{"id":"SUSE-SU-2024:1497-1","aliases":[],"status":"published","title":"Security update for skopeo","description":"This update for skopeo fixes the following issues:\n\n- Update to version 1.14.2:\n  * [release-1.14] Bump Skopeo to v1.14.2\n  * [release-1.14] Bump c/image to v5.29.2, c/common to v0.57.3 (fixes bsc#1219563)\n\n- Update to version 1.14.1:\n  * Bump to v1.14.1\n  * fix(deps): update module github.com/containers/common to v0.57.2\n  * fix(deps): update module github.com/containers/image/v5 to v5.29.1\n  * chore(deps): update dependency containers/automation_images to v20240102\n  * Fix libsubid detection\n  * fix(deps): update module golang.org/x/term to v0.16.0\n  * fix(deps): update golang.org/x/exp digest to 02704c9\n  * chore(deps): update dependency containers/automation_images to v20231208\n  * [skip-ci] Update actions/stale action to v9\n  * fix(deps): update module github.com/containers/common to v0.57.1\n  * fix(deps): update golang.org/x/exp digest to 6522937\n  * DOCS: add Gentoo in install.md\n  * DOCS: Update to add Arch Linux in install.md\n  * fix(deps): update module golang.org/x/term to v0.15.0\n  * Bump to v1.14.1-dev\n\n- Update to version 1.14.0:\n  * Bump to v1.14.0\n  * fix(deps): update module github.com/containers/common to v0.57.0\n  * chore(deps): update dependency containers/automation_images to v20231116\n  * fix(deps): update module github.com/containers/image/v5 to v5.29.0\n  * Add documentation and smoke tests for the new --compat-auth-file options\n  * Update c/image and c/common to latest\n  * fix(deps): update module github.com/containers/storage to v1.51.0\n  * fix(deps): update module golang.org/x/term to v0.14.0\n  * fix(deps): update module github.com/spf13/cobra to v1.8.0\n  * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2\n  * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1\n  * fix(deps): update github.com/containers/common digest to 3e5caa0\n  * chore(deps): update module google.golang.org/grpc to v1.57.1 [security]\n  * fix(deps): update module github.com/containers/ocicrypt to v1.1.9\n  * Update github.com/klauspost/compress to v1.17.2\n  * chore(deps): update module github.com/docker/docker to v24.0.7+incompatible [security]\n  * Fix ENTRYPOINT documentation, drop others.\n  * Remove unused environment variables in Cirrus\n  * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0\n  * chore(deps): update dependency containers/automation_images to v20231004\n  * chore(deps): update module golang.org/x/net to v0.17.0 [security]\n  * copy: Note support for `zstd:chunked`\n  * fix(deps): update module golang.org/x/term to v0.13.0\n  * fix(deps): update module github.com/docker/distribution to v2.8.3+incompatible\n  * fix(deps): update github.com/containers/common digest to 745eaa4\n  * Packit: switch to @containers/packit-build team for copr failure notification comments\n  * Packit: tag @lsm5 on copr build failures\n  * vendor of containers/common\n  * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5\n  * fix(deps): update module github.com/containers/common to v0.56.0\n  * Cirrus: Remove multi-arch skopeo image builds\n  * fix(deps): update module github.com/containers/image/v5 to v5.28.0\n  * Increase the golangci-lint timeout\n  * fix(deps): update module github.com/containers/storage to v1.50.2\n  * fix(deps): update module github.com/containers/storage to v1.50.1\n  * fix(deps): update golang.org/x/exp digest to 9212866\n  * Fix a man page link\n  * fix(deps): update github.com/containers/image/v5 digest to 58d5eb6\n  * GHA: Closed issue/PR comment-lock test\n  * fix(deps): update module github.com/containers/common to v0.55.4\n  * fix(deps): update module github.com/containers/storage to v1.49.0\n  * rpm: spdx compatible license field\n  * chore(deps): update dependency golangci/golangci-lint to v1.54.2\n  * chore(deps): update dependency containers/automation_images to v20230816\n  * Packit: set eln target correctly\n  * packit: Build PRs into default packit COPRs\n  * DOCS: Update Go version requirement info\n  * DOCS: Add information about the cross-build\n  * fix(deps): update module github.com/containers/ocicrypt to v1.1.8\n  * fix(deps): update module github.com/containers/common to v0.55.3\n  * Update c/image after https://github.com/containers/image/pull/2070\n  * chore(deps): update dependency golangci/golangci-lint to v1.54.1\n  * chore(deps): update dependency containers/automation_images to v20230809\n  * fix(deps): update golang.org/x/exp