chore(deps): refresh rpm lockfiles [SECURITY]

[red-hat-konflux]

This PR contains the following updates:

File rpms.in.yaml:

Package	Change
clang	19.1.7-2.module+el8.10.0+23045+e1f8e80e -> 20.1.8-2.module+el8.10.0+23372+3f2ea6fa
clang-libs	19.1.7-2.module+el8.10.0+23045+e1f8e80e -> 20.1.8-2.module+el8.10.0+23372+3f2ea6fa
clang-resource-filesystem	19.1.7-2.module+el8.10.0+23045+e1f8e80e -> 20.1.8-2.module+el8.10.0+23372+3f2ea6fa
compiler-rt	19.1.7-2.module+el8.10.0+23045+e1f8e80e -> 20.1.8-2.module+el8.10.0+23372+3f2ea6fa
gcc-toolset-14-gcc	14.2.1-7.1.el8_10 -> 14.2.1-10.el8_10
gcc-toolset-14-gcc-c++	14.2.1-7.1.el8_10 -> 14.2.1-10.el8_10
gcc-toolset-14-libstdc++-devel	14.2.1-7.1.el8_10 -> 14.2.1-10.el8_10
gcc-toolset-14-runtime	14.0-0.el8_10 -> 14.0-1.el8_10
libomp	19.1.7-2.module+el8.10.0+23045+e1f8e80e -> 20.1.8-2.module+el8.10.0+23372+3f2ea6fa
libomp-devel	19.1.7-2.module+el8.10.0+23045+e1f8e80e -> 20.1.8-2.module+el8.10.0+23372+3f2ea6fa
llvm	19.1.7-2.module+el8.10.0+23045+e1f8e80e -> 20.1.8-2.module+el8.10.0+23372+3f2ea6fa
llvm-libs	19.1.7-2.module+el8.10.0+23045+e1f8e80e -> 20.1.8-2.module+el8.10.0+23372+3f2ea6fa
ca-certificates	2024.2.69_v8.0.303-80.0.el8_10 -> 2025.2.80_v9.0.304-80.2.el8_10
expat	2.2.5-17.el8_10 -> 2.5.0-1.el8_10
glib2	2.56.4-166.el8_10 -> 2.56.4-167.el8_10
kernel-headers	4.18.0-553.79.1.el8_10 -> 4.18.0-553.85.1.el8_10
libssh	0.9.6-14.el8 -> 0.9.6-16.el8_10
libssh-config	0.9.6-14.el8 -> 0.9.6-16.el8_10
systemd	239-82.el8_10.5 -> 239-82.el8_10.8
systemd-libs	239-82.el8_10.5 -> 239-82.el8_10.8
systemd-pam	239-82.el8_10.5 -> 239-82.el8_10.8
systemd-udev	239-82.el8_10.5 -> 239-82.el8_10.8

---

expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing

CVE-2025-59375

More information

Details

A memory amplification vulnerability in libexpat allows attackers to trigger excessive dynamic memory allocations by submitting specially crafted XML input. A small input (~250 KiB) can cause the parser to allocate hundreds of megabytes, leading to denial-of-service (DoS) through memory exhaustion.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2025-59375
• https://bugzilla.redhat.com/show_bug.cgi?id=2395108
• https://www.cve.org/CVERecord?id=CVE-2025-59375
• https://nvd.nist.gov/vuln/detail/CVE-2025-59375
• https://github.com/libexpat/libexpat/blob/676a4c531ec768732fac215da9730b5f50fbd2bf/expat/Changes#L45-L74
• https://github.com/libexpat/libexpat/issues/1018
• https://github.com/libexpat/libexpat/pull/1034
• https://issues.oss-fuzz.com/issues/439133977

---

libexpat: expat: Improper Restriction of XML Entity Expansion Depth in libexpat

CVE-2024-8176

More information

Details

A stack overflow vulnerability exists in the libexpat library due to the way it handles recursive entity expansion in XML documents. When parsing an XML document with deeply nested entity references, libexpat can be forced to recurse indefinitely, exhausting the stack space and causing a crash. This issue could lead to denial of service (DoS) or, in some cases, exploitable memory corruption, depending on the environment and library usage.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2024-8176
• https://bugzilla.redhat.com/show_bug.cgi?id=2310137
• https://www.cve.org/CVERecord?id=CVE-2024-8176
• https://nvd.nist.gov/vuln/detail/CVE-2024-8176
• https://github.com/libexpat/libexpat/issues/893

---

expat: parsing large tokens can trigger a denial of service

CVE-2023-52425

More information

Details

A flaw was found in Expat (libexpat). When parsing a large token that requires multiple buffer fills to complete, Expat has to re-parse the token from start numerous times. This process may trigger excessive resource consumption, leading to a denial of service.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2023-52425
• https://bugzilla.redhat.com/show_bug.cgi?id=2262877
• https://www.cve.org/CVERecord?id=CVE-2023-52425
• https://nvd.nist.gov/vuln/detail/CVE-2023-52425

---

expat: internal entity expansion

CVE-2013-0340

More information

Details

expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2013-0340
• https://bugzilla.redhat.com/show_bug.cgi?id=1000109
• https://www.cve.org/CVERecord?id=CVE-2013-0340
• https://nvd.nist.gov/vuln/detail/CVE-2013-0340

---

libssh: Incorrect Return Code Handling in ssh_kdf() in libssh

CVE-2025-5372

More information

Details

A flaw was found in libssh versions built with OpenSSL versions older than 3.0, specifically in the ssh_kdf() function responsible for key derivation. Due to inconsistent interpretation of return values where OpenSSL uses 0 to indicate failure and libssh uses 0 for success—the function may mistakenly return a success status even when key derivation fails. This results in uninitialized cryptographic key buffers being used in subsequent communication, potentially compromising SSH sessions' confidentiality, integrity, and availability.

Severity

Moderate

References

• https://access.redhat.com/security/cve/CVE-2025-5372
• https://bugzilla.redhat.com/show_bug.cgi?id=2369388
• https://www.cve.org/CVERecord?id=CVE-2025-5372
• https://nvd.nist.gov/vuln/detail/CVE-2025-5372

---

libssh: out-of-bounds read in sftp_handle()

CVE-2025-5318

More information

Details

A flaw was found in the libssh library in versions less than 0.11.2. An out-of-bounds read can be triggered in the sftp_handle function due to an incorrect comparison check that permits the function to access memory beyond the valid handle list and to return an invalid pointer, which is used in further processing. This vulnerability allows an authenticated remote attacker to potentially read unintended memory regions, exposing sensitive information or affect service behavior.

Severity

Moderate

References

• https://access.redhat.com/security/cve/CVE-2025-5318
• https://bugzilla.redhat.com/show_bug.cgi?id=2369131
• https://www.cve.org/CVERecord?id=CVE-2025-5318
• https://nvd.nist.gov/vuln/detail/CVE-2025-5318
• https://www.libssh.org/security/advisories/CVE-2025-5318.txt

🔧 This Pull Request updates lock files to use the latest dependency versions.

---

Configuration

📅 Schedule: Branch creation - "" in timezone Etc/UTC, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[rhacs-bot]

Auto-approved by automation.