Skip to content

Add CVE image tool to security updates documentation - #643

Open
pavolloffay wants to merge 2 commits into
konflux-ci:mainfrom
pavolloffay:patch-1
Open

Add CVE image tool to security updates documentation#643
pavolloffay wants to merge 2 commits into
konflux-ci:mainfrom
pavolloffay:patch-1

Conversation

@pavolloffay

@pavolloffay pavolloffay commented Aug 10, 2026

Copy link
Copy Markdown

Added information about a community tool for checking CVEs in images built on Konflux.

Add link to https://github.com/os-observability/konflux-opentelemetry/tree/main/tools/image-cve-check which we use for CVE investigation and mintmaker rpm.lock file checks.

When --lockfile is specified it checks if the package was updated in the lockfile and mentions it in the report.

Added information about a community tool for checking CVEs in images built on Konflux.
@pavolloffay
pavolloffay requested a review from a team as a code owner August 10, 2026 15:47
@qodo-app-for-konflux-ci

Copy link
Copy Markdown

PR Summary by Qodo

Document community CVE checker for Konflux-built images

📝 Documentation 🕐 Less than 5 minutes

Grey Divider

AI Description

• Add a link to the community image-cve-check tool for Konflux-built images.
• Describe using the tool to validate active CVEs and confirm RPM-based fixes.
Diagram

graph TD
  U(["User"]) --> MM["MintMaker security updates"] --> DB[("OSV CVE DB")]
  RH{{"Red Hat CVE data"}} --> DB
  U --> ICT{{"image-cve-check tool"}} --> IMG["Konflux-built images"] --> LF["RPM lockfile"]

  subgraph Legend
    direction LR
    _user(["Actor"]) ~~~ _svc["Service/Doc topic"] ~~~ _db[("Database")] ~~~ _ext{{"External tool/source"}}
  end
Loading
High-Level Assessment

The following are alternative approaches to this PR:

1. Add a brief disclaimer + usage example
  • ➕ Sets expectations that the tool is community-maintained (support/SLAs).
  • ➕ Makes the doc immediately actionable with a minimal command/example workflow.
  • ➖ Slightly longer doc section to maintain if the tool interface changes.
2. Link from a dedicated “Verification tools” section
  • ➕ Creates a clear home for future related tooling links without cluttering this page.
  • ➖ More restructuring for a small change; may be overkill for a single link.

Recommendation: The current approach (adding a short mention + link) is appropriate for the scope. If you want to improve reader outcomes, consider adding one sentence clarifying it’s a community tool (not MintMaker/Red Hat supported) and optionally a tiny usage example to show how to validate a fixed CVE against the lockfile.

Files changed (1) +3 / -0

Documentation (1) +3 / -0
security-updates.adocAdd link to community image CVE checking tool +3/-0

Add link to community image CVE checking tool

• Extends the security updates documentation with a reference to the community-maintained 'image-cve-check' tool. Notes that it can be used to check active CVEs in Konflux-built images and validate whether updated RPMs in the lockfile remediate a CVE.

modules/mintmaker/pages/security-updates.adoc

@qodo-app-for-konflux-ci

qodo-app-for-konflux-ci Bot commented Aug 10, 2026

Copy link
Copy Markdown

Code Review by Qodo

🐞 Bugs (0) 📘 Rule violations (0) 📎 Requirement gaps (0) 🎨 UX issues (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

Grey Divider


Informational

1. Duplicate word in docs ✓ Resolved 🐞 Bug ≡ Correctness
Description
The newly added sentence contains a duplicated word ("in in"), which is a visible typo and makes the
security-updates guidance harder to read. The same sentence also introduces inconsistent terminology
on the page ("lock file" vs earlier "lockfiles"), which can confuse readers.
Code

modules/mintmaker/pages/security-updates.adoc[18]

+for active CVEs in images built on Konflux and verify if a CVE was fixed by the updated RPM package in in the lock file.
Relevance

●●● Strong

Visible doc typo/terminology inconsistency; similar doc wording/style fixes were previously
accepted.

