Alerts This Week
Warning Icon 1 914
Alerts This Week
Warning Icon 1 914

Fedora 43 Pack Critical Issues - Memory Exhaustion, CVE-2025-58185

fedora
Calendar Grey November 29, 2025
Dist Fedora Esm H88
Addressing vulnerabilities in pack software on Fedora 43, including memory exhaustion and certificate validation.
bump to v0.38.2

Summary

pack is a CLI implementation of the Platform Interface Specification

for Cloud Native Buildpacks.

Update Information:

bump to v0.38.2

Topics%20covered

Topics Covered

security advisory fedora memory exhaustion CVE certificate validation pack

Change Log

* Fri Nov 21 2025 Lokesh Mandvekar - 0.38.2-1 - bump to v0.38.2 * Fri Oct 10 2025 Alejandro Sez - 0.32.0-9 - rebuild

References


[ 1 ] Bug #2408338 - CVE-2025-58189 pack: go crypto/tls ALPN negotiation error contains attacker controlled information [fedora-43] https://bugzilla.redhat.com/show_bug.cgi?id=2408338 [ 2 ] Bug #2409811 - CVE-2025-61723 pack: Quadratic complexity when parsing some invalid inputs in encoding/pem [fedora-43] https://bugzilla.redhat.com/show_bug.cgi?id=2409811 [ 3 ] Bug #2410761 - CVE-2025-58185 pack: Parsing DER payload can cause memory exhaustion in encoding/asn1 [fedora-43] https://bugzilla.redhat.com/show_bug.cgi?id=2410761 [ 4 ] Bug #2411657 - CVE-2025-58188 pack: Panic when validating certificates with DSA public keys in crypto/x509 [fedora-43] https://bugzilla.redhat.com/show_bug.cgi?id=2411657 [ 5 ] Bug #2412596 - CVE-2025-58183 pack: Unbounded allocation when parsing GNU sparse map [fedora-43] https://bugzilla.redhat.com/show_bug.cgi?id=2412596

Update Instructions

This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2025-20f7fd3e95' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label

Severity
critical
Lowest
Low
Medium
High
Critical

Name: pack
Product: Fedora 43
Version: 0.38.2
Release: 1.fc43
URL: https://github.com/buildpacks/pack
Summary: Convert code into runnable images

Topics%20covered

Topics Covered

security advisory fedora memory exhaustion CVE certificate validation pack

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here