chore(deps): refresh rpm lockfiles [SECURITY]

[red-hat-konflux]

This PR contains the following updates:

File rpms.in.yaml:

Package	Change
expat	2.2.5-17.el8_10 -> 2.5.0-1.el8_10
kernel-headers	4.18.0-553.83.1.el8_10 -> 4.18.0-553.85.1.el8_10
libssh	0.9.6-15.el8_10 -> 0.9.6-16.el8_10
libssh-config	0.9.6-15.el8_10 -> 0.9.6-16.el8_10

---

expat: parsing large tokens can trigger a denial of service

CVE-2023-52425

More information

Details

A flaw was found in Expat (libexpat). When parsing a large token that requires multiple buffer fills to complete, Expat has to re-parse the token from start numerous times. This process may trigger excessive resource consumption, leading to a denial of service.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2023-52425
• https://bugzilla.redhat.com/show_bug.cgi?id=2262877
• https://www.cve.org/CVERecord?id=CVE-2023-52425
• https://nvd.nist.gov/vuln/detail/CVE-2023-52425

---

expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing

CVE-2025-59375

More information

Details

A memory amplification vulnerability in libexpat allows attackers to trigger excessive dynamic memory allocations by submitting specially crafted XML input. A small input (~250 KiB) can cause the parser to allocate hundreds of megabytes, leading to denial-of-service (DoS) through memory exhaustion.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2025-59375
• https://bugzilla.redhat.com/show_bug.cgi?id=2395108
• https://www.cve.org/CVERecord?id=CVE-2025-59375
• https://nvd.nist.gov/vuln/detail/CVE-2025-59375
• https://github.com/libexpat/libexpat/blob/676a4c531ec768732fac215da9730b5f50fbd2bf/expat/Changes#L45-L74
• https://github.com/libexpat/libexpat/issues/1018
• https://github.com/libexpat/libexpat/pull/1034
• https://issues.oss-fuzz.com/issues/439133977

---

libexpat: expat: Improper Restriction of XML Entity Expansion Depth in libexpat

CVE-2024-8176

More information

Details

A stack overflow vulnerability exists in the libexpat library due to the way it handles recursive entity expansion in XML documents. When parsing an XML document with deeply nested entity references, libexpat can be forced to recurse indefinitely, exhausting the stack space and causing a crash. This issue could lead to denial of service (DoS) or, in some cases, exploitable memory corruption, depending on the environment and library usage.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2024-8176
• https://bugzilla.redhat.com/show_bug.cgi?id=2310137
• https://www.cve.org/CVERecord?id=CVE-2024-8176
• https://nvd.nist.gov/vuln/detail/CVE-2024-8176
• https://github.com/libexpat/libexpat/issues/893

---

expat: internal entity expansion

CVE-2013-0340

More information

Details

expat before version 2.4.0 does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2013-0340
• https://bugzilla.redhat.com/show_bug.cgi?id=1000109
• https://www.cve.org/CVERecord?id=CVE-2013-0340
• https://nvd.nist.gov/vuln/detail/CVE-2013-0340

---

libssh: Incorrect Return Code Handling in ssh_kdf() in libssh

CVE-2025-5372

More information

Details

A flaw was found in libssh versions built with OpenSSL versions older than 3.0, specifically in the ssh_kdf() function responsible for key derivation. Due to inconsistent interpretation of return values where OpenSSL uses 0 to indicate failure and libssh uses 0 for success—the function may mistakenly return a success status even when key derivation fails. This results in uninitialized cryptographic key buffers being used in subsequent communication, potentially compromising SSH sessions' confidentiality, integrity, and availability.

Severity

Moderate

References

• https://access.redhat.com/security/cve/CVE-2025-5372
• https://bugzilla.redhat.com/show_bug.cgi?id=2369388
• https://www.cve.org/CVERecord?id=CVE-2025-5372
• https://nvd.nist.gov/vuln/detail/CVE-2025-5372

🔧 This Pull Request updates lock files to use the latest dependency versions.

---

Configuration

📅 Schedule: Branch creation - "" in timezone Etc/UTC, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 27.60%. Comparing base (7bb43dd) to head (48572c3).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@              Coverage Diff              @@
##           release-3.23    #2675   +/-   ##
=============================================
  Coverage         27.60%   27.60%           
=============================================
  Files                95       95           
  Lines              5422     5422           
  Branches           2523     2523           
=============================================
  Hits               1497     1497           
  Misses             3213     3213           
  Partials            712      712           

Flag	Coverage Δ
collector-unit-tests	27.60% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.