Improper Input Validation Affecting osbuild-composer package, versions *
Threat Intelligence
EPSS
0.16% (54th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-CENTOS8-OSBUILDCOMPOSER-2935157
- published 24 Jun 2022
- disclosed 12 Aug 2021
How to fix?
There is no fixed version for Centos:8 osbuild-composer.
NVD Description
Note: Versions mentioned in the description apply only to the upstream osbuild-composer package and not the osbuild-composer package as distributed by Centos.
See How to fix? for Centos:8 relevant fixed versions and status.
golang.org/x/text/language in golang.org/x/text before 0.3.7 can panic with an out-of-bounds read during BCP 47 language tag parsing. Index calculation is mishandled. If parsing untrusted user input, this can be used as a vector for a denial-of-service attack.
CVSS Scores
version 3.1