SUSE-CU-2025:8245-1: Security update of suse/registry

Thu Nov 13 08:17:57 UTC 2025

SUSE Container Update Advisory: suse/registry
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2025:8245-1
Container Tags        : suse/registry:2.8 , suse/registry:2.8 , suse/registry:2.8-18.1 , suse/registry:latest
Container Release     : 18.1
Severity              : important
Type                  : security
References            : 1232526 1238491 1239566 1239938 1240788 1241219 1243794 1243991
                        1244050 1245199 1247498 1249584 1250232 1252160 CVE-2025-3576
                        CVE-2025-59375 CVE-2025-9230 
-----------------------------------------------------------------

The container suse/registry was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2025:3508-1
Released:    Thu Oct  9 10:32:56 2025
Summary:     Security update for expat
Type:        security
Severity:    important
References:  1249584,CVE-2025-59375
This update for expat fixes the following issues:

- CVE-2025-59375: memory amplification vulnerability allows attackers to trigger excessive dynamic memory allocations
  by submitting crafted XML input (bsc#1249584).

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2025:3546-1
Released:    Sat Oct 11 03:21:33 2025
Summary:     Security update for openssl-3
Type:        security
Severity:    important
References:  1250232,CVE-2025-9230
This update for openssl-3 fixes the following issues:

- CVE-2025-9230: Fixed out-of-bounds read & write in RFC 3211 KEK unwrap (bsc#1250232).

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2025:3699-1
Released:    Tue Oct 21 12:07:47 2025
Summary:     Security update for krb5
Type:        security
Severity:    moderate
References:  1241219,CVE-2025-3576
This update for krb5 fixes the following issues:

- CVE-2025-3576: weakness in the MD5 checksum design allows for spoofing of GSSAPI-protected messages that are using
  RC4-HMAC-MD5 (bsc#1241219).

Krb5 as very old protocol supported quite a number of ciphers
that are not longer up to current cryptographic standards.

To avoid problems with those, SUSE has by default now disabled
those alorithms.

The following algorithms have been removed from valid krb5 enctypes:

- des3-cbc-sha1
- arcfour-hmac-md5

To reenable those algorithms, you can use allow options in krb5.conf:

[libdefaults]
allow_des3 = true
allow_rc4 = true

to reenable them.

-----------------------------------------------------------------
Advisory ID: SUSE-RU-2025:3836-1
Released:    Tue Oct 28 11:38:00 2025
Summary:     Recommended update for bash
Type:        recommended
Severity:    important
References:  1245199
This update for bash fixes the following issues:

- Fix histfile missing timestamp for the oldest record (bsc#1245199)

-----------------------------------------------------------------
Advisory ID: SUSE-RU-2025:3877-1
Released:    Fri Oct 31 05:29:41 2025
Summary:     Recommended update for libselinux
Type:        recommended
Severity:    important
References:  1252160
This update for libselinux fixes the following issues:

- Ship license file (bsc#1252160)

-----------------------------------------------------------------
Advisory ID: SUSE-RU-2025:3930-1
Released:    Tue Nov  4 09:26:22 2025
Summary:     Recommended update for gcc15
Type:        recommended
Severity:    moderate
References:  1232526,1238491,1239566,1239938,1240788,1243794,1243991,1244050
This update for gcc15 fixes the following issues:

This update ships the GNU Compiler Collection GCC 15.2. (jsc#PED-12029)

The compiler runtime libraries are provided for all SUSE Linux Enterprise 15
versions and replace the same named GCC 14 ones.

The new compilers for C, C++, and Fortran are provided for SUSE Linux
Enterprise 15 SP6 and SP7, and provided in the 'Development Tools' module.

The Go, D, Ada and Modula 2 language compiler parts are available
unsupported via the PackageHub repositories.

To use gcc15 compilers use:

- install 'gcc15' or 'gcc15-c++' or one of the other 'gcc15-COMPILER' frontend packages.
- override your Makefile to use CC=gcc15, CXX=g++15 and similar overrides for the other languages.

