Repository navigation
chore(deps): refresh rpm lockfiles [SECURITY] - #96
Open
konflux-internal-p02[bot] wants to merge 1 commit into
Open
konflux-internal-p02[bot] wants to merge 1 commit into
konflux-internal-p02[bot] wants to merge 1 commit into
Conversation
Signed-off-by: konflux-internal-p02 <170854209+konflux-internal-p02[bot]@users.noreply.github.com>
|
Important Review skippedBot user detected. To trigger a single review, invoke the
 |
Post-Codefreeze Gatekeeper — FAILEDTarget branch: ❌ The following issues were found:
After resolving issues, rerun the Post-Codefreeze Gatekeeper workflow in GitHub Actions to revalidate the current PR description. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
File deploy/konflux/cli/rpms.in.yaml:
2026e-1.el9_8->2026f-1.el9_82.34-283.el9_8->2.34-284.el9_8.42.34-283.el9_8->2.34-284.el9_8.42.34-283.el9_8->2.34-284.el9_8.42.34-283.el9_8->2.34-284.el9_8.4File deploy/konflux/e2e-odh/rpms.in.yaml:
2026e-1.el9_8->2026f-1.el9_82.34-283.el9_8->2.34-284.el9_8.42.34-283.el9_8->2.34-284.el9_8.42.34-283.el9_8->2.34-284.el9_8.4File deploy/konflux/gateway/rpms.in.yaml:
2026e-1.el9_8->2026f-1.el9_82.34-283.el9_8->2.34-284.el9_8.42.34-283.el9_8->2.34-284.el9_8.42.34-283.el9_8->2.34-284.el9_8.4File deploy/konflux/openclaw/rpms.in.yaml:
2026e-1.el9_8->2026f-1.el9_82.34-283.el9_8->2.34-284.el9_8.42.34-283.el9_8->2.34-284.el9_8.42.34-283.el9_8->2.34-284.el9_8.4File deploy/konflux/sandbox/rpms.in.yaml:
5.14.0-687.61.1.el9_8->5.14.0-687.66.1.el9_82026e-1.el9_8->2026f-1.el9_82.34-283.el9_8->2.34-284.el9_8.42.34-283.el9_8->2.34-284.el9_8.42.34-283.el9_8->2.34-284.el9_8.42.34-283.el9_8->2.34-284.el9_8.42.34-283.el9_8->2.34-284.el9_8.42.34-283.el9_8->2.34-284.el9_8.4File deploy/konflux/supervisor/rpms.in.yaml:
2026e-1.el9_8->2026f-1.el9_82.34-283.el9_8->2.34-284.el9_8.42.34-283.el9_8->2.34-284.el9_8.42.34-283.el9_8->2.34-284.el9_8.4glibc: glibc DNS stub resolver: Denial of Service via long search domain in configuration
CVE-2026-8674
More information
Severity
Moderate
References
glibc: glibc: Privilege escalation and arbitrary code execution via TOCTOU race condition in dynamic loader
CVE-2026-86805
More information
Severity
Moderate
References
glibc: nscd stack overflow leads to degraded DNS resolution
CVE-2026-89092
More information
Severity
Moderate
References
glibc: glibc: Local attacker can cause denial of service and information disclosure via stack-based buffer overflow.
CVE-2026-95818
More information
Severity
Moderate
References
glibc: glibc DNS stub resolver: Denial of Service via long search domain in configuration
CVE-2026-8674
More information
Details
A flaw was found in the GNU C Library (glibc) DNS stub resolver. This vulnerability allows a remote attacker on the local network to cause a denial of service by providing a specially crafted, excessively long search domain. When the resolver attempts to initialize with this long domain from /etc/resolv.conf or the LOCALDOMAIN environment variable, it triggers an assertion failure, which aborts the process. This can be exploited without privileges on the target system, potentially through network configuration mechanisms like DHCP or a VPN server.
Severity
Moderate
References
glibc: glibc: Privilege escalation and arbitrary code execution via TOCTOU race condition in dynamic loader
CVE-2026-86805
More information
Details
A flaw was found in glibc, specifically within its dynamic loader (ld.so). A local attacker can exploit a time-of-check to time-of-use (TOCTOU) race condition to escalate privileges and execute arbitrary code. This occurs when the dynamic loader expands $ORIGIN in DT_RPATH for setuid/setgid programs, validating a normalized path but then opening an un-normalized path. By hard-linking such a program and winning a race to swap a path component with a symbolic link, an attacker can direct the loader to an attacker-controlled shared object, gaining elevated privileges. This vulnerability is mitigated on systems with fs.protected_hardlinks enabled.
Severity
Moderate
References
glibc: nscd stack overflow leads to degraded DNS resolution
CVE-2026-89092
More information
Details
A flaw was found in glibc, specifically within the nscd service. A remote attacker, operating a malicious Domain Name System (DNS) server, could send an overly large DNS response. This could trigger a stack overflow in the nscd service, causing it to crash and leading to degraded DNS resolution for the system. There is also a remote possibility of nscd cache corruption.
Severity
Moderate
References
glibc: glibc: Local attacker can cause denial of service and information disclosure via stack-based buffer overflow.
CVE-2026-95818
More information
Details
A flaw was found in glibc, the GNU C Library. A local attacker can exploit a stack-based buffer overflow in the dynamic loader (ld.so) when a setuid/setgid (AT_SECURE) program's DT_RPATH or DT_RUNPATH begins with $ORIGIN followed by a null character or a slash. This vulnerability allows the attacker to crash the loader, leading to a denial of service, and potentially disclose limited process memory.
Severity
Moderate
References
🔧 This Pull Request updates lock files to use the latest dependency versions.
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
To execute skipped test pipelines write comment
/ok-to-test.Documentation
Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.