Security update to pack 0.40.8
Fixes CVE-2024-25621: containerd - local privilege escalation Fixes CVE-2025-47913: golang.org/x/crypto/ssh/agent - SSH client panic Fixes CVE-2025-47914: golang.org/x/crypto/ssh/agent - SSH Agent server DoS Fixes CVE-2025-52881: container escape and denial of service Fixes CVE-2026-27145: crypto/x509 - DoS via excessive DNS SAN processing Fixes CVE-2026-33762: go-git - DoS via crafted Git index file Fixes CVE-2026-34165: go-git - DoS via crafted .idx file Fixes CVE-2026-39828: golang.org/x/crypto/ssh - Unauthorized command execution Fixes CVE-2026-39829: golang.org/x/crypto/ssh - DoS via crafted public key Fixes CVE-2026-39830: golang.org/x/crypto/ssh - Resource leak DoS Fixes CVE-2026-39832: golang.org/x/crypto/ssh/agent - Key restrictions bypass Fixes CVE-2026-39833: golang.org/x/crypto/ssh/agent - Key confirmation bypass Fixes CVE-2026-39835: golang.org/x/crypto/ssh - Certificate DoS Fixes CVE-2026-44740: go-billy - DoS via symlink cycle Fixes GO-2026-4970: Root escape via symlink plus trailing slash Fixes GO-2026-5856: Encrypted Client Hello privacy leak
Updates may require up to 24 hours to propagate to mirrors. If the following command doesn't work, please retry later:
sudo dnf upgrade --refresh --advisory=FEDORA-2026-e6e0368149Please log in to add feedback.
This update has been submitted for testing by lsm5.
This update's test gating status has been changed to 'ignored'.
This update has been pushed to testing.
lsm5 edited this update.
lsm5 edited this update.
lsm5 edited this update.
lsm5 edited this update.
lsm5 edited this update.
lsm5 edited this update.
lsm5 edited this update.
lsm5 edited this update.
lsm5 edited this update.
lsm5 edited this update.
This update's test gating status has been changed to 'passed'.
This update has been submitted for stable by bodhi.
This update has been pushed to stable.