Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Red Hat osbuild-composer could let attackers tamper with system images

published 2 months ago

Summary

The osbuild-composer tool that Red Hat uses to create operating‑system images has a security weakness that could allow an attacker to modify those images before they are deployed. This could lead to compromised servers or workstations. Install the latest Red Hat update for osbuild-composer as soon as possible to close the gap.

What to do

Update redhat osbuild-composer to version 0:75-9.el8_8.
Update redhat osbuild-composer-core to version 0:75-9.el8_8.
Update redhat osbuild-composer-core-debuginfo to version 0:75-9.el8_8.
Update redhat osbuild-composer-debuginfo to version 0:75-9.el8_8.
Update redhat osbuild-composer-debugsource to version 0:75-9.el8_8.
Update redhat osbuild-composer-dnf-json to version 0:75-9.el8_8.
Update redhat osbuild-composer-tests-debuginfo to version 0:75-9.el8_8.
Update redhat osbuild-composer-worker to version 0:75-9.el8_8.
Update redhat osbuild-composer-worker-debuginfo to version 0:75-9.el8_8.

Affected software

Ecosystem	Vendor	Product	Affected versions
Red Hat:rhel_e4s:8.8::appstream	redhat	osbuild-composer	< 0:75-9.el8_8 Fix: upgrade to 0:75-9.el8_8
Red Hat:rhel_e4s:8.8::appstream	redhat	osbuild-composer-core	< 0:75-9.el8_8 Fix: upgrade to 0:75-9.el8_8
Red Hat:rhel_e4s:8.8::appstream	redhat	osbuild-composer-core-debuginfo	< 0:75-9.el8_8 Fix: upgrade to 0:75-9.el8_8
Red Hat:rhel_e4s:8.8::appstream	redhat	osbuild-composer-debuginfo	< 0:75-9.el8_8 Fix: upgrade to 0:75-9.el8_8
Red Hat:rhel_e4s:8.8::appstream	redhat	osbuild-composer-debugsource	< 0:75-9.el8_8 Fix: upgrade to 0:75-9.el8_8
Red Hat:rhel_e4s:8.8::appstream	redhat	osbuild-composer-dnf-json	< 0:75-9.el8_8 Fix: upgrade to 0:75-9.el8_8
Red Hat:rhel_e4s:8.8::appstream	redhat	osbuild-composer-tests-debuginfo	< 0:75-9.el8_8 Fix: upgrade to 0:75-9.el8_8
Red Hat:rhel_e4s:8.8::appstream	redhat	osbuild-composer-worker	< 0:75-9.el8_8 Fix: upgrade to 0:75-9.el8_8
Red Hat:rhel_e4s:8.8::appstream	redhat	osbuild-composer-worker-debuginfo	< 0:75-9.el8_8 Fix: upgrade to 0:75-9.el8_8
Red Hat:rhel_tus:8.8::appstream	redhat	osbuild-composer	< 0:75-9.el8_8 Fix: upgrade to 0:75-9.el8_8
Red Hat:rhel_tus:8.8::appstream	redhat	osbuild-composer-core	< 0:75-9.el8_8 Fix: upgrade to 0:75-9.el8_8
Red Hat:rhel_tus:8.8::appstream	redhat	osbuild-composer-core-debuginfo	< 0:75-9.el8_8 Fix: upgrade to 0:75-9.el8_8
Red Hat:rhel_tus:8.8::appstream	redhat	osbuild-composer-debuginfo	< 0:75-9.el8_8 Fix: upgrade to 0:75-9.el8_8
Red Hat:rhel_tus:8.8::appstream	redhat	osbuild-composer-debugsource	< 0:75-9.el8_8 Fix: upgrade to 0:75-9.el8_8
Red Hat:rhel_tus:8.8::appstream	redhat	osbuild-composer-dnf-json	< 0:75-9.el8_8 Fix: upgrade to 0:75-9.el8_8
Red Hat:rhel_tus:8.8::appstream	redhat	osbuild-composer-tests-debuginfo	< 0:75-9.el8_8 Fix: upgrade to 0:75-9.el8_8
Red Hat:rhel_tus:8.8::appstream	redhat	osbuild-composer-worker	< 0:75-9.el8_8 Fix: upgrade to 0:75-9.el8_8
Red Hat:rhel_tus:8.8::appstream	redhat	osbuild-composer-worker-debuginfo	< 0:75-9.el8_8 Fix: upgrade to 0:75-9.el8_8

Original advisory text

Red Hat Security Advisory: osbuild-composer security update

References

https://access.redhat.com/errata/RHSA-2026:52389 Vendor Advisory
https://access.redhat.com/security/updates/classification/#important Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2445356 Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_52389.... Vendor Advisory
https://access.redhat.com/security/cve/CVE-2026-25679 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2026-25679 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-25679 Vendor Advisory
https://go.dev/cl/752180 Third Party Advisory
https://go.dev/issue/77578 Third Party Advisory
https://groups.google.com/g/golang-announce/c/EdhZqrQ98hk Third Party Advisory
https://pkg.go.dev/vuln/GO-2026-4601 Vendor Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

7.5 High

Timeline

Published10 Aug 2026

Updated22 Aug 2026

First seen22 Aug 2026

Sources

RHSA-2026:52389 · OSV

Track software like this

Free during beta