Bump the oc-mirror-v1-security-updates group across 1 directory with 10 updates #1483
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
Repository: openshift/oc-mirror
Length of output: 1403
🏁 Script executed:
Repository: openshift/oc-mirror
Length of output: 500
🏁 Script executed:
Repository: openshift/oc-mirror
Length of output: 149
🌐 Web query:
Moby github.com/docker/docker v27.5.0 CVE OSV vulnerabilities💡 Result:
Moby version v27.5.0 is known to be affected by several security vulnerabilities discovered or disclosed after its release. Because version v27.5.0 was released prior to these findings, users are generally advised to update to version 29.5.1 or newer (or the relevant patched versions provided by their distribution) to mitigate these risks [1][2][3]. Key vulnerabilities affecting versions including v27.5.0 include: CVE-2026-41568 (GHSA-vp62-88p7-qqf5): A race condition during docker cp mount setup allows a malicious container to create empty files or directories at arbitrary absolute paths on the host filesystem [1][2]. This is patched in Docker Engine version 29.5.1 [2]. CVE-2026-41567 (GHSA-x86f-5xw2-fm2r): A vulnerability where the PUT /containers/{id}/archive API endpoint may execute container binaries on the host with daemon (root) privileges, particularly when handling compressed archives (e.g., xz, gzip) that trigger the use of external system binaries [3]. CVE-2024-29018: A vulnerability where external DNS requests from containers on 'internal' networks could potentially lead to data exfiltration [4][5][6]. Patches for this were included in later releases, such as 27.5.1 [5][6]. General Guidance: To maintain a secure environment, it is recommended to review the official Docker security announcements and your OS vendor's security advisories [7]. Because Moby/Docker frequently releases security patches, you should check for the latest stable version and apply updates promptly [7]. You can also verify specific vulnerability status for your environment via the Open Source Vulnerabilities (OSV) database or the GitHub Advisory Database using the provided CVE and GHSA identifiers [8][9][4].
Citations:
🌐 Web query:
github.com/docker/docker security advisories July 2026💡 Result:
As of July 31, 2026, there are no specific security advisories published directly in the moby/moby repository for the month of July 2026. Security advisories for the Moby/Docker project are tracked within the moby/moby GitHub repository's security advisory section [1]. While no advisories were published for Moby in July 2026, relevant recent activity in the broader container ecosystem includes: 1. Moby/BuildKit: A security advisory (GHSA-32pv-7hq5-qhwq / CVE-2026-15791) was published on July 16, 2026, affecting BuildKit (versions <= v0.31.1). This vulnerability involves a path traversal issue in the low-level build API that could be exploited to remove the contents of the host's /tmp directory. It was fixed in BuildKit v0.31.2 [2]. 2. General Ecosystem: Third-party security reporting has noted other vulnerabilities related to Docker products in July 2026, such as those listed by external threat intelligence sources (e.g., CVE-2026-52833, CVE-2026-54540, CVE-2026-34150) [3], and package maintainers (such as SUSE) have issued updates for Docker incorporating various fixes [4]. Users should refer to the official Docker Security Announcements page and the moby/moby security advisory repository for the most authoritative and up-to-date information regarding their specific deployments [1][5].
Citations:
Resolve Moby vulnerabilities in the indirect Docker dependency.
The pinned version
github.com/docker/docker v27.5.0+incompatibleis affected by multiple high-severity vulnerabilities:docker cpallows malicious containers to create arbitrary files or directories on the host./containers/{id}/archiveAPI endpoint may execute container binaries on the host with daemon privileges.Patches exist in version 29.5.1 and later. Because this is an indirect dependency, identify and update the direct dependency that pulls
docker/docker v27.5.0+incompatible, then rungo mod tidy. If the Docker packages are not reachable from the production binary in thev1module, document the exception before merging.🤖 Prompt for AI Agents
Sources: Path instructions, Learnings, Linters/SAST tools