chore(deps): refresh rpm lockfiles [SECURITY]

[red-hat-konflux]

This PR contains the following updates:

File rpms.in.yaml:

Package	Change
vim-filesystem	2:8.0.1763-19.el8_6.4 -> 2:8.0.1763-21.el8_10
binutils	2.30-125.el8_10 -> 2.30-127.el8_10
curl	7.61.1-34.el8_10.3 -> 7.61.1-34.el8_10.8
file	5.33-26.el8 -> 5.33-27.el8_10
file-libs	5.33-26.el8 -> 5.33-27.el8_10
gnutls	3.6.16-8.el8_10.3 -> 3.6.16-8.el8_10.4
grub2-common	1:2.02-167.el8_10 -> 1:2.02-169.el8_10
grub2-tools	1:2.02-167.el8_10 -> 1:2.02-169.el8_10
grub2-tools-minimal	1:2.02-167.el8_10 -> 1:2.02-169.el8_10
kernel-headers	4.18.0-553.75.1.el8_10 -> 4.18.0-553.81.1.el8_10
libcom_err	1.45.6-6.el8_10 -> 1.45.6-7.el8_10
libcom_err-devel	1.45.6-6.el8_10 -> 1.45.6-7.el8_10
libcurl	7.61.1-34.el8_10.3 -> 7.61.1-34.el8_10.8
libcurl-devel	7.61.1-34.el8_10.3 -> 7.61.1-34.el8_10.8
libssh	0.9.6-14.el8 -> 0.9.6-15.el8_10
libssh-config	0.9.6-14.el8 -> 0.9.6-15.el8_10
openssh	8.0p1-25.el8_10 -> 8.0p1-26.el8_10
openssh-clients	8.0p1-25.el8_10 -> 8.0p1-26.el8_10
s390utils-base	2:2.29.0-3.el8_10.1 -> 2:2.29.0-3.el8_10.3
s390utils-core	2:2.29.0-3.el8_10.1 -> 2:2.29.0-3.el8_10.3
s390utils-se-data	2:2.29.0-3.el8_10.1 -> 2:2.29.0-3.el8_10.3

---

gnutls: Vulnerability in GnuTLS otherName SAN export

CVE-2025-32988

More information

Details

A flaw was found in GnuTLS. A double-free vulnerability exists in GnuTLS due to incorrect ownership handling in the export logic of Subject Alternative Name (SAN) entries containing an otherName. If the type-id OID is invalid or malformed, GnuTLS will call asn1_delete_structure() on an ASN.1 node it does not own, leading to a double-free condition when the parent function or caller later attempts to free the same structure.

This vulnerability can be triggered using only public GnuTLS APIs and may result in denial of service or memory corruption, depending on allocator behavior.

Severity

Moderate

References

• https://access.redhat.com/security/cve/CVE-2025-32988
• https://bugzilla.redhat.com/show_bug.cgi?id=2359622
• https://www.cve.org/CVERecord?id=CVE-2025-32988
• https://nvd.nist.gov/vuln/detail/CVE-2025-32988

---

gnutls: NULL pointer dereference in _gnutls_figure_common_ciphersuite()

CVE-2025-6395

More information

Details

A NULL pointer dereference flaw was found in the GnuTLS software in _gnutls_figure_common_ciphersuite().

Severity

Moderate

References

• https://access.redhat.com/security/cve/CVE-2025-6395
• https://bugzilla.redhat.com/show_bug.cgi?id=2376755
• https://www.cve.org/CVERecord?id=CVE-2025-6395
• https://nvd.nist.gov/vuln/detail/CVE-2025-6395

---

gnutls: Vulnerability in GnuTLS certtool template parsing

CVE-2025-32990

More information

Details

A heap-buffer-overflow (off-by-one) flaw was found in the GnuTLS software in the template parsing logic within the certtool utility. When it reads certain settings from a template file, it allows an attacker to cause an out-of-bounds (OOB) NULL pointer write, resulting in memory corruption and a denial-of-service (DoS) that could potentially crash the system.

Severity

Moderate

References

• https://access.redhat.com/security/cve/CVE-2025-32990
• https://bugzilla.redhat.com/show_bug.cgi?id=2359620
• https://www.cve.org/CVERecord?id=CVE-2025-32990
• https://nvd.nist.gov/vuln/detail/CVE-2025-32990

---

libssh: out-of-bounds read in sftp_handle()

CVE-2025-5318

More information

Details

A flaw was found in the libssh library in versions less than 0.11.2. An out-of-bounds read can be triggered in the sftp_handle function due to an incorrect comparison check that permits the function to access memory beyond the valid handle list and to return an invalid pointer, which is used in further processing. This vulnerability allows an authenticated remote attacker to potentially read unintended memory regions, exposing sensitive information or affect service behavior.

Severity

Moderate

References

• https://access.redhat.com/security/cve/CVE-2025-5318
• https://bugzilla.redhat.com/show_bug.cgi?id=2369131
• https://www.cve.org/CVERecord?id=CVE-2025-5318
• https://nvd.nist.gov/vuln/detail/CVE-2025-5318
• https://www.libssh.org/security/advisories/CVE-2025-5318.txt

---

openssh: Machine-in-the-middle attack if VerifyHostKeyDNS is enabled

CVE-2025-26465

More information

Details

A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key. For an attack to be considered successful, the attacker needs to manage to exhaust the client's memory resource first, turning the attack complexity high.

Severity

Moderate

References

• https://access.redhat.com/security/cve/CVE-2025-26465
• https://bugzilla.redhat.com/show_bug.cgi?id=2344780
• https://www.cve.org/CVERecord?id=CVE-2025-26465
• https://nvd.nist.gov/vuln/detail/CVE-2025-26465
• https://access.redhat.com/solutions/7109879
• https://seclists.org/oss-sec/2025/q1/144

🔧 This Pull Request updates lock files to use the latest dependency versions.

---

Configuration

📅 Schedule: Branch creation - "" in timezone Etc/UTC, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

This PR has been generated by MintMaker (powered by Renovate Bot).

[rhacs-bot]

Auto-approved by automation.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 27.60%. Comparing base (eb2bc9e) to head (562cf7b).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #2561   +/-   ##
=======================================
  Coverage   27.60%   27.60%           
=======================================
  Files          95       95           
  Lines        5422     5422           
  Branches     2523     2523           
=======================================
  Hits         1497     1497           
  Misses       3213     3213           
  Partials      712      712           

Flag	Coverage Δ
collector-unit-tests	27.60% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[msugakov]

/retest collector-on-push