated
- Fix
- Available
What is SUSE-SU-2024:1497-1?
SUSE-SU-2024:1497-1 is a vulnerability in skopeo, published on 6 May 2024.
Official description
This update for skopeo fixes the following issues:
Update to version 1.14.2:
- [release-1.14] Bump Skopeo to v1.14.2
- [release-1.14] Bump c/image to v5.29.2, c/common to v0.57.3 (fixes bsc#1219563)
Update to version 1.14.1:
- Bump to v1.14.1
- fix(deps): update module github.com/containers/common to v0.57.2
- fix(deps): update module github.com/containers/image/v5 to v5.29.1
- chore(deps): update dependency containers/automation_images to v20240102
- Fix libsubid detection
- fix(deps): update module golang.org/x/term to v0.16.0
- fix(deps): update golang.org/x/exp digest to 02704c9
- chore(deps): update dependency containers/automation_images to v20231208
- [skip-ci] Update actions/stale action to v9
- fix(deps): update module github.com/containers/common to v0.57.1
- fix(deps): update golang.org/x/exp digest to 6522937
- DOCS: add Gentoo in install.md
- DOCS: Update to add Arch Linux in install.md
- fix(deps): update module golang.org/x/term to v0.15.0
- Bump to v1.14.1-dev
Update to version 1.14.0:
- Bump to v1.14.0
- fix(deps): update module github.com/containers/common to v0.57.0
- chore(deps): update dependency containers/automation_images to v20231116
- fix(deps): update module github.com/containers/image/v5 to v5.29.0
- Add documentation and smoke tests for the new –compat-auth-file options
- Update c/image and c/common to latest
- fix(deps): update module github.com/containers/storage to v1.51.0
- fix(deps): update module golang.org/x/term to v0.14.0
- fix(deps): update module github.com/spf13/cobra to v1.8.0
- [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2
- [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1
- fix(deps): update github.com/containers/common digest to 3e5caa0
- chore(deps): update module google.golang.org/grpc to v1.57.1 [security]
- fix(deps): update module github.com/containers/ocicrypt to v1.1.9
- Update github.com/klauspost/compress to v1.17.2
- chore(deps): update module github.com/docker/docker to v24.0.7+incompatible [security]
- Fix ENTRYPOINT documentation, drop others.
- Remove unused environment variables in Cirrus
- [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0
- chore(deps): update dependency containers/automation_images to v20231004
- chore(deps): update module golang.org/x/net to v0.17.0 [security]
- copy: Note support for
zstd:chunked - fix(deps): update module golang.org/x/term to v0.13.0
- fix(deps): update module github.com/docker/distribution to v2.8.3+incompatible
- fix(deps): update github.com/containers/common digest to 745eaa4
- Packit: switch to @containers/packit-build team for copr failure notification comments
- Packit: tag @lsm5 on copr build failures
- vendor of containers/common
- fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5
- fix(deps): update module github.com/containers/common to v0.56.0
- Cirrus: Remove multi-arch skopeo image builds
- fix(deps): update module github.com/containers/image/v5 to v5.28.0
- Increase the golangci-lint timeout
- fix(deps): update module github.com/containers/storage to v1.50.2
- fix(deps): update module github.com/containers/storage to v1.50.1
- fix(deps): update golang.org/x/exp digest to 9212866
- Fix a man page link
- fix(deps): update github.com/containers/image/v5 digest to 58d5eb6
- GHA: Closed issue/PR comment-lock test
- fix(deps): update module github.com/containers/common to v0.55.4
- fix(deps): update module github.com/containers/storage to v1.49.0
- rpm: spdx compatible license field
- chore(deps): update dependency golangci/golangci-lint to v1.54.2
- chore(deps): update dependency containers/automation_images to v20230816
- Packit: set eln target correctly
- packit: Build PRs into default packit COPRs
- DOCS: Update Go version requirement info
- DOCS: Add information about the cross-build
- fix(deps): update module github.com/containers/ocicrypt to v1.1.8
- fix(deps): update module github.com/containers/common to v0.55.3
- Update c/image after https://github.com/containers/image/pull/2070
- chore(deps): update dependency golangci/golangci-lint to v1.54.1
- chore(deps): update dependency containers/automation_images to v20230809
- fix(deps): update golang.org/x/exp digest to 352e893