PR-#601
PR-#519

ⓘ Recommendations generated based on similar findings in past PRs

Evidence
The added line includes the duplicated "in in". Earlier in the same page, the documentation uses
"RPM lockfiles", demonstrating the inconsistency introduced by the new phrasing.

modules/mintmaker/pages/security-updates.adoc[17-18]
modules/mintmaker/pages/security-updates.adoc[4-6]

Agent prompt
The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The new documentation sentence contains a duplicated word ("in in") and uses inconsistent terminology ("lock file" vs earlier "lockfiles") in the same page.

## Issue Context
This is in the newly added paragraph referencing the `image-cve-check` community tool.

## Fix Focus Areas
- modules/mintmaker/pages/security-updates.adoc[17-18]

## Suggested change
Change:
- "...updated RPM package in in the lock file."
To:
- "...updated RPM package in the lockfile." (or "...in the lock file." if that’s the preferred term elsewhere)

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools


Grey Divider

Tip of the day
💡 Did you know, you can reply 'qodo' on any finding to push back, ask questions, or dig deeper

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

Grey Divider

Qodo Logo

Comment thread modules/mintmaker/pages/security-updates.adoc Outdated
@pavolloffay

Copy link
Copy Markdown
Author

This is how the output looks like in the .md format

# CVE Report

- **Image:** registry.redhat.io/rhosdt/opentelemetry-collector-rhel9:rhosdt-3.10.1
- **Date:** 2026-08-10

## Open RPM CVEs

### attr 2.5.1-3.el9 (rpms: libattr) (opentelemetry-collector-rhel9)

| CVE | CVSS | Severity | Date | Summary | Link |
|-----|------|----------|------|---------|------|
| CVE-2026-54371 | 6.3 | Moderate | 2026-06-29 | attr: attr: Symlink Traversal Privilege Escalation via getfattr and setfattr | [Details](https://access.redhat.com/security/cve/CVE-2026-54371) |

### bzip2 1.0.8-11.el9 (rpms: bzip2-libs) (opentelemetry-collector-rhel9)

| CVE | CVSS | Severity | Date | Summary | Link |
|-----|------|----------|------|---------|------|
| CVE-2026-42250 | 5.0 | Moderate | 2026-05-28 | bzip2: bzip2: Denial of Service in bzip2recover via a specially crafted file | [Details](https://access.redhat.com/security/cve/CVE-2026-42250) |

### coreutils 8.32-41.el9_8 (rpms: coreutils-single) (opentelemetry-collector-rhel9)

| CVE | CVSS | Severity | Date | Summary | Link |
|-----|------|----------|------|---------|------|
| CVE-2026-56391 | 6.1 | Moderate | 2026-07-24 | coreutils: GNU coreutils uniq: Denial of Service and information disclosure via out-of-bounds read with multibyte input | [Details](https://access.redhat.com/security/cve/CVE-2026-56391) |
| CVE-2026-56392 | 4.4 | Moderate | 2026-07-24 | coreutils: GNU coreutils unexpand: Denial of Service via crafted tab stop values | [Details](https://access.redhat.com/security/cve/CVE-2026-56392) |

### dbus-broker 28-7.el9 (opentelemetry-collector-rhel9)

| CVE | CVSS | Severity | Date | Summary | Link |
|-----|------|----------|------|---------|------|
| CVE-2026-16730 | 5.5 | Moderate | 2026-07-23 | dbus-broker: dbus-broker: session bus denial of service via EMFILE during peer setup | [Details](https://access.redhat.com/security/cve/CVE-2026-16730) |

