RHSA-2026:97229: Important: skopeo security, bug fix, and enhancement update
The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files. Security Fix(es): docker: Moby/Docker Engine: Arbitrary Code Execution via malicious container image and compressed archive upload (CVE-2026-41567) Bug Fix(es) and Enhancement(s): update to the latest upstream release (JIRA:RHEL-185735) skopeo: Bump epoch to preserve upgrade path (JIRA:RHEL-220536) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.Additional Changes:For detailed information on changes in this release, see the Red Hat Enterprise Linux 10 Release Notes linked from the References section.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/skopeoto a version that resolves this vulnerability.Fixed in 1.24.0-2.el10 - Upgrade
Upgrade
redhat/skopeo-debuginfoto a version that resolves this vulnerability.Fixed in 1.24.0-2.el10 - Upgrade
Upgrade
redhat/skopeo-debugsourceto a version that resolves this vulnerability.Fixed in 1.24.0-2.el10 - Upgrade
Upgrade
redhat/skopeo-teststo a version that resolves this vulnerability.Fixed in 1.24.0-2.el10 - Upgrade
Upgrade
redhat/skopeoto a version that resolves this vulnerability.Fixed in 1.24.0-2.el10.aa - Upgrade
Upgrade
redhat/skopeo-debuginfoto a version that resolves this vulnerability.Fixed in 1.24.0-2.el10.aa - Upgrade
Upgrade
redhat/skopeo-debugsourceto a version that resolves this vulnerability.Fixed in 1.24.0-2.el10.aa - Upgrade
Upgrade
redhat/skopeo-teststo a version that resolves this vulnerability.Fixed in 1.24.0-2.el10.aa - Upgrade
Upgrade
skopeoto a version that resolves this vulnerability.Patch JIRA:RHEL-220536
Event History
Frequently Asked Questions
What component should be prioritized for remediation?
Prioritize systems with the Red Hat skopeo packages installed, including skopeo, skopeo-debuginfo, skopeo-debugsource, and skopeo-tests. The advisory identifies a security fix for CVE-2026-41567 in the docker/Moby-Docker Engine area.
What attacker-controlled content is associated with exploitation?
The security issue is described as arbitrary code execution through a malicious container image and compressed archive upload. Systems that inspect, retrieve, or otherwise process untrusted container images or archives merit particular attention.
What can be done if the update cannot be applied immediately?
The provided information does not specify a workaround. Until the update is deployed, limit processing of untrusted container images and compressed archive uploads where operationally possible.