[ALSA-2026:37410] Important: buildah security update
Type:
security
Severity:
important
Release date:
2026-07-13
Description:
The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. Security Fix(es): * golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate (CVE-2026-39835) * golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions (CVE-2026-39832) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Updated packages listed below:
Architecture Package Checksum
aarch64 buildah-tests-1.43.1-3.el9_8.aarch64.rpm 331b53177b13e1247cab1e6946b3ada97626abfd13721a9b9b5a1206e72c5410
aarch64 buildah-1.43.1-3.el9_8.aarch64.rpm 372466d390f4f4e8cbdb3e1a264f9b659772c847d910ba327eafbba4dc54e8f7
ppc64le buildah-1.43.1-3.el9_8.ppc64le.rpm 2b01346f6029b2bd9be2b66b381242f2982a08fcf669322032a69cb601a675c2
ppc64le buildah-tests-1.43.1-3.el9_8.ppc64le.rpm 96cd1821d45cc7cf0023dfc856b10ae4c2d4793f4b84249af3115c29f4c5dd8d
s390x buildah-1.43.1-3.el9_8.s390x.rpm 8517e551dd66e2abcf9bf7da62f3dafb1cd5446d8eeda157f1de6d59f68c2c65
s390x buildah-tests-1.43.1-3.el9_8.s390x.rpm e0915e7206a91769ea559dd7c34e9813e87b7a049ec7fca8d38a5b6d651ba023
x86_64 buildah-1.43.1-3.el9_8.x86_64.rpm 548132e51c8f4e48042aa928e895a48d47d9b0fd82983094e07a87c8c017a2d1
x86_64 buildah-tests-1.43.1-3.el9_8.x86_64.rpm cfaf5a8e8b6922a028a317d8fc0363cb12453da1bebe5c716ef15e95559e2712
Notes:
This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.