### expat 2.5.0-6.el9_8.1 (opentelemetry-collector-rhel9)

| CVE | CVSS | Severity | Date | Summary | Link |
|-----|------|----------|------|---------|------|
| CVE-2026-56407 | 6.9 | Moderate | 2026-06-21 | libexpat: libexpat: Arbitrary code execution due to integer overflow | [Details](https://access.redhat.com/security/cve/CVE-2026-56407) |
| CVE-2026-56406 | 6.9 | Moderate | 2026-06-21 | libexpat: libexpat: Arbitrary code execution via integer overflow in XML_ParseBuffer | [Details](https://access.redhat.com/security/cve/CVE-2026-56406) |
| CVE-2026-56404 | 6.9 | Moderate | 2026-06-21 | libexpat: libexpat: Arbitrary Code Execution via integer overflow in addBinding | [Details](https://access.redhat.com/security/cve/CVE-2026-56404) |
| CVE-2026-56403 | 6.9 | Moderate | 2026-06-21 | libexpat: libexpat: Arbitrary code execution due to integer overflow in storeAtts | [Details](https://access.redhat.com/security/cve/CVE-2026-56403) |
| CVE-2026-56132 | 6.9 | Moderate | 2026-06-19 | expat: libexpat: Arbitrary Code Execution via Heap-based Buffer Overflow | [Details](https://access.redhat.com/security/cve/CVE-2026-56132) |
| CVE-2026-32776 | 6.2 | Moderate | 2026-03-16 | libexpat: libexpat: Denial of Service due to NULL pointer dereference | [Details](https://access.redhat.com/security/cve/CVE-2026-32776) |
| CVE-2026-32778 | 5.1 | Moderate | 2026-03-16 | libexpat: libexpat: Denial of Service via NULL pointer dereference after out-of-memory condition | [Details](https://access.redhat.com/security/cve/CVE-2026-32778) |
| CVE-2026-56412 | 4.9 | Moderate | 2026-06-21 | libexpat: libexpat: Use-after-free vulnerability due to improper handling of XML CDATA sections | [Details](https://access.redhat.com/security/cve/CVE-2026-56412) |
| CVE-2026-56405 | 4.9 | Moderate | 2026-06-21 | libexpat: libexpat: Information disclosure and arbitrary code execution via integer overflow | [Details](https://access.redhat.com/security/cve/CVE-2026-56405) |
| CVE-2026-50219 | 4.9 | Moderate | 2026-06-04 | expat: libexpat: Use-after-free vulnerability due to improper handler call depth tracking | [Details](https://access.redhat.com/security/cve/CVE-2026-50219) |
| CVE-2026-56131 | 4.5 | Moderate | 2026-06-19 | libexpat: libexpat: Use-after-free vulnerability due to insufficient handler call depth tracking | [Details](https://access.redhat.com/security/cve/CVE-2026-56131) |
| CVE-2026-32777 | 4.0 | Moderate | 2026-03-16 | libexpat: libexpat: Denial of Service via infinite loop in DTD content parsing | [Details](https://access.redhat.com/security/cve/CVE-2026-32777) |
| CVE-2026-41080 | 3.7 | Low | 2026-04-16 | libexpat: expat: libexpat: Denial of Service via hash flooding with crafted XML | [Details](https://access.redhat.com/security/cve/CVE-2026-41080) |
| CVE-2026-24515 | 2.9 | Low | 2026-01-23 | libexpat: libexpat null pointer dereference | [Details](https://access.redhat.com/security/cve/CVE-2026-24515) |
| CVE-2025-66382 | 2.9 | Low | 2025-11-28 | libexpat: libexpat: Denial of service via crafted file processing | [Details](https://access.redhat.com/security/cve/CVE-2025-66382) |

### gcc 11.5.0-14.el9 (rpms: libgcc) (opentelemetry-collector-rhel9)

| CVE | CVSS | Severity | Date | Summary | Link |
|-----|------|----------|------|---------|------|
| CVE-2022-27943 | 5.5 | Low | 2022-03-26 | binutils: libiberty/rust-demangle.c in GNU GCC 11.2 allows stack exhaustion in demangle_const | [Details](https://access.redhat.com/security/cve/CVE-2022-27943) |
| CVE-2021-46195 | 3.3 | Low | 2021-01-29 | gcc: uncontrolled recursion in libiberty/rust-demangle.c | [Details](https://access.redhat.com/security/cve/CVE-2021-46195) |