digest to 352e893\n  * chore(deps): update dependency containers/automation_images to v20230807\n  * Update to Go 1.19\n  * fix(deps): update module golang.org/x/term to v0.11.0\n  * Update c/image for golang.org/x/exp\n  * RPM: define gobuild macro for rhel/centos stream\n  * Fix handling the unexpected return value combination from IsRunningImageAllowed\n  * Close the PolicyContext, as required by the API\n  * Use globalOptions.getPolicyContext instead of an image-targeted SystemContext\n  * Packit: remove pre-sync action\n  * fix(deps): update module github.com/containers/common to v0.55.2\n  * proxy: Change the imgid to uint64\n  * [CI:BUILD] Packit: install golist before updating downstream spec\n  * Update module golang.org/x/term to v0.10.0\n  * Bump to v1.14.0-dev\n  * Bump to v1.13.0\n\n- Bump go version to 1.21 (bsc#1215611)\n\n- Update to version 1.13.2:\n  * [release-1.13] Bump to v1.13.2\n  * [release-1.31] Bump c/common v0.55.3\n  * Packit: remove pre-sync action\n  * [release-1.13] Bump to v1.13.2-dev\n\n- Update to version 1.13.1:\n  * [release-1.13] Bump to v1.13.1\n  * [release-1.13] Bump c/common to v0.55.2\n  * [release-1.13 backport] [CI:BUILD] Packit: install golist before updating downstream spec\n  * [release-1.13] Bump to v1.13.1-dev\n\n- Update to version 1.13.0:\n  * Bump to v1.13.0\n  * proxy: Policy verification of OCI Image before pulling\n  * Update module github.com/opencontainers/image-spec to v1.1.0-rc4\n  * Update module github.com/containers/common to v0.55.1\n  * Update module github.com/containers/common to v0.54.0\n  * Update module github.com/containers/image/v5 to v5.26.0\n  * [CI:BUILD] RPM: fix ELN builds\n  * Update module github.com/containers/storage to v1.47.0\n  * Packit: easier to read distro conditionals\n  * Update dependency golangci/golangci-lint to v1.53.3\n  * Help Renovate manage the golangci-lint version\n  * Minor: Cleanup renovate configuration\n  * Update dependency containers/automation_images to v20230614\n  * Update module golang.org/x/term to v0.9.0\n  * [CI:BUILD] Packit: add jobs for downstream Fedora package builds\n  * Update module github.com/sirupsen/logrus to v1.9.3\n  * Update dependency containers/automation_images to v20230601\n  * Update golang.org/x/exp digest to 2e198f4\n  * Update github.com/containers/image/v5 digest to e14c1c5\n  * Update module github.com/stretchr/testify to v1.8.4\n  * Update module github.com/stretchr/testify to v1.8.3\n  * Update dependency containers/automation_images to v20230517\n  * Update module github.com/sirupsen/logrus to v1.9.2\n  * Update module github.com/docker/distribution to v2.8.2+incompatible\n  * Trigger an update of the ostree_ext container image\n  * Update c/image with https://github.com/containers/image/pull/1944\n  * Update module github.com/containers/common to v0.53.0\n  * Update module golang.org/x/term to v0.8.0\n  * Update dependency containers/automation_images to v20230426\n  * Update golang.org/x/exp digest to 47ecfdc\n  * Emphasize the semantics of --preserve-digests a tiny bit\n  * Improve the static build documentation a tiny bit\n  * Bump to v1.12.1-dev","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2024-05-06T07:40:10Z","modified":"2024-05-06T07:40:10Z","fixes":[{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"skopeo","fixed_in":["1.14.2-150300.11.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"skopeo","fixed_in":["1.14.2-150300.11.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"skopeo","fixed_in":["1.14.2-150300.11.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"skopeo","fixed_in":["1.14.2-150300.11.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"skopeo","fixed_in":["1.14.2-150300.11.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"skopeo","fixed_in":["1.14.2-150300.11.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"skopeo","fixed_in":["1.14.2-150300.11.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"skopeo","fixed_in":["1.14.2-150300.11.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"skopeo","fixed_in":["1.14.2-150300.11.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.3","package":"skopeo","fixed_in":["1.14.2-150300.11.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.3","package":"skopeo","fixed_in":["1.14.2-150300.11.8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7.1","package":"skopeo","fixed_in":["1.14.2-150300.11.8.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"skopeo","fixed_in":["1.14.2-150300.11.8.