Moderate: skopeo security and bug fix update

2024-05-1014:32:42

Google

osv.dev

skopeo command

image inspection

image retrieval

signature usage

security fix

bug fix

golang-protobuf

encoding

internal/encoding/json

infinite loop

protojson.unmarshal

rocky linux

jose-go

highly compressed data

4.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

5.2 Medium

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

17.2%

JSON

The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files.

Security Fix(es):

golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON (CVE-2024-24786)

Bug Fix(es):

TRIAGE CVE-2024-24786 skopeo: golang-protobuf: encoding/protojson, internal/encoding/json: infinite loop in protojson.Unmarshal when unmarshaling certain forms of invalid JSON [rhel-9] - Rocky Linux 9.4 0day (JIRA:Rocky Linux-28235)
skopeo: jose-go: improper handling of highly compressed data [rhel-9] (JIRA:Rocky Linux-28736)