SUSE-CU-2026:1274-1: Security update of suse/manager/4.3/proxy-httpd

[sle-container-updates at lists.suse.com]

SUSE Container Update Advisory: suse/manager/4.3/proxy-httpd
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2026:1274-1
Container Tags        : suse/manager/4.3/proxy-httpd:4.3.16.2 , suse/manager/4.3/proxy-httpd:4.3.16.2.9.73.17 , suse/manager/4.3/proxy-httpd:latest
Container Release     : 9.73.17
Severity              : important
Type                  : security
References            : 1257029 1257031 1257041 1257042 1257044 1257046 CVE-2025-11468
                        CVE-2025-15282 CVE-2025-15366 CVE-2025-15367 CVE-2026-0672 CVE-2026-0865
-----------------------------------------------------------------

The container suse/manager/4.3/proxy-httpd was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:664-1
Released:    Thu Feb 26 16:15:04 2026
Summary:     Security update for python3
Type:        security
Severity:    important
References:  1257029,1257031,1257041,1257042,1257044,1257046,CVE-2025-11468,CVE-2025-15282,CVE-2025-15366,CVE-2025-15367,CVE-2026-0672,CVE-2026-0865
This update for python3 fixes the following issues:

- CVE-2025-11468: header injection when folding a long comment in an email header containing exclusively unfoldable
  characters (bsc#1257029).
- CVE-2026-0672: HTTP header injection via user-controlled cookie values and parameters when using http.cookies.Morsel
  (bsc#1257031).
- CVE-2026-0865: user-controlled header containing newlines can allow injecting HTTP headers (bsc#1257042).
- CVE-2025-15366: user-controlled command can allow additional commands injected using newlines (bsc#1257044).
- CVE-2025-15282: user-controlled data URLs parsed may allow injecting headers (bsc#1257046).
- CVE-2025-15367: control characters may allow the injection of additional commands (bsc#1257041).


The following package changes have been done:

- python3-base-3.6.15-150300.10.106.1 updated
- libpython3_6m1_0-3.6.15-150300.10.106.1 updated
- python3-3.6.15-150300.10.106.1 updated