SUSE-IU-2026:5863-1: Security update of suse/sl-micro/6.1/base-os-container

[sle-container-updates at lists.suse.com]

SUSE Image Update Advisory: suse/sl-micro/6.1/base-os-container
-----------------------------------------------------------------
Image Advisory ID : SUSE-IU-2026:5863-1
Image Tags        : suse/sl-micro/6.1/base-os-container:2.2.1 , suse/sl-micro/6.1/base-os-container:2.2.1-5.152 , suse/sl-micro/6.1/base-os-container:latest
Image Release     : 5.152
Severity          : important
Type              : security
References        : 1192869 1217580 1217584 1217585 1241661 1253245 1257490 1257625
                        1258163 1258167 1261400 1261982 1261983 1262305 1267644 1267647
                        1268402 1268407 1268409 1268413 1268415 1268416 1268417 1268420
                        1268422 1268427 CVE-2021-42380 CVE-2023-42363 CVE-2023-42364
                        CVE-2023-42365 CVE-2025-46394 CVE-2025-60876 CVE-2026-10536 CVE-2026-12064
                        CVE-2026-26157 CVE-2026-26158 CVE-2026-40226 CVE-2026-8286 CVE-2026-8458
                        CVE-2026-8924 CVE-2026-8927 CVE-2026-9079 CVE-2026-9080 CVE-2026-9545
                        CVE-2026-9547 
-----------------------------------------------------------------

The container suse/sl-micro/6.1/base-os-container was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: 619
Released:    Tue Jul 21 18:46:43 2026
Summary:     Security update for curl
Type:        security
Severity:    important
References:  1192869,1217580,1217584,1217585,1241661,1253245,1258163,1258167,1268402,1268407,1268409,1268413,1268415,1268416,1268417,1268420,1268422,1268427,CVE-2021-42380,CVE-2023-42363,CVE-2023-42364,CVE-2023-42365,CVE-2025-46394,CVE-2025-60876,CVE-2026-10536,CVE-2026-12064,CVE-2026-26157,CVE-2026-26158,CVE-2026-8286,CVE-2026-8458,CVE-2026-8924,CVE-2026-8927,CVE-2026-9079,CVE-2026-9080,CVE-2026-9545,CVE-2026-9547
This update for curl fixes the following issues

- CVE-2026-8286: wrong STARTTLS connection reuse (bsc#1268402).
- CVE-2026-8458: wrong reuse for different services (bsc#1268407).
- CVE-2026-8924: traling dot domain super cookie (bsc#1268409).
- CVE-2026-8927: env-set cross-proxy Digest auth state leak (bsc#1268413).
- CVE-2026-9079: stale proxy password leak (bsc#1268415).
- CVE-2026-9080: UAF after pause in socket callback (bsc#1268416).
- CVE-2026-9545: exposing HTTP/3 early data (bsc#1268417).
- CVE-2026-9547: SSH improper host validation (bsc#1268420).
- CVE-2026-10536: HTTP/2 stream-dependency tree UAF (bsc#1268422).
- CVE-2026-12064: proto-default skips SSH verification (bsc#1268427).

-----------------------------------------------------------------
Advisory ID: 622
Released:    Tue Jul 21 20:32:40 2026
Summary:     Security update for systemd
Type:        security
Severity:    important
References:  1257490,1257625,1261400,1261982,1261983,1262305,1267644,1267647,CVE-2026-40226
This update for systemd fixes the following issues

Security issues fixed:

- CVE-2026-40226: nspawn: escape-to-host via malformed optional config file (bsc#1261400).

Other updates and bugfixes:

- Import commit 260e668bfa (bsc#1267647 bsc#1262305 bsc#1267644).
- Import commit 58e5d2e21e (bsc#1261982).
- Import commit 4bd91117cc (bsc#1261983).


The following package changes have been done:

- libudev1-254.27-slfo.1.1_5.1 updated
- libsystemd0-254.27-slfo.1.1_5.1 updated
- SL-Micro-release-6.1-slfo.1.12.53 updated
- systemd-254.27-slfo.1.1_5.1 updated
- udev-254.27-slfo.1.1_5.1 updated
- libcurl4-8.14.1-slfo.1.1_8.1 updated
- curl-8.14.1-slfo.1.1_8.1 updated
- container:suse-toolbox-image-1.0.0-5.73 updated