SUSE-SU-2023:4103-1: Security update for buildah

Q: Which deployments are in scope for this update?

The update applies to the buildah package on SUSE openSUSE Leap 15.5 and SUSE Containers Module 15-SP5. The listed architectures are aarch64, ppc64le, s390x, and x86_64; Leap 15.5 also lists i586.

Q: What is known about the underlying security issue?

The advisory states that buildah was rebuilt with the Go 1.21 security release. It does not identify a specific vulnerability, attack vector, affected configuration, or workaround.

Q: What should teams do if they use buildah on an affected SUSE platform?

Apply SUSE-SU-2023:4103-1 through the normal SUSE update process. The provided information does not include a mitigation for systems that cannot be updated immediately.

Published Oct 17, 2023

Updated

This update of buildah fixes the following issues: rebuild the package with the go 1.21 security release (bsc#1212475).

Affected Software

4 affected componentsFixes available

All of the following

SUSE openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64 i586)

suse/buildah<1.29.1-150500.3.2.1

1.29.1-150500.3.2.1

All of the following

SUSE Containers Module 15-SP5 (aarch64 ppc64le s390x x86_64)

suse/buildah<1.29.1-150500.3.2.1

1.29.1-150500.3.2.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade suse/buildah to a version that resolves this vulnerability.
Fixed in 1.29.1-150500.3.2.1
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Module-Containers-15-SP5-2023-4103=1
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch openSUSE-SLE-15.5-2023-4103=1
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-2023-4103=1

Event History

Oct 17, 2023

Advisory Published

04:30 PM

Frequently Asked Questions

Which deployments are in scope for this update?

The update applies to the buildah package on SUSE openSUSE Leap 15.5 and SUSE Containers Module 15-SP5. The listed architectures are aarch64, ppc64le, s390x, and x86_64; Leap 15.5 also lists i586.

What is known about the underlying security issue?

The advisory states that buildah was rebuilt with the Go 1.21 security release. It does not identify a specific vulnerability, attack vector, affected configuration, or workaround.

What should teams do if they use buildah on an affected SUSE platform?

Apply SUSE-SU-2023:4103-1 through the normal SUSE update process. The provided information does not include a mitigation for systems that cannot be updated immediately.

SUSE-SU-2023:4103-1: Security update for buildah

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are in scope for this update?

What is known about the underlying security issue?

What should teams do if they use buildah on an affected SUSE platform?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are in scope for this update?

What is known about the underlying security issue?

What should teams do if they use buildah on an affected SUSE platform?