Osbuild-Composer Security Update — AlmaLinux 8 (ALSA-2026:48790)

This is a security release for AlmaLinux 8. The fix ships in the current release line (referenced builds: 101.5-1). Update the product on every affected server to the patched release — there is no workaround, and unpatched servers remain exposed until updated.

High 2026-07-31

AlmaLinux 8

Fix-Befehle

EL8+ (AlmaLinux/CloudLinux/Rocky)

sudo dnf update

Was das unter einer SharedLicense-Lizenz bedeutet

Your SharedLicense license itself is not affected — this is a change in AlmaLinux 8 software, not in licensing. Update the product through its standard update channel. Licenses keep working through updates; nothing needs re-issuing or re-activating.

A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients.

Security Fix(es):

* google.golang.org/…

Type:

security

Severity:

important

Release date:

2026-07-31

Description:

Security Fix(es):

* google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186)
* github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986)
* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)
* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)
* crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References:

Updated packages listed below:

Architecture	Package	Checksum
aarch64	osbuild-composer-core-101.5-1.el8_10.alma.1.aarch64.rpm	6135e5d7e53bd867267190acb0520bd37879e345a8a387ca3f48e6a97ad09c8e
aarch64	osbuild-composer-worker-101.5-1.el8_10.alma.1.aarch64.rpm	79521ba582384b48056ac24aafc314e7e2023d0e36574e1b7097624504f7adda
aarch64	osbuild-composer-101.5-1.el8_10.alma.1.aarch64.rpm	9ceb993c2c138f39d32a5dd63432fb8b0fff4743ad993088d96c0fb8ab961372
ppc64le	osbuild-composer-101.5-1.el8_10.alma.1.ppc64le.rpm	46b6e700e4bb1011d3fc12d23e7b89a1169b0d31fae16c99010aa46a37f99b49
ppc64le	osbuild-composer-core-101.5-1.el8_10.alma.1.ppc64le.rpm	589daa196dc3259d7a3babff0893d1e49ae1a4af68ea35e8ec003de2b1e8532d
ppc64le	osbuild-composer-worker-101.5-1.el8_10.alma.1.ppc64le.rpm	ab7d1ecd018d06acc2bde0fb9d3d036cd1d3c7b37bc295532cc195b055634de7
s390x	osbuild-composer-worker-101.5-1.el8_10.alma.1.s390x.rpm	0442ed025b9f2a854a540a30754920f3920c8ce8d36e84c549638f0a2da4042e
s390x	osbuild-composer-101.5-1.el8_10.alma.1.s390x.rpm	34cbcf10d1969d7f897faa564c4bc1d01fce68a95b9c07ec2fd67939a31ae099
s390x	osbuild-composer-core-101.5-1.el8_10.alma.1.s390x.rpm	7f1dd71a2274d69ebe35f0007de5f428f0e135e7575302bdd4c52e360f43b9a4
x86_64	osbuild-composer-worker-101.5-1.el8_10.alma.1.x86_64.rpm	439e1be2b1a754bbc33ac6a90424be47ae543a8ca834459e715a3667476adec9
x86_64	osbuild-composer-core-101.5-1.el8_10.alma.1.x86_64.rpm	5955e0f0cd6384679a51dff20f48356d8d24e004f09002de9470833129af1066
x86_64	osbuild-composer-101.5-1.el8_10.alma.1.x86_64.rpm	82a72a4b8a1ce7de074f9e3d5a664a32d01f5e09bd8708570bf6db9d152f7896

Notes:

This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.

Referenzen

Hersteller-Hinweis

Sicherheitshinweise

System auf Schwachstellen prüfen

Wählen Sie Ihr Produkt und Betriebssystem, um die passenden Fix-Befehle zu sehen.

System prüfen

EL8+ (AlmaLinux/CloudLinux/Rocky)

Verwandte Warnhinweise

System auf Schwachstellen prüfen