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.2-150300.11.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP5","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.2-150300.11.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.2-150300.11.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.2-150300.11.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.2-150300.11.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.2-150300.11.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.2-150300.11.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.2-150300.11.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.2-150300.11.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.2-150300.11.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.2-150300.11.8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.2-150300.11.8.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"skopeo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.2-150300.11.8.1"}]}]}],"references":[{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241497-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1215611","tags":["report"]},{"url":"https://bugzilla.suse.com/1219563","tags":["report"]}],"sources":{"osv":[{"id":"SUSE-SU-2024:1497-1","title":"Security update for skopeo","description":"This update for skopeo fixes the following issues:\n\n- Update to version 1.14.2:\n  * [release-1.14] Bump Skopeo to v1.14.2\n  * [release-1.14] Bump c/image to v5.29.2, c/common to v0.57.3 (fixes bsc#1219563)\n\n- Update to version 1.14.1:\n  * Bump to v1.14.1\n  * fix(deps): update module github.com/containers/common to v0.57.2\n  * fix(deps): update module github.com/containers/image/v5 to v5.29.1\n  * chore(deps): update dependency containers/automation_images to v20240102\n  * Fix libsubid detection\n  * fix(deps): update module golang.org/x/term to v0.16.0\n  * fix(deps): update golang.org/x/exp digest to 02704c9\n  * chore(deps): update dependency containers/automation_images to v20231208\n  * [skip-ci] Update actions/stale action to v9\n  * fix(deps): update module github.com/containers/common to v0.57.1\n  * fix(deps): update golang.org/x/exp digest to 6522937\n  * DOCS: add Gentoo in install.md\n  * DOCS: Update to add Arch Linux in install.md\n  * fix(deps): update module golang.org/x/term to v0.15.0\n  * Bump to v1.14.1-dev\n\n- Update to version 1.14.0:\n  * Bump to v1.14.0\n  * fix(deps): update module github.com/containers/common to v0.57.0\n  * chore(deps): update dependency containers/automation_images to v20231116\n  * fix(deps): update module github.com/containers/image/v5 to v5.29.0\n  * Add documentation and smoke tests for the new --compat-auth-file options\n  * Update c/image and c/common to latest\n  * fix(deps): update module github.com/containers/storage to v1.51.0\n  * fix(deps): update module golang.org/x/term to v0.14.0\n  * fix(deps): update module github.com/spf13/cobra to v1.8.0\n  * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.2\n  * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.1\n  * fix(deps): update github.com/containers/common digest to 3e5caa0\n  * chore(deps): update module google.golang.org/grpc to v1.57.1 [security]\n  * fix(deps): update module github.com/containers/ocicrypt to v1.1.9\n  * Update github.com/klauspost/compress to v1.17.2\n  * chore(deps): update module github.com/docker/docker to v24.0.7+incompatible [security]\n  * Fix ENTRYPOINT documentation, drop others.\n  * Remove unused environment variables in Cirrus\n  * [CI:DOCS] Update dependency golangci/golangci-lint to v1.55.0\n  * chore(deps): update dependency containers/automation_images to v20231004\n  * chore(deps): update module golang.org/x/net to v0.17.0 [security]\n  * copy: Note support for `zstd:chunked`\n  * fix(deps): update module golang.org/x/term to v0.13.0\n  * fix(deps): update module github.com/docker/distribution to v2.8.3+incompatible\n  * fix(deps): update github.com/containers/common digest to 745eaa4\n  * Packit: switch to @containers/packit-build team for copr failure notification comments\n  * Packit: tag @lsm5 on copr build failures\n  * vendor of containers/common\n  * fix(deps): update module github.com/opencontainers/image-spec to v1.1.0-rc5\n  * fix(deps): update module github.com/containers/common to v0.56.0\n  * Cirrus: Remove multi-arch skopeo image builds\n  * fix(deps): update module github.com/containers/image/v5 to v5.28.0\n  * Increase the golangci-lint timeout\n  * fix(deps): update