- chore(deps): update dependency containers/automation_images to v20230807
- Update to Go 1.19
- fix(deps): update module golang.org/x/term to v0.11.0
- Update c/image for golang.org/x/exp
- RPM: define gobuild macro for rhel/centos stream
- Fix handling the unexpected return value combination from IsRunningImageAllowed
- Close the PolicyContext, as required by the API
- Use globalOptions.getPolicyContext instead of an image-targeted SystemContext
- Packit: remove pre-sync action
- fix(deps): update module github.com/containers/common to v0.55.2
- proxy: Change the imgid to uint64
- [CI:BUILD] Packit: install golist before updating downstream spec
- Update module golang.org/x/term to v0.10.0
- Bump to v1.14.0-dev
- Bump to v1.13.0
Bump go version to 1.21 (bsc#1215611)
Update to version 1.13.2:
- [release-1.13] Bump to v1.13.2
- [release-1.31] Bump c/common v0.55.3
- Packit: remove pre-sync action
- [release-1.13] Bump to v1.13.2-dev
Update to version 1.13.1:
- [release-1.13] Bump to v1.13.1
- [release-1.13] Bump c/common to v0.55.2
- [release-1.13 backport] [CI:BUILD] Packit: install golist before updating downstream spec
- [release-1.13] Bump to v1.13.1-dev
Update to version 1.13.0:
- Bump to v1.13.0
- proxy: Policy verification of OCI Image before pulling
- Update module github.com/opencontainers/image-spec to v1.1.0-rc4
- Update module github.com/containers/common to v0.55.1
- Update module github.com/containers/common to v0.54.0
- Update module github.com/containers/image/v5 to v5.26.0
- [CI:BUILD] RPM: fix ELN builds
- Update module github.com/containers/storage to v1.47.0
- Packit: easier to read distro conditionals
- Update dependency golangci/golangci-lint to v1.53.3
- Help Renovate manage the golangci-lint version
- Minor: Cleanup renovate configuration
- Update dependency containers/automation_images to v20230614
- Update module golang.org/x/term to v0.9.0
- [CI:BUILD] Packit: add jobs for downstream Fedora package builds
- Update module github.com/sirupsen/logrus to v1.9.3
- Update dependency containers/automation_images to v20230601
- Update golang.org/x/exp digest to 2e198f4
- Update github.com/containers/image/v5 digest to e14c1c5
- Update module github.com/stretchr/testify to v1.8.4
- Update module github.com/stretchr/testify to v1.8.3
- Update dependency containers/automation_images to v20230517
- Update module github.com/sirupsen/logrus to v1.9.2
- Update module github.com/docker/distribution to v2.8.2+incompatible
- Trigger an update of the ostree_ext container image
- Update c/image with https://github.com/containers/image/pull/1944
- Update module github.com/containers/common to v0.53.0
- Update module golang.org/x/term to v0.8.0
- Update dependency containers/automation_images to v20230426
- Update golang.org/x/exp digest to 47ecfdc
- Emphasize the semantics of –preserve-digests a tiny bit
- Improve the static build documentation a tiny bit
- Bump to v1.12.1-dev
Which versions are affected by SUSE-SU-2024:1497-1?
Linux distribution packages (13)
skopeo SUSE:Enterprise Storage 7.1 | All versions | 1.14.2-150300.11.8.1 |
skopeo SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS | All versions | 1.14.2-150300.11.8.1 |
skopeo SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS | All versions | 1.14.2-150300.11.8.1 |
skopeo SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS | All versions | 1.14.2-150300.11.8.1 |
skopeo SUSE:Linux Enterprise Micro 5.5 | All versions | 1.14.2-150300.11.8.1 |
skopeo SUSE:Linux Enterprise Module for Basesystem 15 SP5 | All versions | 1.14.2-150300.11.8.1 |
skopeo SUSE:Linux Enterprise Server 15 SP3-LTSS | All versions | 1.14.2-150300.11.8.1 |
skopeo SUSE:Linux Enterprise Server 15 SP4-LTSS | All versions | 1.14.2-150300.11.8.1 |
skopeo SUSE:Linux Enterprise Server for SAP Applications 15 SP3 | All versions | 1.14.2-150300.11.8.1 |
skopeo SUSE:Linux Enterprise Server for SAP Applications 15 SP4 | All versions | 1.14.2-150300.11.8.1 |
skopeo SUSE:Manager Proxy 4.3 | All versions | 1.14.2-150300.11.8.1 |
skopeo SUSE:Manager Server 4.3 | All versions | 1.14.2-150300.11.8.1 |
skopeo openSUSE:Leap 15.5 | All versions | 1.14.2-150300.11.8.1 |
How do I fix SUSE-SU-2024:1497-1?
Upgrade to a fixed version.
Is SUSE-SU-2024:1497-1 being exploited?
There is no known exploitation of SUSE-SU-2024:1497-1 in the wild and no public exploit code.