CVE-2024-22038

[CVE catalog]

Severity

High · CVSS 7.3CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H

Published

Nov 15, 2024, 4:05:33 AM UTC

Updated

Jul 9, 2026, 6:24:06 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.21% · Oct 25, 2026

This update for build, product-composer fixes the following issues: Changes in build: - Support a new "IgnoreRebuild" config. - build-recipe-kiwi: * Add support for oci containers * Avoid needlessly compressing container images * Detect container images based on build result file name - Fix queryrecipe to use the summary and the description from the main package - config: Add slfo-main build configuration - drop the inner quotes, not needed on bash 4 and breaks on bash 3 - build: in the ccache case, after test -e also accept -L - container: * Add microdnf package manager support * Add experimental support for the container-timestamp build option - sbom: * allow to create v1 intoto data * spdx: connect OPERATING-SYSTEM package to the root package * Transfer product vcs and disturl - Support --cms-nocerts and --cms-keyid in the signdummy - Support chroot builds inside of containers - runservice tool, allow to specify the modes. Can be used on plain git source now also - Support --mtime option for cpio creation - generate_sbom: * Support also unzck compressed repomd files * Fail when given --product directory is missing * support zstd compressed repomd data - build-vm-lxc: support lxc >= 5 - vc: Hide an annoying error message when not using NIS - added leap-16.0 and leap-16.1 build configs. (not named sl16.0 anymore, but using same string as the git branch) - Implement cmssign support in signdummy - pbuild: mark git assets with a fixed commit as immutable - mkosi * check if old parameters are supported before passing them * support old bash version - Do not crash on small files that start with the PE magic - Harden export_debian_orig_from_git (CVE-2024-22038, boo#1230469) Changes in product-composer: update to version 0.9.6: * Speed-up reading of rpm headers * Flush output lines to get get correct timestamps in OBS update to version 0.9.5: * Be a bit more verbose to track used times per step in OBS * Fix a crash when doing version compare with an epoch update to version 0.9.4: * Give an error when trying to add updateinfo meta data without all binary revisions. * Hand over vcs and disturl data to generate_sbom. (We require a recent build package therefore)