ELSA-2026-67148-0

ELSA-2026-67148-0 - osbuild-composer security update

Type:	SECURITY
Impact:	IMPORTANT
Release Date:	2026-09-28

Description

[101.5-3.0.1]
- go.mod: update github.com/labstack/echo/v4 to v4.15.3
Resolves: RHEL-213908
- go.mod: update go.opentelemetry.io/otel to v1.44.0
Resolves: RHEL-239503
- Rebuild against updated golang
Resolves: RHEL-177172, RHEL-234031, RHEL-251840, RHEL-251061
- Fix CVE-2025-22866 CVE-2026-32281 CVE-2026-41178 CVE-2026-42499 CVE-2026-42504 CVE-2026-55677

Related CVEs

CVE-2025-22866

CVE-2026-32281

CVE-2026-41178

CVE-2026-42499

CVE-2026-42504

CVE-2026-55677

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 8 (aarch64)	osbuild-composer-101.5-3.0.1.el8_10.src.rpm	960f564d15a52757512c573831d0d5512a031c3046facb4bdfc53b663d5a68bf	-	ol8_aarch64_appstream
	osbuild-composer-101.5-3.0.1.el8_10.aarch64.rpm	63e7762afd6d32a442e9c4749cc55040b061e88639a3ce63b0493029573ee627	-	ol8_aarch64_appstream
	osbuild-composer-core-101.5-3.0.1.el8_10.aarch64.rpm	b725977e5f22eb4305e8837fe84ad40f70ca2836d24dfbd3a33e89d14ce587ed	-	ol8_aarch64_appstream
	osbuild-composer-worker-101.5-3.0.1.el8_10.aarch64.rpm	976a8747c99c88a447fe8bb81120ec1102f757039bee4a620f63d812f11ba753	-	ol8_aarch64_appstream
Oracle Linux 8 (x86_64)	osbuild-composer-101.5-3.0.1.el8_10.src.rpm	960f564d15a52757512c573831d0d5512a031c3046facb4bdfc53b663d5a68bf	-	ol8_x86_64_appstream
	osbuild-composer-101.5-3.0.1.el8_10.x86_64.rpm	679fe071f0ee4a36a3c4045261e94bcdefe26d8db17520dd454564d127d0ada2	-	ol8_x86_64_appstream
	osbuild-composer-core-101.5-3.0.1.el8_10.x86_64.rpm	58c43e079b1a3791a356ed63d6d8cf439d1ee87ebc38f458a29b17fd7bcf6aad	-	ol8_x86_64_appstream
	osbuild-composer-worker-101.5-3.0.1.el8_10.x86_64.rpm	519e901d4f91170e7d860147eb97e5104f7aa9ae9a59f8c918edc2852428a839	-	ol8_x86_64_appstream

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team