SUSE-IU-2026:1388-1: Security update of suse/sl-micro/6.1/baremetal-os-container

[sle-container-updates at lists.suse.com]

SUSE Image Update Advisory: suse/sl-micro/6.1/baremetal-os-container
-----------------------------------------------------------------
Image Advisory ID : SUSE-IU-2026:1388-1
Image Tags        : suse/sl-micro/6.1/baremetal-os-container:2.2.1 , suse/sl-micro/6.1/baremetal-os-container:2.2.1-7.67 , suse/sl-micro/6.1/baremetal-os-container:latest
Image Release     : 7.67
Severity          : important
Type              : security
References        : 1229122 1245223 1246118 1246912 1247719 1247720 1247816 1251198
                        1251199 1257029 1257031 1257041 1257042 1257044 1257046 1257108
                        1258166 1258859 CVE-2025-11468 CVE-2025-12781 CVE-2025-15282
                        CVE-2025-15366 CVE-2025-15367 CVE-2025-4674 CVE-2025-47906 CVE-2025-47907
                        CVE-2025-61984 CVE-2025-61985 CVE-2026-0672 CVE-2026-0865 CVE-2026-3184
-----------------------------------------------------------------

The container suse/sl-micro/6.1/baremetal-os-container was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: 437
Released:    Tue Mar 10 19:41:43 2026
Summary:     Security update for openssh
Type:        security
Severity:    moderate
References:  1246912,1251198,1251199,1258166,CVE-2025-61984,CVE-2025-61985
This update for openssh fixes the following issues:

- CVE-2025-61984: code execution via control characters in usernames when a ProxyCommand is used (bsc#1251198).
- CVE-2025-61985: code execution via '\0' character in ssh: // URI when a ProxyCommand is used (bsc#1251199).

-----------------------------------------------------------------
Advisory ID: 435
Released:    Tue Mar 10 19:43:23 2026
Summary:     Security update for util-linux
Type:        security
Severity:    moderate
References:  1229122,1246118,1247719,1247720,1247816,1258859,CVE-2025-4674,CVE-2025-47906,CVE-2025-47907,CVE-2026-3184
This update for util-linux fixes the following issue:

- CVE-2026-3184: access control bypass due to improper hostname canonicalization in `login` (bsc#1258859).

-----------------------------------------------------------------
Advisory ID: 434
Released:    Tue Mar 10 20:08:57 2026
Summary:     Security update for python311
Type:        security
Severity:    important
References:  1245223,1257029,1257031,1257041,1257042,1257044,1257046,1257108,CVE-2025-11468,CVE-2025-12781,CVE-2025-15282,CVE-2025-15366,CVE-2025-15367,CVE-2026-0672,CVE-2026-0865
This update for python311 fixes the following issues:

- CVE-2025-11468: preserving parens when folding comments in email headers. (bsc#1257029)
- CVE-2026-0672: rejects control characters in http cookies. (bsc#1257031)
- CVE-2026-0865: rejecting control characters in wsgiref.headers.Headers, which could be abused for injecting false HTTP headers. (bsc#1257042)
- CVE-2025-15366: basically the same as the previous patch for IMAP protocol. (bsc#1257044)
- CVE-2025-15282: basically the same as the previous patch for urllib library. (bsc#1257046)
- CVE-2025-15367: basically the same as the previous patch for poplib library. (bsc#1257041)
- CVE-2025-12781: fix decoding with non-standard Base64 alphabet (bsc#1257108)


The following package changes have been done:

- libuuid1-2.40.4-slfo.1.1_4.1 updated
- libsmartcols1-2.40.4-slfo.1.1_4.1 updated
- libblkid1-2.40.4-slfo.1.1_4.1 updated
- libmount1-2.40.4-slfo.1.1_4.1 updated
- libfdisk1-2.40.4-slfo.1.1_4.1 updated
- util-linux-2.40.4-slfo.1.1_4.1 updated
- SL-Micro-release-6.1-slfo.1.12.15 updated
- util-linux-systemd-2.40.4-slfo.1.1_4.1 updated
- gpg2-2.4.4-slfo.1.1_8.1 updated
- openssh-common-9.6p1-slfo.1.1_3.1 updated
- python311-base-3.11.14-slfo.1.1_3.1 updated
- libpython3_11-1_0-3.11.14-slfo.1.1_3.1 updated
- openssh-server-9.6p1-slfo.1.1_3.1 updated
- openssh-clients-9.6p1-slfo.1.1_3.1 updated
- python311-3.11.14-slfo.1.1_3.1 updated
- openssh-9.6p1-slfo.1.1_3.1 updated
- container:SL-Micro-base-container-2.2.1-5.89 updated