SUSE-IU-2025:3851-1: Security update of suse/sl-micro/6.1/baremetal-os-container

[sle-container-updates at lists.suse.com]

SUSE Image Update Advisory: suse/sl-micro/6.1/baremetal-os-container
-----------------------------------------------------------------
Image Advisory ID : SUSE-IU-2025:3851-1
Image Tags        : suse/sl-micro/6.1/baremetal-os-container:2.2.1 , suse/sl-micro/6.1/baremetal-os-container:2.2.1-7.35 , suse/sl-micro/6.1/baremetal-os-container:latest
Image Release     : 7.35
Severity          : moderate
Type              : security
References        : 1236217 1242300 1244156 1244157 1244158 1251305 1252974 1253757
                        CVE-2025-0913 CVE-2025-11563 CVE-2025-22874 CVE-2025-4673 CVE-2025-47268
                        CVE-2025-6075 CVE-2025-8291 
-----------------------------------------------------------------

The container suse/sl-micro/6.1/baremetal-os-container was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: 346
Released:    Tue Dec  9 17:34:04 2025
Summary:     Security update for curl
Type:        security
Severity:    moderate
References:  1242300,1253757,CVE-2025-11563,CVE-2025-47268
This update for curl fixes the following issues:

- CVE-2025-11563: Fixed wcurl path traversal with percent-encoded slashes (bsc#1253757).

-----------------------------------------------------------------
Advisory ID: 347
Released:    Tue Dec  9 18:00:05 2025
Summary:     Security update for python311
Type:        security
Severity:    moderate
References:  1236217,1244156,1244157,1244158,1251305,1252974,CVE-2025-0913,CVE-2025-22874,CVE-2025-4673,CVE-2025-6075,CVE-2025-8291
This update for python311 fixes the following issues:

Update to 3.11.14:

- CVE-2025-8291: Fixed validity of the ZIP64 End of Central Directory (EOCD) is not checked by the 'zipfile' 
  module (bsc#1251305).
- CVE-2025-6075: Fixed the value passed to os.path.expandvars() is user-controlled a performance degradation
  is possible when expanding environment variables (bsc#1252974).


The following package changes have been done:

- SL-Micro-release-6.1-slfo.1.11.70 updated
- libcurl4-8.14.1-slfo.1.1_3.1 updated
- python311-base-3.11.14-slfo.1.1_1.1 updated
- libpython3_11-1_0-3.11.14-slfo.1.1_1.1 updated
- python311-3.11.14-slfo.1.1_1.1 updated
- container:SL-Micro-base-container-2.2.1-5.57 updated