Repository navigation
chore(deps): refresh rpm lockfiles [SECURITY] - #2103
red-hat-konflux[bot] merged 1 commit into
Conversation
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. 🗂️ Base branches to auto review (2)
Please check the settings in the CodeRabbit UI or the ⚙️ Run configuration
You can disable this status message by setting the Use the checkbox below for a quick retry:
Comment |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## release-0.4 #2103 +/- ##
============================================
Coverage 33.38% 33.38%
============================================
Files 22 22
Lines 3630 3630
Branches 3630 3630
============================================
Hits 1212 1212
Misses 2409 2409
Partials 9 9 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
|
/konflux-retest fact-on-push |
2 similar comments
|
/konflux-retest fact-on-push |
|
/konflux-retest fact-on-push |
Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
0d45991 to
da6e0b8
Compare
2 participants
This PR contains the following updates:
File rpms.in.yaml:
5.14.0-687.56.1.el9_8->5.14.0-687.57.1.el9_87.76.1-40.el9_8.7->7.76.1-40.el9_8.87.76.1-40.el9_8.7->7.76.1-40.el9_8.810.40-6.el9->10.40-7.el9_810.40-6.el9->10.40-7.el9_8curl: curl: Cookie injection via malicious HTTP server using super cookies
CVE-2026-8924
More information
Details
A flaw was found in curl's cookie parsing logic. A malicious HTTP server can exploit this by setting 'super cookies' that bypass the Public Suffix List check. This allows an attacker-controlled origin to inject cookies that curl then transmits to unrelated third-party domains, leading to compromising request integrity.
Severity
Moderate
References
curl: curl: Information disclosure via incorrect Digest authentication header reuse
CVE-2026-11856
More information
Details
A flaw was found in curl. When
libcurlperforms a transfer to an HTTP origin using Digest authentication and then reuses the same connection handle for a subsequent transfer to a different origin, it may incorrectly send the authentication header intended for the first origin to the second. This could lead to unintended information disclosure, potentially allowing an attacker to gain unauthorized access to sensitive data.Severity
Moderate
References
pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions
CVE-2026-86145
More information
Details
A flaw was found in PCRE2. An out-of-bounds write vulnerability exists in the
pcre2_dfa_matchfunction due to improper size checking when reusing cached workspace blocks. A remote attacker could exploit this by providing a specially crafted regular expression or a recursive pattern in conjunction with a small heap limit. This could lead to data corruption or potentially arbitrary code execution, compromising the integrity and availability of the system.Severity
Important
References
PCRE2: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback
CVE-2026-89156
More information
Details
A flaw was found in PCRE2. An attacker can provide invalid UTF (Unicode Transformation Format) data, leading to an out-of-bounds read during a Just-In-Time (JIT) fallback. This vulnerability could potentially result in a denial of service.
Severity
Important
References
pcre2: PCRE2: Out-of-bounds write via large pattern input
CVE-2026-89157
More information
Details
A flaw was found in PCRE2. On 32-bit platforms, an attacker can provide a specially crafted large pattern, leading to an out-of-bounds write within the pcre2_pattern_convert function. This vulnerability can result in high integrity impact, such as data corruption, and potentially a low availability impact, causing a denial of service.
Severity
Important
References
PCRE2: PCRE2: Out-of-bounds write via integer overflow on 32-bit platforms
CVE-2026-89158
More information
Details
A flaw was found in PCRE2. On 32-bit platforms, an integer overflow in the
pcre2_compile_32function can lead to an out-of-bounds write. This vulnerability could allow a remote attacker to achieve a high integrity impact and a low availability impact, potentially leading to data corruption or denial of service.Severity
Important
References
pcre2: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching
CVE-2026-89160
More information
Details
A flaw was found in PCRE2, a library for processing regular expressions. A remote attacker could exploit this vulnerability by providing a specially crafted input that triggers an out-of-bounds read during pattern matching with invalid UTF (Unicode Transformation Format) characters. This could lead to a denial of service, making the affected system or application unavailable.
Severity
Important
References
pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match
CVE-2026-89161
More information
Details
A flaw was found in PCRE2, a library for processing regular expressions. The
pcre2_jit_matchfunction, which handles just-in-time (JIT) compilation for regular expressions, incorrectly manages memory when processing certain inputs. This memory corruption vulnerability could allow a local attacker to cause the application to crash, leading to a denial of service, or potentially execute unauthorized code.Severity
Important
References
pcre2: pcre2: Out-of-bounds write via crafted regular expression
CVE-2026-103111
More information
Details
A flaw was found in pcre2. When an application processes attacker-controlled regular expressions using certain Just-In-Time (JIT) compiler interfaces, an out-of-bounds write with arbitrary data can occur. An attacker could exploit this vulnerability to achieve arbitrary code execution, corrupt memory, or cause a denial of service (DoS).
Severity
Important
References
🔧 This Pull Request updates lock files to use the latest dependency versions.
Configuration
📅 Schedule: (in timezone Etc/UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
To execute skipped test pipelines write comment
/ok-to-test.Documentation
Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.