### gzip 1.12-1.el9 (opentelemetry-collector-rhel9)

| CVE | CVSS | Severity | Date | Summary | Link |
|-----|------|----------|------|---------|------|
| CVE-2026-41991 | 6.0 | Moderate | 2026-06-29 | gzip: gzip: Arbitrary file overwrite via insecure temporary file handling in gzexe utility | [Details](https://access.redhat.com/security/cve/CVE-2026-41991) |

### libgcrypt 1.10.0-11.el9 (opentelemetry-collector-rhel9)

| CVE | CVSS | Severity | Date | Summary | Link |
|-----|------|----------|------|---------|------|
| CVE-2026-41989 | 7.5 | Moderate | 2026-04-23 | Libgcrypt: Libgcrypt: Denial of Service and buffer overflow via crafted ECDH ciphertext | [Details](https://access.redhat.com/security/cve/CVE-2026-41989) |
| CVE-2026-41990 | 3.3 | Low | 2026-04-23 | Libgcrypt: Libgcrypt: Denial of Service or data integrity issues from missing bounds check during Dilithium signing. | [Details](https://access.redhat.com/security/cve/CVE-2026-41990) |

### ncurses 6.2-12.20210508.el9 (rpms: ncurses-base, ncurses-libs) (opentelemetry-collector-rhel9)

| CVE | CVSS | Severity | Date | Summary | Link |
|-----|------|----------|------|---------|------|
| CVE-2023-50495 | 6.5 | Low | 2023-12-12 | ncurses: segmentation fault via _nc_wrap_entry() | [Details](https://access.redhat.com/security/cve/CVE-2023-50495) |

### openssl 1:3.5.5-6.el9_8 (rpms: openssl, openssl-libs) (opentelemetry-collector-rhel9)

| CVE | CVSS | Severity | Date | Summary | Link |
|-----|------|----------|------|---------|------|
| CVE-2026-2673 | 6.5 | Moderate | 2026-03-13 | openssl: OpenSSL TLS 1.3 server may choose unexpected key agreement group | [Details](https://access.redhat.com/security/cve/CVE-2026-2673) |
| CVE-2026-42765 | 5.9 | Low | 2026-06-09 | openssl: NULL Dereference in Certificate Verification with OCSP Checking | [Details](https://access.redhat.com/security/cve/CVE-2026-42765) |
| CVE-2026-28389 | 5.9 | Low | 2026-04-07 | openssl: OpenSSL: Denial of Service vulnerability in CMS processing | [Details](https://access.redhat.com/security/cve/CVE-2026-28389) |
| CVE-2026-28388 | 5.9 | Low | 2026-04-07 | openssl: OpenSSL: Denial of Service due to NULL pointer dereference in delta CRL processing | [Details](https://access.redhat.com/security/cve/CVE-2026-28388) |
| CVE-2024-41996 | 5.9 | Low | 2024-08-26 | openssl: remote attackers (from the client side) to trigger unnecessarily expensive server-side DHE modular-exponentiation calculations | [Details](https://access.redhat.com/security/cve/CVE-2024-41996) |
| CVE-2026-31789 | 5.8 | Low | 2026-04-07 | openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing | [Details](https://access.redhat.com/security/cve/CVE-2026-31789) |
| CVE-2024-13176 | 4.7 | Low | 2025-01-20 | openssl: Timing side-channel in ECDSA signature computation | [Details](https://access.redhat.com/security/cve/CVE-2024-13176) |
| CVE-2026-28387 | 3.7 | Low | 2026-04-07 | openssl: OpenSSL: Arbitrary code execution due to use-after-free in DANE TLSA authentication | [Details](https://access.redhat.com/security/cve/CVE-2026-28387) |
| CVE-2025-9232 | 3.1 | Low | 2025-09-30 | openssl: Out-of-bounds read in HTTP client no_proxy handling | [Details](https://access.redhat.com/security/cve/CVE-2025-9232) |

### openssl-fips-provider 3.0.7-11.el9_8 (rpms: openssl-fips-provider, openssl-fips-provider-so) (opentelemetry-collector-rhel9)

| CVE | CVSS | Severity | Date | Summary | Link |
|-----|------|----------|------|---------|------|
| CVE-2026-2673 | 6.5 | Moderate | 2026-03-13 | openssl: OpenSSL TLS 1.3 server may choose unexpected key agreement group | [Details](https://access.redhat.com/security/cve/CVE-2026-2673) |

