chore(deps): refresh rpm lockfiles [SECURITY]

[red-hat-konflux]

This PR contains the following updates:

File rpms.in.yaml:

Package	Change
ca-certificates	2024.2.69_v8.0.303-80.0.el8_10 -> 2025.2.80_v9.0.304-80.2.el8_10
glib2	2.56.4-166.el8_10 -> 2.56.4-167.el8_10
kernel-headers	4.18.0-553.79.1.el8_10 -> 4.18.0-553.82.1.el8_10
libssh	0.9.6-14.el8 -> 0.9.6-15.el8_10
libssh-config	0.9.6-14.el8 -> 0.9.6-15.el8_10
systemd	239-82.el8_10.5 -> 239-82.el8_10.8
systemd-libs	239-82.el8_10.5 -> 239-82.el8_10.8
systemd-pam	239-82.el8_10.5 -> 239-82.el8_10.8
systemd-udev	239-82.el8_10.5 -> 239-82.el8_10.8

---

libssh: out-of-bounds read in sftp_handle()

CVE-2025-5318

More information

Details

A flaw was found in the libssh library in versions less than 0.11.2. An out-of-bounds read can be triggered in the sftp_handle function due to an incorrect comparison check that permits the function to access memory beyond the valid handle list and to return an invalid pointer, which is used in further processing. This vulnerability allows an authenticated remote attacker to potentially read unintended memory regions, exposing sensitive information or affect service behavior.

Severity

Moderate

References

• https://access.redhat.com/security/cve/CVE-2025-5318
• https://bugzilla.redhat.com/show_bug.cgi?id=2369131
• https://www.cve.org/CVERecord?id=CVE-2025-5318
• https://nvd.nist.gov/vuln/detail/CVE-2025-5318
• https://www.libssh.org/security/advisories/CVE-2025-5318.txt

🔧 This Pull Request updates lock files to use the latest dependency versions.

---

Configuration

📅 Schedule: Branch creation - "" in timezone Etc/UTC, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[rhacs-bot]

Auto-approved by automation.

[rhacs-bot]

Auto-approved by automation.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 27.60%. Comparing base (cb5c9cf) to head (89faee1).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@              Coverage Diff              @@
##           release-3.23    #2600   +/-   ##
=============================================
  Coverage         27.60%   27.60%           
=============================================
  Files                95       95           
  Lines              5422     5422           
  Branches           2523     2523           
=============================================
  Hits               1497     1497           
  Misses             3213     3213           
  Partials            712      712           

Flag	Coverage Δ
collector-unit-tests	27.60% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.