module github.com/containers/storage to v1.50.2\n  * fix(deps): update module github.com/containers/storage to v1.50.1\n  * fix(deps): update golang.org/x/exp digest to 9212866\n  * Fix a man page link\n  * fix(deps): update github.com/containers/image/v5 digest to 58d5eb6\n  * GHA: Closed issue/PR comment-lock test\n  * fix(deps): update module github.com/containers/common to v0.55.4\n  * fix(deps): update module github.com/containers/storage to v1.49.0\n  * rpm: spdx compatible license field\n  * chore(deps): update dependency golangci/golangci-lint to v1.54.2\n  * chore(deps): update dependency containers/automation_images to v20230816\n  * Packit: set eln target correctly\n  * packit: Build PRs into default packit COPRs\n  * DOCS: Update Go version requirement info\n  * DOCS: Add information about the cross-build\n  * fix(deps): update module github.com/containers/ocicrypt to v1.1.8\n  * fix(deps): update module github.com/containers/common to v0.55.3\n  * Update c/image after https://github.com/containers/image/pull/2070\n  * chore(deps): update dependency golangci/golangci-lint to v1.54.1\n  * chore(deps): update dependency containers/automation_images to v20230809\n  * fix(deps): update golang.org/x/exp digest to 352e893\n  * chore(deps): update dependency containers/automation_images to v20230807\n  * Update to Go 1.19\n  * fix(deps): update module golang.org/x/term to v0.11.0\n  * Update c/image for golang.org/x/exp\n  * RPM: define gobuild macro for rhel/centos stream\n  * Fix handling the unexpected return value combination from IsRunningImageAllowed\n  * Close the PolicyContext, as required by the API\n  * Use globalOptions.getPolicyContext instead of an image-targeted SystemContext\n  * Packit: remove pre-sync action\n  * fix(deps): update module github.com/containers/common to v0.55.2\n  * proxy: Change the imgid to uint64\n  * [CI:BUILD] Packit: install golist before updating downstream spec\n  * Update module golang.org/x/term to v0.10.0\n  * Bump to v1.14.0-dev\n  * Bump to v1.13.0\n\n- Bump go version to 1.21 (bsc#1215611)\n\n- Update to version 1.13.2:\n  * [release-1.13] Bump to v1.13.2\n  * [release-1.31] Bump c/common v0.55.3\n  * Packit: remove pre-sync action\n  * [release-1.13] Bump to v1.13.2-dev\n\n- Update to version 1.13.1:\n  * [release-1.13] Bump to v1.13.1\n  * [release-1.13] Bump c/common to v0.55.2\n  * [release-1.13 backport] [CI:BUILD] Packit: install golist before updating downstream spec\n  * [release-1.13] Bump to v1.13.1-dev\n\n- Update to version 1.13.0:\n  * Bump to v1.13.0\n  * proxy: Policy verification of OCI Image before pulling\n  * Update module github.com/opencontainers/image-spec to v1.1.0-rc4\n  * Update module github.com/containers/common to v0.55.1\n  * Update module github.com/containers/common to v0.54.0\n  * Update module github.com/containers/image/v5 to v5.26.0\n  * [CI:BUILD] RPM: fix ELN builds\n  * Update module github.com/containers/storage to v1.47.0\n  * Packit: easier to read distro conditionals\n  * Update dependency golangci/golangci-lint to v1.53.3\n  * Help Renovate manage the golangci-lint version\n  * Minor: Cleanup renovate configuration\n  * Update dependency containers/automation_images to v20230614\n  * Update module golang.org/x/term to v0.9.0\n  * [CI:BUILD] Packit: add jobs for downstream Fedora package builds\n  * Update module github.com/sirupsen/logrus to v1.9.3\n  * Update dependency containers/automation_images to v20230601\n  * Update golang.org/x/exp digest to 2e198f4\n  * Update github.com/containers/image/v5 digest to e14c1c5\n  * Update module github.com/stretchr/testify to v1.8.4\n  * Update module github.com/stretchr/testify to v1.8.3\n  * Update dependency containers/automation_images to v20230517\n  * Update module github.com/sirupsen/logrus to v1.9.2\n  * Update module github.com/docker/distribution to v2.8.2+incompatible\n  * Trigger an update of the ostree_ext container image\n  * Update c/image with https://github.com/containers/image/pull/1944\n  * Update module github.com/containers/common to v0.53.0\n  * Update module golang.org/x/term to v0.8.0\n  * Update dependency containers/automation_images to v20230426\n  * Update golang.org/x/exp digest to 47ecfdc\n  * Emphasize the semantics of --preserve-digests a tiny bit\n  * Improve the static build documentation a tiny bit\n  * Bump to v1.12.1-dev\n","status":"published","published":"2024-05-06T07:40:10Z","modified":"2024-05-06T07:40:10Z","updated_at":"2026-11-02T15:53:54.652421Z"}]}}