SUSE-SU-2025:20019-1: important: Security update for skopeo

[SLE-SECURITY-UPDATES]

# Security update for skopeo

Announcement ID: SUSE-SU-2025:20019-1  
Release Date: 2025-02-03T08:48:40Z  
Rating: important  
References:

  * bsc#1219563
  * bsc#1224123

  
Cross-References:

  * CVE-2024-28180
  * CVE-2024-3727

  
CVSS scores:

  * CVE-2024-28180 ( SUSE ):  2.3
    CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
  * CVE-2024-28180 ( SUSE ):  4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
  * CVE-2024-28180 ( NVD ):  4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
  * CVE-2024-3727 ( SUSE ):  8.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
  * CVE-2024-3727 ( NVD ):  8.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

  
Affected Products:

  * SUSE Linux Micro 6.0

  
  
An update that solves two vulnerabilities can now be installed.

## Description:

This update for skopeo fixes the following issues:

  * Update to version 1.14.4:
  * CVE-2024-3727: digest type does not guarantee valid type (bsc#1224123)
  * Packit: update packit targets
  * Bump gopkg.in/go-jose to v2.6.3
  * Bump ocicrypt and go-jose CVE-2024-28180
  * Freeze the fedora-minimal image reference at Fedora 38
  * Bump c/common to v0.57.4
  * Bump google.golang.org/protobuf to v1.33.0
  * Bump Skopeo to v1.14.3-dev

  * Update to version 1.14.2:

  * Bump c/image to v5.29.2, c/common to v0.57.3 (fixes bsc#1219563)

  * Update to version 1.14.1:

  * fix(deps): update module github.com/containers/common to v0.57.2
  * fix(deps): update module github.com/containers/image/v5 to v5.29.1
  * chore(deps): update dependency containers/automation_images to v20240102
  * Fix libsubid detection
  * fix(deps): update module golang.org/x/term to v0.16.0
  * fix(deps): update golang.org/x/exp digest to 02704c9
  * chore(deps): update dependency containers/automation_images to v20231208
  * [skip-ci] Update actions/stale action to v9
  * fix(deps): update module github.com/containers/common to v0.57.1
  * fix(deps): update golang.org/x/exp digest to 6522937
  * fix(deps): update module golang.org/x/term to v0.15.0

## Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".  
Alternatively you can run the command listed for your product:

  * SUSE Linux Micro 6.0  
    zypper in -t patch SUSE-SLE-Micro-6.0-21=1

## Package List:

  * SUSE Linux Micro 6.0 (aarch64 s390x x86_64)
    * skopeo-1.14.4-1.1
    * skopeo-debuginfo-1.14.4-1.1

## References:

  * https://www.suse.com/security/cve/CVE-2024-28180.html
  * https://www.suse.com/security/cve/CVE-2024-3727.html
  * https://bugzilla.suse.com/show_bug.cgi?id=1219563
  * https://bugzilla.suse.com/show_bug.cgi?id=1224123

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.suse.com/pipermail/sle-security-updates/attachments/20250604/cc8847d0/attachment.htm>