### p11-kit 0.26.2-1.el9 (rpms: p11-kit, p11-kit-trust) (opentelemetry-collector-rhel9)

| CVE | CVSS | Severity | Date | Summary | Link |
|-----|------|----------|------|---------|------|
| CVE-2026-13757 | 6.2 | Moderate | 2026-06-23 | p11-kit: Stack exhaustion via unbounded recursion in RPC attribute parsing | [Details](https://access.redhat.com/security/cve/CVE-2026-13757) |

### pam 1.5.1-28.el9 (opentelemetry-collector-rhel9)

| CVE | CVSS | Severity | Date | Summary | Link |
|-----|------|----------|------|---------|------|
| CVE-2026-12610 | 6.4 | Moderate | 2026-06-09 | sssd: Use-after-free crash in SSSD' 'sssd_pam' process | [Details](https://access.redhat.com/security/cve/CVE-2026-12610) |
| CVE-2026-54411 | 4.8 | Moderate | 2026-06-14 | linux-pam: Plaintext password recovery via timing discrepancy in pam_userdb module | [Details](https://access.redhat.com/security/cve/CVE-2026-54411) |

### pcre2 10.40-6.el9 (rpms: pcre2, pcre2-syntax) (opentelemetry-collector-rhel9)

| CVE | CVSS | Severity | Date | Summary | Link |
|-----|------|----------|------|---------|------|
| CVE-2022-41409 | 5.3 | Low | 2023-07-18 | pcre2: negative repeat value in a pcre2test subject line leads to inifinite loop | [Details](https://access.redhat.com/security/cve/CVE-2022-41409) |

### sed 4.8-10.el9 (opentelemetry-collector-rhel9)

| CVE | CVSS | Severity | Date | Summary | Link |
|-----|------|----------|------|---------|------|
| CVE-2026-5958 | 6.3 | Moderate | 2026-04-19 | sed: GNU sed TOCTOU race condition | [Details](https://access.redhat.com/security/cve/CVE-2026-5958) |

### systemd 252-67.el9_8.4 (rpms: systemd, systemd-libs, systemd-pam, systemd-rpm-macros) (opentelemetry-collector-rhel9)

| CVE | CVSS | Severity | Date | Summary | Link |
|-----|------|----------|------|---------|------|
| CVE-2026-4105 | 6.7 | Moderate | 2026-03-13 | systemd: systemd: Privilege escalation via improper access control in RegisterMachine D-Bus method | [Details](https://access.redhat.com/security/cve/CVE-2026-4105) |

### util-linux 2.37.4-25.el9 (rpms: libblkid, libfdisk, libmount, libsmartcols, libuuid, util-linux, util-linux-core) (opentelemetry-collector-rhel9)

| CVE | CVSS | Severity | Date | Summary | Link |
|-----|------|----------|------|---------|------|
| CVE-2026-13595 | 6.8 | Moderate | 2026-05-07 | util-linux: util-linux: heap use-after-free in libblkid nested partition probing | [Details](https://access.redhat.com/security/cve/CVE-2026-13595) |
| CVE-2026-27456 | 4.7 | Moderate | 2026-04-03 | util-linux: TOCTOU in the mount program when setting up loop devices | [Details](https://access.redhat.com/security/cve/CVE-2026-27456) |

### xz 5.2.5-8.el9_0 (rpms: xz-libs) (opentelemetry-collector-rhel9)

| CVE | CVSS | Severity | Date | Summary | Link |
|-----|------|----------|------|---------|------|
| CVE-2026-34743 | 5.3 | Moderate | 2026-04-02 | xz: XZ Utils: Denial of Service via buffer overflow in index decoding | [Details](https://access.redhat.com/security/cve/CVE-2026-34743) |

