SUSE-SU-2025:20019-1

See a problem?
Please try reporting it to the source first.

Source

Import Source

JSON Data

https://api.osv.dev/v1/vulns/SUSE-SU-2025:20019-1

Upstream

CVE (2)

Related

CVE (2)

Published

2025-02-03T08:48:38Z

Modified

2026-03-23T04:48:07Z

Summary

Security update for skopeo

Details

This update for skopeo fixes the following issues:

Update to version 1.14.4:
- CVE-2024-3727: digest type does not guarantee valid type (bsc#1224123)
- Packit: update packit targets
- Bump gopkg.in/go-jose to v2.6.3
- Bump ocicrypt and go-jose CVE-2024-28180
- Freeze the fedora-minimal image reference at Fedora 38
- Bump c/common to v0.57.4
- Bump google.golang.org/protobuf to v1.33.0
- Bump Skopeo to v1.14.3-dev
Update to version 1.14.2:
- Bump c/image to v5.29.2, c/common to v0.57.3 (fixes bsc#1219563)
Update to version 1.14.1:
- fix(deps): update module github.com/containers/common to v0.57.2
- fix(deps): update module github.com/containers/image/v5 to v5.29.1
- chore(deps): update dependency containers/automation_images to v20240102
- Fix libsubid detection
- fix(deps): update module golang.org/x/term to v0.16.0
- fix(deps): update golang.org/x/exp digest to 02704c9
- chore(deps): update dependency containers/automation_images to v20231208
- [skip-ci] Update actions/stale action to v9
- fix(deps): update module github.com/containers/common to v0.57.1
- fix(deps): update golang.org/x/exp digest to 6522937
- fix(deps): update module golang.org/x/term to v0.15.0

References

Affected packages

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.14.4-1.1

{
    "binaries":  [
        {
            "skopeo":  "1.14.4-1.1"
        }
    ]
}

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2025:20019-1.json"