Add image_5.29.3 for buildah_1.34.3 as CVE-2024-3727 fixed in 5.29.3

[ArchanaWind]

Hi ,

CVE-2024-3727 is fixed in image_5.29.3. Is there any chance to add image_5.29.3 for buildah_1.34.3 stable branch

Thanks in advance

[nalind]

@TomSweeneyRedHat I see you merged updates to the release-1.33 and release-1.35 branches, are there plans for the release-1.34 branch, too?

[TomSweeneyRedHat]

@nalind I think that would be a good cabal/scrum topic. No plans at the moment, the current thinking is to update RHEL branches and the latest on Fedora with CVE like fixes.

[ArchanaWind]

Hi @caiges @TomSweeneyRedHat

we are using buildah-1.34.3, it has image-1.29.1, could you please suggest how can I make available it for 1.34.3.

[TomSweeneyRedHat]

@ArchanaWind I can't add it to Buildah v1.34.3 directly. The best I can do is add it and create 1.34.4, which shouldn't have too much more than that patch in it.

[TomSweeneyRedHat]

And it's not bumping up nicely. We have a mismatch between c/storage that c/image wants, the the c/storage that's in the Buildah v1.34 branch. I'm not sure if this can be done without bumping c/image and c/storage up to what we have in Buildah 1.35, and I'm not sure what chaos might happen then.

@ArchanaWind any way you can bump to 1.36
?