ELSA-2026-9044

ELSA-2026-9044 - osbuild-composer security update

Type:	SECURITY
Impact:	IMPORTANT
Release Date:	2026-04-21

Description

[149-5.0.1]
- Add missing dependency over dracut-config-rescue for image-installer [ORABUG: 38587453]
- Switch to UEKR8 repositories for OL9.6 [Orabug: 37962207]
- Add support to create OpenScap images [JIRA: OLDIS-35301]
- Simplify repository names [JIRA: OLDIS-35893]
- Refactor patches to fix some naming and set a correct kernel for Oracle Linux [Orabug: 37253643]
- Support using OCI variables inside built images [JIRA: OLDIS-35302]
- Support using repository definitons with OCI variables [JIRA: OLDIS-38657]
- Update repositories to contain OCI variables
- Remove image types Minimal-raw and wsl [JIRA: OLDIS-38123]
- Increase default /boot size to 1GB [Orabug: 36827079]
- Add support for OCI hybrid images [JIRA: OLDIS-33593]
- enable aarch64 OCI image builds [JIRA: OLDIS-33593]
- support for building OL8/9 images on Oracle Linux 9 [Orabug: 36400619]

[149-5]
- Rebuilt to fix:
- CVE-2026-25679
- CVE-2026-27137
- RHEL-158741
- RHEL-158860

Related CVEs

CVE-2026-25679

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 9 (aarch64)	osbuild-composer-149-5.0.1.el9_7.src.rpm	8a0b888cb022cbd55aec33c7baceb266fadb9242894e89a60c0106eecc96d122	-	ol9_aarch64_appstream
	osbuild-composer-149-5.0.1.el9_7.aarch64.rpm	0e027c3883b6a333224d8d84f41000360275de807e18657dca62c8c3a1d5fcb3	-	ol9_aarch64_appstream
	osbuild-composer-core-149-5.0.1.el9_7.aarch64.rpm	b21cbf82c1daa6884aba92ef3be25d72ee71c1fab3782d288d215450b2ccb1b7	-	ol9_aarch64_appstream
	osbuild-composer-worker-149-5.0.1.el9_7.aarch64.rpm	3f03f8e5a2feb82f138817be72a552bd5785ca613a943ae50d0862e22e1f5ee4	-	ol9_aarch64_appstream
Oracle Linux 9 (x86_64)	osbuild-composer-149-5.0.1.el9_7.src.rpm	8a0b888cb022cbd55aec33c7baceb266fadb9242894e89a60c0106eecc96d122	-	ol9_x86_64_appstream
	osbuild-composer-149-5.0.1.el9_7.x86_64.rpm	cf55a9c84d23fce87f0cdc33aeba9deaee70cd5e30d28c4682b0de79cc728e7b	-	ol9_x86_64_appstream
	osbuild-composer-core-149-5.0.1.el9_7.x86_64.rpm	63a520264d8aeaa21ae48edc1e0648e9da86e7a88c23799e6fe98dae4f2a1420	-	ol9_x86_64_appstream
	osbuild-composer-worker-149-5.0.1.el9_7.x86_64.rpm	27c0102d2f94bea22fb0bee6214369936eaf0f966bc45fb9d119fd24fe98caee	-	ol9_x86_64_appstream

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team