### zlib 1.2.11-40.el9 (opentelemetry-collector-rhel9)

| CVE | CVSS | Severity | Date | Summary | Link |
|-----|------|----------|------|---------|------|
| CVE-2026-27171 | 3.3 | Low | 2026-02-18 | zlib: zlib: Denial of Service via infinite loop in CRC32 combine functions | [Details](https://access.redhat.com/security/cve/CVE-2026-27171) |

## Open Go module CVEs

### github.com/aws/aws-sdk-go v1.55.8

| CVE | CVSS | Severity | Date | Summary | Link |
|-----|------|----------|------|---------|------|
| CVE-2020-8911 | 5.6 | Moderate | 2022-02-11 | CBC padding oracle issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go | [Details](https://access.redhat.com/security/cve/CVE-2020-8911) |
| CVE-2020-8912 | 2.5 | Low | 2024-12-12 | In-band key negotiation issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go | [Details](https://access.redhat.com/security/cve/CVE-2020-8912) |

### github.com/klauspost/compress v1.18.6 (fix: 1.18.7)

| CVE | CVSS | Severity | Date | Summary | Link |
|-----|------|----------|------|---------|------|
| GO-2026-5841 | N/A | Unknown | 2026-07-27 | OOB read in github.com/klauspost/compress/s2 | [Details](https://osv.dev/vulnerability/GO-2026-5841) |

### go.opentelemetry.io/otel v1.43.0 (fix: 1.44.0)

| CVE | CVSS | Severity | Date | Summary | Link |
|-----|------|----------|------|---------|------|
| CVE-2026-41178 | N/A | Unknown | 2026-07-24 | Opentelemetry-go's baggage parsing no longer caps raw header length in go.opentelemetry.io/otel | [Details](https://access.redhat.com/security/cve/CVE-2026-41178) |

### golang.org/x/crypto v0.54.0

| CVE | CVSS | Severity | Date | Summary | Link |
|-----|------|----------|------|---------|------|
| GO-2026-5932 | N/A | Unknown | 2026-07-07 | The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues | [Details](https://osv.dev/vulnerability/GO-2026-5932) |

### google.golang.org/grpc v1.81.0 (fix: 1.82.1)

| CVE | CVSS | Severity | Date | Summary | Link |
|-----|------|----------|------|---------|------|
| GHSA-hrxh-6v49-42gf | N/A | Unknown | 2026-07-21 | gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities | [Details](https://osv.dev/vulnerability/GHSA-hrxh-6v49-42gf) |
| GO-2026-6061 | N/A | Unknown | 2026-07-27 | Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in google.golang.org/grpc | [Details](https://osv.dev/vulnerability/GO-2026-6061) |

## Summary

- **RPM packages with CVEs:** 19
- **RPM CVEs:** 46
- **RPM Critical/Important:** 0
- **Go modules with CVEs:** 5
- **Go module CVEs:** 7
- **Go module Critical/Important:** 0


@rh-rsaar

Copy link
Copy Markdown

This is the first time I'm hearing about such tool. How does it relate to MintMaker? Wouldn't this be more related to build/release time?

@pavolloffay

Copy link
Copy Markdown
Author

With the --lockfile flag it can be used to generate a report outlining which CVEs are fixed by the mintmaker PR to update the lockfile.

The tool can also be used before the release to outline which CVEs were fixed since the previous release.

@rh-rsaar

Copy link
Copy Markdown

Does it show different information than the security PRs MintMaker already generates?

@pavolloffay

Copy link
Copy Markdown
Author

Mintmaker/renovate shows which CVE(s) are fixed in a given PR. This tool creates an overview of:

  • CVEs affecting an image
  • CVEs fixed in rpm.lock file - usually done by multiple mintmaker PRs
  • CVEs fixed by a newly built image (e.g. users can confirm before the release which CVEs are fixed)

@pavolloffay

Copy link
Copy Markdown
Author

Also the mintmaker sometimes does not show any CVEs fixed in the security PR e.g. os-observability/konflux-opentelemetry#950. Also it shows only high,moderate. The tool in this PR can show all CVEs.

@pavolloffay

Copy link
Copy Markdown
Author

Also the tool can show medium and low vulnerabilities which I don't think are considered by mintmaker.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants