SUSE-CU-2026:9135-1: Security update of suse/multi-linux-manager/5.1/x86_64/server-attestation
sle-container-updates at lists.suse.com
sle-container-updates at lists.suse.com
Mon Aug 24 07:22:53 UTC 2026
SUSE Container Update Advisory: suse/multi-linux-manager/5.1/x86_64/server-attestation
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2026:9135-1
Container Tags : suse/multi-linux-manager/5.1/x86_64/server-attestation:5.1.5 , suse/multi-linux-manager/5.1/x86_64/server-attestation:5.1.5.8.27.1 , suse/multi-linux-manager/5.1/x86_64/server-attestation:latest
Container Release : 8.27.1
Severity : important
Type : security
References : 1252306 1253043 1257463 1261400 1261982 1261983 1262305 1262684
1263656 1263658 1264396 1264994 1267355 1267644 1267647 1268603
1268853 1268897 1268898 1268899 1268902 1268902 1271440 1271442
1271712 1272223 1272224 1272225 1272227 1272228 1272235 1272236
1272237 CVE-2026-40226 CVE-2026-41254 CVE-2026-41989 CVE-2026-46917
CVE-2026-46968 CVE-2026-47010 CVE-2026-47021 CVE-2026-47027 CVE-2026-47059
CVE-2026-47063 CVE-2026-5435 CVE-2026-54512 CVE-2026-54513 CVE-2026-54514
CVE-2026-54515 CVE-2026-54515 CVE-2026-56109 CVE-2026-59888 CVE-2026-59889
CVE-2026-60147 CVE-2026-6238
-----------------------------------------------------------------
The container suse/multi-linux-manager/5.1/x86_64/server-attestation was updated. The following patches have been included in this update:
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:2801-1
Released: Wed Jul 8 21:04:39 2026
Summary: Security update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformats-binary, jackson-modules-base, jackson-parent
Type: security
Severity: important
References: 1268603,1268897,1268898,1268899,1268902,CVE-2026-54512,CVE-2026-54513,CVE-2026-54514,CVE-2026-54515
This update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformats-binary, jackson-modules-base, jackson-parent fixes the following issues
- CVE-2026-54512: jackson-databind has a PolymorphicTypeValidator bypass via generic type parameters that allows
arbitrary class instantiation (bsc#1268897).
- CVE-2026-54513: jackson-databind: array subtype allowlist bypass in BasicPolymorphicTypeValidator (bsc#1268898).
- CVE-2026-54514: jackson-databind: InetSocketAddress deserialization triggers eager DNS resolution (bsc#1268899).
- CVE-2026-54515: jackson-databindi: case-insensitive deserialization bypasses per-property @JsonIgnoreProperties
(bsc#1268902).
- jackson-core: document length constraint bypass in blocking, async, and DataInput parsers (bsc#1268603).
Changes for jackson-annotations:
- Update to 2.18.8
* No changes since 2.17.3
Changes for jackson-bom:
- Update to 2.18.8
* Changes
+ #68: Remove 'junit' 4.x dependency from 'jackson-base' 2.18.x
to help junit5 migration
+ 'base/pom.xml' now creates '${project.version.underscore}' for
'cleansed' version of '${project.version}'
Changes for jackson-core:
- Update to 2.18.8
* Changes of 2.18.8
+ #1611: Apply number-length validator on streaming integer path
of async parser
* Changes of 2.18.7
+ #1570: Fail parsing from 'DataInput' if 'StreamReadConstraints
.getMaxDocumentLength()' set
(bsc#1268603, GHSA-2m67-wjpj-xhg9)
+ #1600: Rework 3rd party licenses in jar
+ #1602: 'UTF8DataInputJsonParser' needs to enforce
'StreamReadConstraints.maxNameLength' limit
* Changes of 2.18.6
+ #1512: Number-parsing fix for 'UTF8DataInputJsonParser'
+ #1548: 'StreamReadConstraints.maxDocumentLength' not checked
when creating parser with fixed buffer
+ #1555: Enforce 'StreamReadConstraints.maxNumberLength' for
non-blocking (async) parser
* Changes of 2.18.5
+ #1433: 'JsonParser#getNumberType()' throws
'JsonParseException' when the current token is non-numeric
instead of returning null
+ #1446: Invalid package reference to 'java.lang.foreign' from
'com.fasterxml.jackson.core:jackson-core' (from
'FastDoubleParser')
* Changes of 2.18.3
+ #1391: Fix issue where the parser can read back old number
state when parsing later numbers
+ #1397: Jackson changes additional values to infinite in case
of special JSON structures and existing infinite values
+ #1398: Fix issue that feature
COMBINE_UNICODE_SURROGATES_IN_UTF8 doesn't work when custom
characterEscape is used
* Changes of 2.18.2
+ #1359: Non-surrogate characters being incorrectly combined
when 'JsonWriteFeature.COMBINE_UNICODE_SURROGATES_IN_UTF8' is
enabled
* Changes of 2.18.1
+ #1353: Use fastdoubleparser 1.0.90
* Changes of 2.18.
+ #223: 'UTF8JsonGenerator' writes supplementary characters as a
surrogate pair: should use 4-byte encoding
+ #1230: Improve performance of 'float' and 'double' parsing
from 'TextBuffer'
+ #1251: 'InternCache' replace synchronized with 'ReentrantLock'
- the cache size limit is no longer strictly enforced for
performance reasons but we should never go far about the limit
+ #1252: 'ThreadLocalBufferManager' replace synchronized with
'ReentrantLock'
+ #1257: Increase InternCache default max size from 100 to 200
+ #1262: Add diagnostic method 'pooledCount()' in 'RecyclerPool'
+ #1264: Rename shaded 'ch.randelshofer:fastdoubleparser'
classes to prevent use by downstream consumers
+ #1271: Deprecate 'LockFreePool' implementation in 2.18 (remove
from 3.0)
+ #1274: 'NUL'-corrupted keys, values on JSON serialization
+ #1277: Add back Java 22 optimisation in FastDoubleParser
+ #1284: Optimize 'JsonParser.getDoubleValue()/getFloatValue()
/getDecimalValue()' to avoid String allocation
+ #1305: Make helper methods of 'WriterBasedJsonGenerator'
non-final to allow overriding
+ #1310: Add new 'StreamReadConstraints' ('maxTokenCount') to
limit maximum number of Tokens allowed per document#
+ #1331: Update to FastDoubleParser v1.0.1 to fix 'BigDecimal'
decoding proble
Changes for jackson-databind:
- Update to 2.18.8
* Changes of 2.18.8
+ #5950: Improve 'UUIDeserializer' error handling
+ #5951: Improve 'InetSocketAddress' deserialization
(bsc#1268899, CVE-2026-54514)
+ #5969: '@JsonView' by-passed for some 'setterless' creator
properties
+ #5971: '@JsonView' by-passed for unwrapped creator parameters
+ #5974: '@JsonIgnore' on Record property ignored with
'PropertyNamingStrategy'
+ #5981: 'BasicPolymorphicTypeValidator' setting
'allowIfSubTypeIsArray()' should validate element type
(bsc#1268898, CVE-2026-54513)
+ #5988: 'PolymorphicTypeValidator' needs to validate generic
type parameters too (bsc#1268897, CVE-2026-54512)
+ #5993: 'UPPER_SNAKE_CASE' / 'LOWER_CASE' 'NamingStrategyImpls'
fold case using JVM default locale (Turkish-I bug)
* Changes of 2.18.4
+ #4628: '@JsonIgnore' and '@JsonProperty.access=READ_ONLY' on
Record property ignored for deserialization
+ #5049: Duplicate creator property 'b' (index 0 vs 1) on simple
java record
* Changes of 2.18.3
+ #4444: The 'KeyDeserializer' specified in the class with
'@JsonDeserialize(keyUsing = ...)' is overwritten by the
'KeyDeserializer' specified in the 'ObjectMapper'.
+ #4827: Subclassed Throwable deserialization fails since
v2.18.0 - no creator index for property 'cause'
+ #4844: Fix wrapped array handling wrt 'null' by
'StdDeserializer'
+ #4848: Avoid type pollution in 'StringCollectionDeserializer'
+ #4860: 'ConstructorDetector.USE_PROPERTIES_BASED' does not
work with multiple constructors since 2.18
+ #4878: When serializing a Map via
Converter(StdDelegatingSerializer), a NullPointerException is
thrown due to missing key serializer
+ #4908: Deserialization behavior change with @JsonCreator and
@ConstructorProperties between 2.17 and 2.18
+ #4917: 'BigDecimal' deserialization issue when using
'@JsonCreator'
+ #4920: Creator properties are ignored on abstract types when
collecting bean properties, breaking AsExternalTypeDeserializer
+ #4922: Failing '@JsonMerge' with a custom Map
+ #4932: Conversion of 'MissingNode' throws
'JsonProcessingException'
* Changes of 2.18.2
+ #4733: Wrong serialization of Type Ids for certain types of
Enum values
+ #4742: Deserialization with Builder, External type id,
'@JsonCreator' failing
+ #4777: 'StdValueInstantiator.withArgsCreator' is now set for
creators with no arguments
+ #4783 Possibly wrong behavior of @JsonMerge
+ #4787: Wrong 'String.format()' in 'StdDelegatingDeserializer'
hides actual error
+ #4788: 'EnumFeature.WRITE_ENUMS_TO_LOWERCASE' overrides
'@JsonProperty' values
+ #4790: Fix '@JsonAnySetter' issue with 'setter' method
(related to #4639)
+ #4807: Improve 'FactoryBasedEnumDeserializer' to work better
with XML module
+ #4810: Deserialization using '@JsonCreator' with renamed
property failing (since 2.18)
* Changes of 2.18.1
+ #4508: Deserialized JsonAnySetter field in Kotlin data class
is null
+ #4639: @JsonAnySetter on field ignoring unrecognized
properties if they are declared before the last recognized
properties in JSON
+ #4718: Should not fail on trying to serialize
'java.time.DateTimeException'
+ #4724: Deserialization behavior change with Records,
'@JsonCreator' and '@JsonValue' between 2.17 and 2.18
+ #4727: Eclipse having issues due'module-info' class 'lost' on
2.18.0 jars
+ #4741: When 'Include.NON_DEFAULT' setting is used on POJO,
empty values are not included in json if default is 'null'
+ #4749: Fixed a problem with
'StdDelegatingSerializer#serializeWithType' looking up the
serializer with the wrong argument
* Changes of 2.18.0
+ #562: Allow '@JsonAnySetter' to flow through Creators
+ #806: Problem with 'NamingStrategy', creator methods with
implicit names
+ #2977: Incompatible 'FAIL_ON_MISSING_PRIMITIVE_PROPERTIES' and
field level '@JsonProperty'
+ #3120: Return 'ListIterator' from 'ArrayNode.elements()'
+ #3241: 'constructorDetector' seems to invalidate
'defaultSetterInfo' for nullability
+ #3439: Java Record '@JsonAnySetter' value is null after
deserialization
+ #4085: '@JsonView' does not work on class-level for records
+ #4119: Exception when deserialization uses a record with a
constructor property with 'access=READ_ONLY'
+ #4356: 'BeanDeserializerModifier::updateBuilder()' doesn't
work for beans with Creator methods
+ #4407: 'null' type id handling does not work with
'writeTypePrefix()'
+ #4452: '@JsonProperty' not serializing field names properly on
'@JsonCreator' in Record
+ #4453: Allow JSON Integer to deserialize into a single-arg
constructor of parameter type 'double'
+ #4456: Rework locking in 'DeserializerCache'
+ #4458: Rework synchronized block from 'BeanDeserializerBase'
+ #4464: When 'Include.NON_DEFAULT' setting is used, 'isEmpty()'
method is not called on the serializer
+ #4472: Rework synchronized block in 'TypeDeserializerBase'
+ #4483: Remove 'final' on method BeanSerializer.serialize()
+ #4515: Rewrite Bean Property Introspection logic in Jackson
2.x
+ #4545: Unexpected deserialization behavior with
'@JsonCreator', '@JsonProperty' and javac '-parameters'
+ #4570: Deprecate 'ObjectMapper.canDeserialize()'/'ObjectMapper
.canSerialize()'
+ #4580: Add 'MapperFeature
.SORT_CREATOR_PROPERTIES_BY_DECLARATION_ORDER' to use Creator
properties' declaration order for sorting
+ #4584: Provide extension point for detecting 'primary'
Constructor for Kotlin (and similar) data classes
+ #4602: Possible wrong use of _arrayDelegateDeserializer in
BeanDeserializerBase::deserializeFromObjectUsingNonDefault()
+ #4617: Record property serialization order not preserved
+ #4626: '@JsonIgnore' on Record property ignored for
deserialization, if there is getter override
+ #4630: '@JsonIncludeProperties', '@JsonIgnoreProperties'
ignored when serializing Records, if there is getter override
+ #4634: '@JsonAnySetter' not working when annotated on both
constructor parameter & field
+ #4678: Java records don't serialize with 'MapperFeature
.REQUIRE_SETTERS_FOR_GETTERS'
+ #4688: Should allow deserializing with no-arg
'@JsonCreator(mode = DELEGATING)'
+ #4694: Deserializing 'BigDecimal' with large number of
decimals result in incorrect value
+ #4699: Add extra 'writeNumber()' method in 'TokenBuffer'
+ #4709: Add 'JacksonCollectors' with 'toArrayNode()'
implementation
+ Fix #5962: Case-insensitive deserialization may use wrong
@JsonIgnoreProperties (bsc#1268902, CVE-2026-54515)
- Fix 'Not fully interpolated version' error with Maven 4
Changes for jackson-dataformats-binary:
- Update to 2.18.8
* Changes of 2.18.8
+ #696: (ion) Incomplete number length validation in Ion decoder
(for 'BigDecimal' and/or 'BigInteger')
* Changes of 2.18.6
+ #645: (avro) Remove use of Avro 'Schema.Parser()
.setValidate()' to allow use of Avro core 1.12.1 (2.x)
+ #649: (cbor, smile) 'StreamReadConstraints.maxDocumentLength'
not checked when creating parser with fixed buffer
+ #651: (smile) Ensure Smile backend supports
'StreamReadConstraints.maxTokenCount'
+ #652: (cbor) Ensure CBOR backend supports
+ Minor fix to 'ProtobufGenerator._reportEnumError()' helper
method
* Changes of 2.18.5
+ #599: (cbor) Unable to deserialize stringref-enabled CBOR with
ignored properties
+ #623: (ion) Upgrade 'ion-java' dep to 1.11.11 (from 1.11.10)
* Changes of 2.18.4
+ #569: (ion) 'IonParser' fails to parse some 'long' values
saying they are out of range when they are not
+ #584: (protobuf) Missing 'JsonToken.END_OBJECT' for nested
Protobuf Objects
+ (ion) Upgrade 'ion-java' to 1.11.10 (from 1.11.9)
* Changes of 2.18.3
+ #541: (cbor, protobuf, smile) 'SmileParser.getValueAsString()'
FIELD_NAME bug
* Changes of 2.18.1
+ #518: Should not read past end for CBOR string values
* Changes of 2.18.0
+ #167: (avro) Incompatibility with Avro >=1.9.0 (upgrade to
Avro 1.11.3)
+ #484: (protobuf) Rework synchronization in 'ProtobufMapper'
+ #494: (avro) Avro Schema generation: allow mapping Java Enum
properties to Avro String values
+ #508: (avro) Ignore 'specificData' field on serialization
+ #509: IonValueMapper.builder() not implemented, does not
register modules
* (ion) Upgrade 'ion-java' to 1.11.9 (from 1.11.8)
value
Changes for jackson-modules-base:
- Upgrade to 2.18.8
* No changes since 2.18.0
* Changes of 2.18.0
+ #233: (jaxb) Tolerate JAX-RS 2.2 in
jackson-module-jaxb-annotations so that it can be deployed in
Liberty alongside features which use 2.2
+ #248: (android-record) jClass annotations and polymorphic
types are ignored when deserializing Android Record fields
+ #251: (android-record) Constructor is not recognized when a
record uses both arrays and generic types
Changes for jackson-parent:
- Update to 2.18.4
* Changes of 2.18.4
+ Update to latest 'oss-parent' (69)
* Changes of 2.18.3
+ Update to latest 'oss-parent' (68)
+ Switch to publishing via Sonatype Central Portal repo
* Changes of 2.18.2
+ Update to latest 'oss-parent' (66); future-proof for Sonatype
Central Portal
* Changes of 2.18.1
+ #15: Add override to downgrade 'moditect-maven-plugin' from
1.2.2 to 1.1.0 to work around Eclipse issues
* Changes of 2.18
+ Update to oss-parent 61 (plugin version updates)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3030-1
Released: Wed Jul 15 11:53:06 2026
Summary: Security update for glibc
Type: security
Severity: moderate
References: 1263656,1263658,CVE-2026-5435,CVE-2026-6238
This update for glibc fixes the following issues
- CVE-2026-5435: unchecked buffer writing in TSIG handling can lead to an out-of-bounds write (bsc#1263656).
- CVE-2026-6238: insufficient RDATA length validation can lead to application crashes or uninitialized memory disclosure
(bsc#1263658).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2026:3118-1
Released: Fri Jul 17 22:18:41 2026
Summary: Recommended update for gcc15
Type: recommended
Severity: moderate
References: 1252306,1253043,1257463
This update for gcc15 fixes the following issues:
- Update to GCC 15.3 release
- Drop -fhardened from RPM_OPT_FLAGS
- Avoid conflicts between %gcc_libc_bootstrap packages of different
versions if update-alternatives are still in use (SLE 15 and older)
- Allow conversions to/from uint32_t. Filter out -Wtime_t-conversion
from flags to build D target library files. [jsc#PED-15601]
- Remove loongarch64 from quadmath_arch. On LoongArch long double
is IEEE quad, so libquadmath is not needed and no longer built.
- includes fix for bogus expression simplification [bsc#1257463]
even when not available at build time. [bsc#1253043]
- Backport fix that cures a miscompile of libgo on arm. [bsc#1252306]
- Check availability of builtins at expand time
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2026:3145-1
Released: Tue Jul 21 10:38:13 2026
Summary: Recommended update for log4j
Type: recommended
Severity: important
References:
This update for log4j fixes the following issues:
log4j was updated and includes fixes and improvements from versions 2.21.0 through 2.26.0:
- Bugs fixed:
- Fixed crashes when logging errors with stack traces modified by other threads
- Fixed FATAL-level log messages being silently discarded
- Fixed memory leaks in several components
- Fixed log file headers not being written correctly when files are recreated
- Fixed log file rotation failures
- Fixed configuration file loading from HTTP sources
- Fixed date and time formatting issues in logs
- Fixed problems when multiple threads modify logger settings simultaneously
- Fixed MongoDB appender connection issues
- New Features Added:
- Support for ZStandard compression for log files
- Support for LMAX Disruptor 4.x (high-performance logging)
- Better support for GraalVM environments
- Java 8 users now get sub-millisecond precision timestamps
- Features Removed:
- JMX GUI tool (moved to separate release)
- Flume Appender (moved to separate release)
- Kubernetes lookup feature (users should migrate to io.fabric8:kubernetes-log4j)
- JAnsi library support (Windows 10+ has built-in color support)
- Important Changes:
- JMX monitoring is now DISABLED by default (set log4j2.disableJmx=false to enable)
- Default log format has changed
- Configuration scripts now require explicit names
- Deprecations (features to be removed in the future):
- MongoDB4 module (use standard MongoDB module instead)
- EventLogger class
- Some builder methods (replaced with setter methods)
New Runtime Dependencies:
- jackson-dataformat-xml
- stax2-api
- woodstox-core
New and Updated Build Dependencies:
- aalto-xml (updated from version 1.3.3 to 1.4.0)
- jakarta-annotations (new)
- jakarta-messaging (new)
- jspecify (new)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3182-1
Released: Wed Jul 22 09:25:44 2026
Summary: Security update for libgcrypt
Type: security
Severity: moderate
References: 1262684,CVE-2026-41989
This update for libgcrypt fixes the following issue
- CVE-2026-41989: heap-based buffer overflow when processing crafted ECDH ciphertext can lead to a denial of service
(bsc#1262684).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3244-1
Released: Fri Jul 24 15:11:25 2026
Summary: Security update for systemd
Type: security
Severity: moderate
References: 1261400,1261982,1261983,1262305,1267644,1267647,CVE-2026-40226
This update for systemd fixes the following issues
Security issues fixed:
- CVE-2026-40226: nspawn: escape-to-host via malformed optional config file (bsc#1261400).
Other updates and bugfixes:
- Fix soft reboot not restarting user services with default.target (bsc#1262305).
- Import commit e46e1952d5 (bsc#1267647 bsc#1262305 bsc#1267644).
- Import commit 429043ca9a (bsc#1261982 bsc#1261983).
- Import commit 58e5d2e21e (bsc#1261982).
- Import commit 4bd91117cc (bsc#1261983).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3270-1
Released: Mon Jul 27 13:01:22 2026
Summary: Security update for alsa
Type: security
Severity: moderate
References: 1268853,CVE-2026-56109
This update for alsa fixes the following issue
- CVE-2026-56109: double-free vulnerability in parse_def() in src/conf.c that can allow attackers to corrupt memory
(bsc#1268853).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3273-1
Released: Mon Jul 27 13:32:13 2026
Summary: Security update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformats-binary, jackson-modules-base
Type: security
Severity: moderate
References: 1268902,1271440,1271442,CVE-2026-54515,CVE-2026-59888,CVE-2026-59889
This update for jackson-annotations, jackson-bom, jackson-core, jackson-databind, jackson-dataformats-binary, jackson-modules-base fixes the following issues:
- CVE-2026-54515: rebuilding the property map from unfiltered bean properties could permit a bypass of
@JsonIgnoreProperties exclusions (bsc#1268902).
- CVE-2026-59889: missing view guard when deserializing @JsonUnwrapped properties could allow unauthorized writes to
@JsonView restricted fields (bsc#1271440).
- CVE-2026-59888: mismatch between property renaming and ignore-filtering on Java Records could allow a bypass of
@JsonIgnore restrictions (bsc#1271442).
Changes for jackson-annotations:
- Update to 2.18.9.
Changes for jackson-bom:
- Update to 2.18.9.
Changes for jackson-core:
- Update to 2.18.9.
Changes for jackson-databind:
- Update to 2.18.9:
* honor @JsonView for external-type-id (EXTERNAL_PROPERTY) properties (GHSA-mhm7-754m-9p8w).
Changes for jackson-dataformats-binary:
- Update to 2.18.9.
Changes for jackson-modules-base:
- Update to 2.18.9.
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2026:3381-1
Released: Tue Jul 28 17:35:03 2026
Summary: Recommended update for log4j
Type: recommended
Severity: important
References:
This update for log4j fixes the following issues:
Upgrade to 2.26.1:
* Changed
+ Improve logging for LinkageError scenarios involving the LMAX
Disruptor library
* Fixed
+ Fix the createOnDemand behavior of RollingFileAppender to
correctly defer file and directory creation until the first
log event, while preserving eager creation when disabled
+ Improve documentation for locale handling in the Pattern
Layout date pattern converter
+ Fix handling of non-finite numbers while encoding MapMessage
to JSON
+ Fix encoding of MSGID and SD-ID fields of
StructuredDataMessage to XML
+ Fix stack trace rendering for exceptions with identity
malfunction (e.g., colliding equals() and/or hashCode()
implementations)
+ Fix resource leaks in ConfigurationSource when loading
configuration via URL fails
+ Fix KafkaAppender reporting error to error handler even after
a successful retry
- Generate META-INF/services files using bnd-maven-plugin
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3406-1
Released: Wed Jul 29 13:09:09 2026
Summary: Security update for java-17-openjdk
Type: security
Severity: important
References: 1264396,1264994,1267355,1272223,1272224,1272225,1272227,1272228,1272235,1272236,1272237,CVE-2026-41254,CVE-2026-46917,CVE-2026-46968,CVE-2026-47010,CVE-2026-47021,CVE-2026-47027,CVE-2026-47059,CVE-2026-47063,CVE-2026-60147
This update for java-17-openjdk fixes the following issues:
Upgrade to upstream tag jdk-17.0.20+8 (July 2026 CPU).
Security issues fixed:
- CVE-2026-41254: lcms: information disclosure and denial of service via integer overflow in `CubeSize` (bsc#1264994).
- CVE-2026-46917: unauthenticated attacker with network access via TLS can cause a partial denial of service
(bsc#1272223).
- CVE-2026-46968: unauthenticated attacker with network access via TLS can gain unauthorized creation, deletion or
modification access to critical data(bsc#1272224).
- CVE-2026-47010: unauthenticated attacker with network access via multiple protocols can gain unauthorized update,
insert or delete access to some data (bsc#1272225).
- CVE-2026-47021: unauthenticated attacker with network access via multiple protocols can cause a partial denial of
service (bsc#1272227).
- CVE-2026-47027: unauthenticated attacker with network access via multiple protocols can cause a partial denial of
service (bsc#1272228).
- CVE-2026-47059: unauthenticated attacker with network access via multiple protocols can cause a partial denial of
service (bsc#1272235).
- CVE-2026-47063: unauthenticated attacker with network access via multiple protocols can gain unauthorized creation,
deletion or modification access to critical data (bsc#1272236).
- CVE-2026-60147: unauthenticated attacker with network access via multiple protocols can gain unauthorized update,
insert, delete and read access to some(bsc#1272237).
Other updates and bugfixes:
- Errors from update-alternatives when installing java-25-openjdk (bsc#1267355).
- Make post scripts less noisy (bsc#1267355).
- Use libalternatives instead of update-alternatives for distributions where libalternatives is available.
- Upgrade to upstream tag jdk-17.0.20+8 (July 2026 CPU):
+ JDK-7184899: Test sun/java2d/X11SurfaceData/
/SharedMemoryPixmapsTest/SharedMemoryPixmapsTest.sh fail
+ JDK-8015444: java/awt/Focus/KeyStrokeTest.java sometimes fails
+ JDK-8064922: [macos] Test javax/swing/JTabbedPane/4624207/
/bug4624207.java fails
+ JDK-8068293: [TEST_BUG] Test closed/com/sun/java/swing/plaf/
/motif/InternalFrame/4150591/bug4150591.java fails with
GTKLookAndFeel
+ JDK-8068310: [TEST_BUG] Test javax/swing/JColorChooser/
/Test4234761.java fails with GTKL&F
+ JDK-8068378: [TEST_BUG]The java/awt/Modal/PrintDialogsTest/
/PrintDialogsTest.java instruction need to update
+ JDK-8183336: Better cleanup for jdk/test/java/lang/module/
/customfs/ModulesInCustomFileSystem.java
+ JDK-8221451: PIT: sun/java2d/X11SurfaceData/
/SharedMemoryPixmapsTest/SharedMemoryPixmapsTest.sh fails
+ JDK-8240908: RetransformClass does not know about
MethodParameters attribute
+ JDK-8255463: java/nio/channels/spi/SelectorProvider/
/inheritedChannel/InheritedChannelTest.java failed with
ThreadTimeoutException
+ JDK-8272477: Additional cleanup of test/jdk/java/nio/file/spi/
/SetDefaultProvider.java
+ JDK-8274082: Wrong test name in jtreg run tag for java/awt/
/print/PrinterJob/SwingUIText.java
+ JDK-8277444: Data race between
JvmtiClassFileReconstituter::copy_bytecodes and class linking
+ JDK-8281243: Test java/lang/instrument/
/RetransformWithMethodParametersTest.java is failing
+ JDK-8282044: [JVMCI] Export _sha3_implCompress,
_md5_implCompress and aarch64::_has_negatives stubs to JVMCI
compiler.
+ JDK-8284993: Replace System.exit call in swing tests with
RuntimeException
+ JDK-8286258: [Accessibility,macOS,VoiceOver] VoiceOver reads
the spinner value wrong and sometime partially
+ JDK-8286865: vmTestbase/vm/mlvm/meth/stress/jni/
/nativeAndMH/Test.java fails with Out of space in CodeCache
+ JDK-8287062: com/sun/jndi/ldap/LdapPoolTimeoutTest.java failed
due to different timeout message
+ JDK-8290504: Close streams returned by ModuleReader::list
+ JDK-8293484: AArch64:
TestUseSHA512IntrinsicsOptionOnSupportedCPU.java fails on CPU
with SHA512 feature support
+ JDK-8297191: [macos] Printing a page range with starting
page > 1 results in missing pages
+ JDK-8298783: java/lang/ref/FinalizerHistogramTest.java failed
with 'RuntimeException: MyObject is not found in test output'
+ JDK-8298823: [macos] java/awt/Mouse/EnterExitEvents/
/DragWindowTest.java continues to fail with 'No MouseReleased
event on label!'
+ JDK-8299304: Test 'java/awt/print/PrinterJob/
/PageDialogTest.java' fails on macOS 13 x64 because the Page
Dialog blocks the Toolkit
+ JDK-8304065: HttpServer.stop should terminate immediately if
no exchanges are in progress
+ JDK-8309142: Refactor test/langtools/tools/javac/versions/
/Versions.java
+ JDK-8316274: javax/swing/ButtonGroup/
/TestButtonGroupFocusTraversal.java fails in Ubuntu 23.10 with
Motif LAF
+ JDK-8317801: java/net/Socket/asyncClose/Race.java fails
intermittently (aix)
+ JDK-8320677: Printer tests use invalid '@run main/manual=yesno
+ JDK-8321182: SourceExample.SOURCE_14 comment should refer to
'switch expressions' instead of 'text blocks'
+ JDK-8321303: Intermittent open/test/jdk/java/awt/
/KeyboardFocusmanager/ConsumeNextMnemonicKeyTypedTest/
/ConsumeNextMnemonicKeyTypedTest.java failure on Linux
+ JDK-8323089: networkaddress.cache.ttl is not a system property
+ JDK-8323545: java/awt/GraphicsDevice/CheckDisplayModes.java
fails with 'exit code: 133'
+ JDK-8323672: Suppress unwanted autoconf added flags in CC and
CXX
+ JDK-8324345: Stack overflow during C2 compilation when
splitting memory phi
+ JDK-8324641: [IR Framework] Add Setup method to provide custom
arguments and set fields
+ JDK-8328300: Convert PrintDialogsTest.java from Applet to main
program
+ JDK-8332495: java/util/logging/LoggingDeadlock2.java fails
with AssertionError: Some tests failed
+ JDK-8334928: Test sun/security/ssl/SSLSocketImpl/
/ReuseAddr.java failed: java.net.BindException: Address
already in use
+ JDK-8337876: [IR Framework] Add support for IR tests with
@Stable
+ JDK-8338103: Stabilize and open source a Swing OGL
ButtonResizeTest
+ JDK-8338112: Test testlibrary_tests/ir_framework/tests/
/TestPrivilegedMode.java fails with release build
+ JDK-8338344: Test TestPrivilegedMode.java intermittent fails
java.lang.NoClassDefFoundError: jdk/test/lib/Platform
+ JDK-8338554: Fix inconsistencies in javadoc/doclet/
/testLinkOption/TestRedirectLinks.java
+ JDK-8338883: Show warning when CreateCoredumpOnCrash set, but
core dump will not happen
+ JDK-8339233: Test javax/swing/JButton/
/SwingButtonResizeTestWithOpenGL.java#id failed: Button
renderings are different after window resize
+ JDK-8339238: Update to use jtreg 7.5.1
+ JDK-8339879: Open some dialog awt tests
+ JDK-8339975: Open some dialog awt tests 2
+ JDK-8340140: Open some dialog awt tests 3
+ JDK-8340336: Open some checkbox awt tests
+ JDK-8340494: Open some dialog awt tests 4
+ JDK-8340851: Open some TextArea awt tests
+ JDK-8340987: Open some TextArea awt tests 1
+ JDK-8341055: Open some TextArea awt tests 2
+ JDK-8341292: Open some TextArea awt tests 3
+ JDK-8341376: Open some TextArea awt tests 4
+ JDK-8341427: JFR: Adjust object sampler span handling
+ JDK-8342401: [TESTBUG] javax/swing/JSpinner/8223788/
/JSpinnerButtonFocusTest.java test fails in ubuntu 22.04 on
SBR Hosts
+ JDK-8345618: javax/swing/text/Caret/8163124/
/CaretFloatingPointAPITest.java leaves Caret is not complete
+ JDK-8346154: [XWayland] Some tests fail intermittently in the
CI, but not locally
+ JDK-8347811: Container detection code for cgroups v2 should
use cgroup.controllers
+ JDK-8347836: Disabled PopupMenu shows shortcuts on Mac
+ JDK-8349192: jvmti/scenarios/contention/TC05/tc05t001 fails:
ERROR: tc05t001.cpp, 281: (waitedThreadCpuTime -
waitThreadCpuTime) < (EXPECTED_ACCURACY * 1000000)
+ JDK-8349533: Refactor validator tests shell files to java
+ JDK-8349988: Change cgroup version detection logic to not
depend on /proc/cgroups
+ JDK-8350749: Upgrade JLine to 3.29.0
+ JDK-8352685: Opensource JInternalFrame tests - series2
+ JDK-8352733: Improve RotFontBoundsTest test
+ JDK-8352877: Opensource Several Font related tests - Batch 1
+ JDK-8353488: Open some JComboBox bugs 3
+ JDK-8353552: Opensource Several Font related tests - Batch 3
+ JDK-8354163: Open source Swing tests Batch 1
+ JDK-8354469: Keytool exposes the password in plain text when
command is piped using | grep
+ JDK-8354695: Open source several swing tests batch7
+ JDK-8354878: File Leak in
CgroupSubsystemFactory::determine_type of
cgroupSubsystem_linux.cpp:300
+ JDK-8354900: javax/swing/AbstractButton/bug4133768.java
failing on macosx-aarch64
+ JDK-8355048: ProblemList TestGlyphVectorLayout.java on all
platforms
+ JDK-8355179: Reinstate javax/swing/JScrollBar/4865918/
/bug4865918.java headful and macos run
+ JDK-8355332: Fix failing semi-manual test EDT issue
+ JDK-8355443: [java.io] Use @requires tag instead of exiting
based on File.separatorChar value
+ JDK-8355445: [java.nio] Use @requires tag instead of exiting
based on 'os.name' property value
+ JDK-8356107: [java.lang] Use @requires tag instead of exiting
based on os.name or separatorChar property
+ JDK-8357062: Update Public Suffix List to 823beb1
+ JDK-8357082: Stabilize and add debug logs to CopyAreaOOB.java
+ JDK-8357141: Update to use jtreg 7.5.2
+ JDK-8357280: (bf) Remove @requires tags from java/nio/Buffer/
/LimitDirectMemory[NegativeTest].java
+ JDK-8357390: java/awt/Toolkit/ScreenInsetsTest/
/ScreenInsetsTest.java Test failing on Ubuntu 24.04 Vm Hosts
used by Oracle's internal CI system
+ JDK-8358058: sun/java2d/OpenGL/DrawImageBg.java Test fails
intermittently
+ JDK-8358751: C2: Recursive inlining check for compiled lambda
forms is broken
+ JDK-8359978: Test javax/net/ssl/SSLSocket/Tls13PacketSize.java
failed again with java.net.SocketException: An established
connection was aborted by the software in your host machine
+ JDK-8360160: ubuntu-22-04 machine is failing client tests
+ JDK-8360882: Tests throw SkippedException when they should
fail
+ JDK-8361106: [TEST] com/sun/net/httpserver/Test9.java fails
with java.nio.file.FileSystemException
+ JDK-8361606: ConsumeNextMnemonicKeyTypedTest.java fails on
Windows: character typed with VK_A: a
+ JDK-8362428: Update IANA Language Subtag Registry to Version
2025-08-25
+ JDK-8364190: JFR: RemoteRecordingStream withers don't work
+ JDK-8364315: Remove unused xml files from test/jaxp/javax/xml/
/jaxp/functional/javax/xml/transform/xmlfiles
+ JDK-8364927: Add @requires annotation to
TestReclaimStringsLeaksMemory.java
+ JDK-8365379: SU3.applyInsets may produce wrong results
+ JDK-8365423: [macos26] java/awt/MenuBar/8007006/
/bug8007006.java fails on macOS 26
+ JDK-8365424: [macos26] java/awt/Frame/DisposeTest.java fails
on macOS 26
+ JDK-8365526: Crash with null Symbol passed to
SystemDictionary::resolve_or_null
+ JDK-8365625: Can't change accelerator colors in Windows L&F
+ JDK-8366128: jdk/jdk/nio/zipfs/TestPosix.java::testJarFile
uses wrong file
+ JDK-8366261: Provide utility methods for
sun.security.util.Password
+ JDK-8366369: Add @requires linux for GTK L&F tests
+ JDK-8366852: java/awt/Choice/ChoiceMouseWheelTest/
/ChoiceMouseWheelTest.java test is failing
+ JDK-8367583: sun/security/util/AlgorithmConstraints/
/InvalidCryptoDisabledAlgos.java fails after JDK-8244336
+ JDK-8367772: Refactor createUI in PassFailJFrame
+ JDK-8367784: java/awt/Focus/InitialFocusTest/
/InitialFocusTest1.java failed with Wrong focus owner
+ JDK-8368041: Enhance TLS certificate handling
+ JDK-8368335: Refactor the rest of Locale TestNG based tests to
JUnit
+ JDK-8368498: Use JUnit instead of TestNG for jdk_text tests
+ JDK-8368551: Core dump warning may be confusing
+ JDK-8368670: Deadlock in JFR on event register + class load
+ JDK-8368683: [process] Increase jtreg debug output
maxOutputSize for TreeTest
+ JDK-8368754: runtime/cds/appcds/SignedJar.java log regex is
too strict
+ JDK-8368885: NMT CommandLine tests can check for error better
+ JDK-8368892: Make JEditorPane/TestBrowserBGColor.java headless
+ JDK-8369251: Opensource few tests
+ JDK-8369319: java/net/httpclient/CancelRequestTest.java fails
intermittently
+ JDK-8369335: Two sun/java2d/OpenGL tests fail on Windows
after JDK-8358058
+ JDK-8369561: sun/java2d/OpenGL/DrawBitmaskImage.java#id0:
Incorrect color for first pixel (actual=ff000000)
+ JDK-8369851: Remove darcy author tags from langtools tests
+ JDK-8369858: Remove darcy author tags from jdk tests
+ JDK-8369911: Test sun/java2d/marlin/ClipShapeTest.java
#CubicDoDash, #Cubic and #Poly fail intermittent
+ JDK-8369950: TLS connection to IPv6 address fails with BCJSSE
due to IllegalArgumentException
+ JDK-8370325: G1: Disallow GC for TLAB allocation
+ JDK-8370511: test/jdk/javax/swing/JSlider/bug4382876.java does
not release previously pressed keys
+ JDK-8370732: Use WhiteBox.getWhiteBox().fullGC() to provoking
gc for nsk/jvmti tests
+ JDK-8370942: test/jdk/java/security/Provider/NewInstance.java
and /test/jdk/java/security/cert/CertStore/NoLDAP.java may
skip without notifying
+ JDK-8371365: Update javax/swing/JFileChooser/bug4759934.java
to use Util.findComponent()
+ JDK-8371366: java/net/httpclient/whitebox/
/RawChannelTestDriver.java fails intermittently in jtreg
timeout
+ JDK-8371383: Test sun/security/tools/jarsigner/
/DefaultOptions.java failed due to
CertificateNotYetValidException
+ JDK-8371503: RETAIN_IMAGE_AFTER_TEST do not work for some
tests
+ JDK-8372120: Add missing sound keyword to MIDI tests
+ JDK-8372351: Add 2 WISeKey roots
+ JDK-8372609: Bug4944439 does not enforce locale correctly
+ JDK-8372661: Add a null-safe static factory method to
'jdk.test.lib.net.SimpleSSLContext'
+ JDK-8372988: Test runtime/Nestmates/membership/
/TestNestHostErrorWithMultiThread.java failed: Unexpected
interrupt
+ JDK-8373101: JdkClient and JdkServer test classes ignore
namedGroups field
+ JDK-8373239: Test java/awt/print/PrinterJob/PageRanges.java
fails with incorrect selection of printed pages
+ JDK-8373275: Improve DTLS handshaking
+ JDK-8373623: Refactor Serialization tests for Records to JUnit
+ JDK-8373650: Test 'javax/swing/JMenuItem/6458123/
/ManualBug6458123.java' fails because the check icons are not
aligned properly as expected
+ JDK-8373690: Unexpected Keystore message using
jdk.crypto.disabledAlgorithms
+ JDK-8373716: Refactor further java/util tests from TestNG to
JUnit
+ JDK-8373807: test/jdk/java/net/httpclient/websocket/
/DummyWebSocketServer.java getURI() uses 'localhost'
+ JDK-8373847: Test javax/swing/JMenuItem/MenuItemTest/
/bug6197830.java failed because The test case automatically
fails when clicking any items in the “Nothing†menu in all
four windows (Left-to-right)-Menu Item Test and
(Right-to-left)-Menu Item Test
+ JDK-8373869: Refactor java/net/httpclient/
/ThrowingPushPromises*.java tests to use JUnit5
+ JDK-8373928: 4 Dangling pointer defect groups in java.c
+ JDK-8373931: Test javax/sound/sampled/Clip/
/AutoCloseTimeCheck.java timed out
+ JDK-8374058: Enhance JPEG handling
+ JDK-8374178: Missing include in systemDictionary.cpp after
JDK-8365526
+ JDK-8374304: MultiResolutionSplashTest.java fails in CI:
'Image with wrong resolution is used for splash screen!'
