RHSA-2025:7118: osbuild-composer Red Hat

CVSS: 7.5v3.1HighPublished

Published 05-08-2026Last modified 17-10-2026

Open JSON

Vulnerability summary

RHSA-2025:7118 is a high (CVSS 7.5) vulnerability in osbuild-composer Red Hat.

Overall risk

30/100

0100

Medium · default modelHow is this calculated?

CVSS score

7.5/10

010

High · v3.1 (OSV · Red hat), selected by version preference

EPSS score

Not scored

0%100%

No EPSS score yet

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 3 · Downstream 0 · Related 2

CVE-2024-1394 CVE-2024-34158 CVE-2024-9355

Timeline

05-08-2026
PublishedVulnerability first disclosed.
17-10-2026
Last modifiedVulnerability information updated.

Description

Red Hat Security Advisory: osbuild and osbuild-composer security update

CVSS metrics

1 score · 1 source · 1 version

v3.17.5

EPSS trend

No EPSS score has been published for this record yet.

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Redhat8 products

osbuild-composer< 0:132-1.el9
osbuild-composer-core< 0:132-1.el9
osbuild-composer-core-debuginfo< 0:132-1.el9
osbuild-composer-debuginfo< 0:132-1.el9
osbuild-composer-debugsource< 0:132-1.el9

Show all 8

1 vendor · 8 products

References

32 links

Show all 32 references

issues.redhat.com/browse/RHEL-56049ARTICLE
issues.redhat.com/browse/RHEL-78659ARTICLE
security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_7118.jsonAdvisory
access.redhat.com/security/cve/CVE-2024-1394REPORT
www.cve.org/CVERecord?id=CVE-2024-1394Advisory
nvd.nist.gov/vuln/detail/CVE-2024-1394Advisory
github.com/golang-fips/openssl/commit/85d31d0d257ce842c8a1e63c4d230ae850348136ARTICLE
github.com/golang-fips/openssl/security/advisories/GHSA-78hx-gp6g-7mj6ARTICLE
github.com/microsoft/go-crypto-openssl/commit/104fe7f6912788d2ad44602f77a0a0a62f1f259fARTICLE
pkg.go.dev/vuln/GO-2024-2660Advisory
vuln.go.dev/ID/GO-2024-2660.jsonARTICLE
access.redhat.com/security/cve/CVE-2024-9355REPORT
www.cve.org/CVERecord?id=CVE-2024-9355Advisory
nvd.nist.gov/vuln/detail/CVE-2024-9355Advisory
github.com/golang-fips/openssl/pull/198ARTICLE
access.redhat.com/security/cve/CVE-2024-34158REPORT
www.cve.org/CVERecord?id=CVE-2024-34158Advisory
nvd.nist.gov/vuln/detail/CVE-2024-34158Advisory
go.dev/cl/611240ARTICLE
go.dev/issue/69141ARTICLE
groups.google.com/g/golang-dev/c/S9POB9NCTdkARTICLE
pkg.go.dev/vuln/GO-2024-3107Advisory