ELSA-2025-22012

ELSA-2025-22012 - buildah security update

Type:	SECURITY
Impact:	IMPORTANT
Release Date:	2025-12-02

Description

[1.41.6-1.0.1]
- Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117178]

[2:1.41.6-1]
- update to the latest content of https://github.com/containers/buildah/tree/release-1.41
(https://github.com/containers/buildah/commit/2ece502)
- fixes '[Minor Incident] CVE-2025-52881 buildah: container escape and denial of service due to arbitrary write gadgets and procfs write redirects [rhel-10.1.z]'
- Resolves: RHEL-126634

[2:1.41.4-3]
- rebuild for CVE-2025-58183
- Resolves: RHEL-125628

[2:1.41.4-2]
- rebuild as the last build was built in the wrong tag
- Related: RHEL-115167

[2:1.41.4-1]
- update to the latest content of https://github.com/containers/buildah/tree/release-1.41
(https://github.com/containers/buildah/commit/ee5b574)
- fixes 'buildah: create parent directories of mount targets with mode 0755 - [RHEL-10.1] 0day'
- Resolves: RHEL-115167

Related CVEs

CVE-2025-52881

CVE-2025-58183

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 10 (aarch64)	buildah-1.41.6-1.0.1.el10_1.src.rpm	b0f45836805a4a76e33a2f3ea4675f1742dea755a7fab9d9efaa48d00e388291	-	ol10_aarch64_appstream
	buildah-1.41.6-1.0.1.el10_1.aarch64.rpm	fa440c32ed6ba47e4df2848c59e88b560bc5b511ff97eecac09b348182f2b2ab	-	ol10_aarch64_appstream
	buildah-tests-1.41.6-1.0.1.el10_1.aarch64.rpm	1b8e5c873a80c5a40bf1acdf8a2ef2b34258333600174600e36a8c4350eed858	-	ol10_aarch64_appstream
Oracle Linux 10 (x86_64)	buildah-1.41.6-1.0.1.el10_1.src.rpm	b0f45836805a4a76e33a2f3ea4675f1742dea755a7fab9d9efaa48d00e388291	-	ol10_x86_64_appstream
	buildah-1.41.6-1.0.1.el10_1.x86_64.rpm	207b9bfea45060794f39015bcbbc5a9d50b2a8adfff5f4590941ca38fd75bb77	-	ol10_x86_64_appstream
	buildah-tests-1.41.6-1.0.1.el10_1.x86_64.rpm	33f71f80f7e6e9c61b631dd7db049847f77ed11a40c9da853636899d246fab0c	-	ol10_x86_64_appstream

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team