For a full changelog with all new GCC15 features, check out

	https://gcc.gnu.org/gcc-15/changes.html

Update to GCC 15.2 release:

  * the GCC 15.2 release contains regression fixes accumulated since
    the GCC 15.1 release

- Prune the use of update-alternatives from openSUSE Factory and
  SLFO.

- Adjust crosses to conflict consistently where they did not
  already and make them use unsuffixed binaries.

- Tune for power10 for SLES 16.  [jsc#PED-12029]
- Tune for z15 for SLES 16.  [jsc#PED-253]

- Fix PR120827, ICE due to splitter emitting constant loads directly

- Exclude shared objects present for link editing in the GCC specific
  subdirectory from provides processing via __provides_exclude_from.
  [bsc#1244050][bsc#1243991]

- Make cross-*-gcc15-bootstrap package conflict with the non-bootstrap
  variant conflict with the unversioned cross-*-gcc package.

- Enable C++ for offload compilers.  [bsc#1243794]

- Add libgcobol and libquadmath-devel dependence to the cobol frontend
  package.

Update to GCC 15 branch head, 15.1.1+git9595

  * includes GCC 15.1 release

- Enable gfx9-generic, gfx10-3-generic and gfx11-generic multilibs
  for the AMD GCN offload compiler when llvm is new enough.
- Make sure link editing is done against our own shared library
  copy rather than the installed system runtime.  [bsc#1240788]
- Fix newlib libm miscompilation for GCN offloading.

Update to GCC trunk head, 15.0.1+git9001

  * includes -msplit-patch-nops required for user-space livepatching
    on powerpc
  * includes fix for Ada build with --enable-host-pie

- Build GCC executables PIE on SLE.  [bsc#1239938]
- Includes change to also record -D_FORTIFY_SOURCE=2 in the DWARF
  debug info DW_AT_producer string.  [bsc#1239566]
- Package GCC COBOL compiler for openSUSE Factory for supported
  targets which are x86_64, aarch64 and ppc64le.
- Disable profiling during build when %want_reproducible_builds is set
  [bsc#1238491]
- Includes fix for emacs JIT use
- Bumps libgo SONAME to libgo24 which should fix go1.9 build
- Adjust cross compiler requirements to use %requires_ge
- For cross compilers require the same or newer binutils, newlib
  or cross-glibc that was used at build time.  [bsc#1232526]

-----------------------------------------------------------------
Advisory ID: SUSE-RU-2025:3934-1
Released:    Tue Nov  4 12:23:11 2025
Summary:     Recommended update for cyrus-sasl
Type:        recommended
Severity:    moderate
References:  1247498
This update for cyrus-sasl fixes the following issue:

- Replace insecure MD5 with ephemeral HMAC-SHA256 (bsc#1247498).

The following package changes have been done:

- libgcc_s1-15.2.0+git10201-150000.1.3.3 updated
- libselinux1-3.5-150600.3.3.1 updated
- libstdc++6-15.2.0+git10201-150000.1.3.3 updated
- libreadline7-7.0-150400.27.6.1 updated
- bash-4.4-150400.27.6.1 updated
- bash-sh-4.4-150400.27.6.1 updated
- libexpat1-2.7.1-150700.3.6.1 updated
- libsasl2-3-2.1.28-150600.7.9.2 updated
- libopenssl3-3.2.3-150700.5.21.1 updated
- openssl-3-3.2.3-150700.5.21.1 updated
- krb5-1.20.1-150600.11.14.1 updated
- container:suse-sle15-15.7-355365ed1220d1d8c94041197156b2b908b1f16fc22472e50c15e185f74d6a8c-0 added
- container:registry.suse.com-bci-bci-micro-15.7-b43c2c783170982214ceb18c7ab5b77bcc6ded97928ba82c368ecfd29edd8226-0 added
- container:bci-bci-micro-15.7-f98a5deb3bf91c48bf953f57d3a0bfe7a691340a7abe2a2157c3f8ceb87f4e57-0 removed
- perl-5.26.1-150300.17.20.1 removed