+ JDK-8374433: java/util/Locale/PreserveTagCase.java does not
run any tests
+ JDK-8374506: Incorrect positioning of arrow icon in parent
JMenu in Windows L&F
+ JDK-8374548: Process httpserver cancelled keys more quickly
+ JDK-8374555: No need for visible input warning in
s.s.u.Password when not reading from System.in
+ JDK-8374711: Hotspot runtime/CommandLine/OptionsValidation/
/TestOptionsWithRanges fails without printing the option name
+ JDK-8374888: Implement internal test cache to help
UserIterCount test performance
+ JDK-8374998: Failing os::write - remove bad file
+ JDK-8375065: Update LCMS to 2.18
+ JDK-8375080: The tools/jpackage/windows/Win8365790Test.java
may fail with ClassNotFoundException: jtreg.SkippedException
+ JDK-8375231: Refactor util/ServiceLoader tests to use JUnit
+ JDK-8375232: Refactor util/StringJoiner tests to use JUnit
+ JDK-8375233: Refactor util/Vector tests to use JUnit
+ JDK-8375999: com/sun/jndi/ldap/LdapPoolTimeoutTest.java fails
sporadically on Windows
+ JDK-8376031: HttpsURLConnection.getServerCertificates() throws
'java.lang.IllegalStateException: connection not yet open' for
the HEAD method
+ JDK-8376152: Test javax/sound/sampled/Clip/bug5070081.java
timed out then completed
+ JDK-8376233: Clean up code in Desktop native peer
+ JDK-8377158: Enhance XBM image support
+ JDK-8377167: javax/imageio/ReadAbortTest.java throw NPE when
x11 unavailable
+ JDK-8377498: Improve HttpServer handling
+ JDK-8377602: Create automated test for PageRange
+ JDK-8377678: G1: Heap Dumping crashes with -UseClassUnloading
+ JDK-8377727: Ghost caret and focus appear in non‑editable text
fields
+ JDK-8377833: Enhance Jar file processing
+ JDK-8377910: Minor cleanup of java/io/FileDescriptor/
/Sharing.java
+ JDK-8377944: LowMemoryTest2.java#id1 intermittent fails OOME:
Metaspace
+ JDK-8378113: Add sun/java2d/OpenGL/ScaleParamsOOB.java to the
ProblemList.txt file
+ JDK-8378201: [OGL] glXMakeContextCurrent() drops the buffers
of the unbound drawable
+ JDK-8378417: Printing All pages results in NPE for 1.1
PrintJob
+ JDK-8378687: Improve delegation of HttpURLConnection
+ JDK-8378777: Bump update version for OpenJDK: jdk-17.0.20
+ JDK-8378802: [21u] backport changes to TKit.java by
JDK-8352419
+ JDK-8380316: Test runtime/os/AvailableProcessors.java fails
Invalid argument
+ JDK-8380565: PPC64: deoptimization stub should save vector
registers
+ JDK-8380672: Improve certification checking
+ JDK-8380947: Add pull request template
+ JDK-8381039: Enhance AWT ImagingLib
+ JDK-8381049: Enhance Jar handling
+ JDK-8381205: GHA: Upgrade Node.js 20 to 24
+ JDK-8381519: Enhance Der Value Handling
+ JDK-8381796: Enhance Certificate parsing
+ JDK-8382242: JFR: Metadata reconstruction invalidates
ConstantMap for java.lang.String
+ JDK-8383175: (tz) Update Timezone Data to 2026b
+ JDK-8383354: Update LCMS to 2.19.1
+ JDK-8383473: Follow on from tzdata2026b time change to include
temporary hack BC time change
+ JDK-8383601: RISC-V:
ShenandoahBarrierSetAssembler::load_reference_barrier calls
'weak' on 'phantom' path
+ JDK-8383630: Fix iteration in tests doing class redefinition
+ JDK-8383659: [17u] JVM crashes during stub routines generation
on Windows and rare combination of CPU features
+ JDK-8384158: GHA: Downgrade Windows GHA runners to
windows-2022 temporarily
+ JDK-8384486: NTLM tests fail on Windows 11 and Windows Server
2025
+ JDK-8384495: Update Libpng to 1.6.58
+ JDK-8384540: [25u, 21u, 17u] Update GHA JDKs after Apr/26
updates
+ JDK-8384815: SelectOneKeyOutOfMany and PreferredKey fail after
expired test certificate
+ JDK-8384902: Update GIFlib to 6.1.3
+ JDK-8385390: Update FreeType to 2.14.3
+ JDK-8385490: Update HarfBuzz to 14.2.0
+ JDK-8386343: [17u] Fix NTLMHeadTest after backport of 8384486
+ JDK-8386551: Windows build broken because of MSys2/Make update
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3444-1
Released: Fri Jul 31 22:04:31 2026
Summary: Security update for openssl-3
Type: security
Severity: moderate
References: 1271712
This update for openssl-3 fixes the following issues:
- HollowByte: DoS vector against OpenSSL TLS ClientHello via remote, attacker-controlled memory allocations
(bsc#1271712).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3493-1
Released: Tue Aug 4 14:11:00 2026
Summary: Security update for libpng16
Type: security
Severity: important
References:
This update for libpng16 fixes the following issues:
Changes for libpng16:
- version update to 1.6.58 (jsc#PED-16190).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2026:3618-1
Released: Fri Aug 14 07:18:50 2026
Summary: Recommended update for apache-logging-parent, log4j
Type: recommended
Severity: moderate
References:
This update for apache-logging-parent, log4j fixes the following issues:
apache-logging-parent:
- Upgrade to logging-parent 12.1.1
* Main changes
+ Update to the latest upstream release (includes major updates
from versions 10, 11, and 12).
+ Better Security Tracking: Added tools (CycloneDX) to
automatically list all software ingredients (SBOM) used in the
build.
+ Updated Java Module Building: Swapped the old
maven-bundle-plugin for bnd-maven-plugin to better handle OSGi
and modern Java modules.
+ Stricter Code Quality: Added spotless-maven-plugin to enforce
a standard code style, and grouped bug-catching tools (Error
Prone, SpotBugs) into one place.
+ New Changelog System: Replaced the old Maven changes plugin
with a custom log4j-changelog-maven-plugin for managing
release notes.
+ Standardized Automation: Centralized GitHub Actions workflows
to make testing, building, and deploying more consistent
across projects.
+ Reliable Builds: Updated core Maven plugins and enforced
strict timestamp settings so that the same source code always
produces the exact same final files (reproducible builds).
log4j:
- Build with apache-logging-parent 12.1.1
+ Full osgi metadata generation
+ Bring back the annotation processing and generating the
Log4j2Plugins.dat descriptors
The following package changes have been done:
- glibc-2.38-150600.14.52.1 updated
- libgcc_s1-15.3.0+git11272-150000.1.12.1 updated
- libstdc++6-15.3.0+git11272-150000.1.12.1 updated
- libopenssl3-3.2.3-150700.5.40.1 updated
- libgcrypt20-1.11.0-150700.5.10.1 updated
- libopenssl-3-fips-provider-3.2.3-150700.5.40.1 updated
- openssl-3-3.2.3-150700.5.40.1 updated
- libasound2-1.2.10-150600.4.3.1 updated
- libpng16-16-1.6.58-150600.3.23.1 updated
- libsystemd0-254.27-150600.4.71.2 updated
- java-17-openjdk-headless-17.0.20.0-150400.3.69.1 updated
- stax2-api-4.3.0-150200.3.8.1 added
- jackson-core-2.18.9-150200.3.25.1 updated
- jackson-annotations-2.18.9-150200.3.25.1 updated
- woodstox-core-7.2.1-150200.3.10.1 added
- jackson-databind-2.18.9-150200.3.33.1 updated
- jackson-dataformat-xml-2.18.8-150200.5.5.1 added
- log4j-2.26.1-150200.4.42.1 updated
- container:bci-bci-base-15.7-4de2a562289c9545ddd1e888292b3fa87a6156d62d9bb6f2574c92a9e0e8fe98-0 updated
More information about the sle-container-updates
mailing list