SUSE-IU-2026:8637-1: Security update of suse/sl-micro/6.1/baremetal-os-container
sle-container-updates at lists.suse.com
sle-container-updates at lists.suse.com
Tue Nov 10 08:42:41 UTC 2026
SUSE Image Update Advisory: suse/sl-micro/6.1/baremetal-os-container
-----------------------------------------------------------------
Image Advisory ID : SUSE-IU-2026:8637-1
Image Tags : suse/sl-micro/6.1/baremetal-os-container:2.2.1 , suse/sl-micro/6.1/baremetal-os-container:2.2.1-7.200 , suse/sl-micro/6.1/baremetal-os-container:latest
Image Release : 7.200
Severity : important
Type : security
References : 1264459 1265781 1266622 1266789 1272088 1277992 1278164 1279213
1279312 1279911 1279912 1279996 CVE-2026-19201 CVE-2026-33814
CVE-2026-37236 CVE-2026-39821 CVE-2026-43284 CVE-2026-56852 CVE-2026-79775
CVE-2026-83530 CVE-2026-84303 CVE-2026-84304
-----------------------------------------------------------------
The container suse/sl-micro/6.1/baremetal-os-container was updated. The following patches have been included in this update:
-----------------------------------------------------------------
Advisory ID: 778
Released: Mon Nov 9 18:55:55 2026
Summary: Security update for elemental-operator, elemental-system-agent, elemental-toolkit
Type: security
Severity: important
References: 1264459,1265781,1266622,1266789,1272088,1277992,1278164,1279213,1279312,1279911,1279912,1279996,CVE-2026-19201,CVE-2026-33814,CVE-2026-37236,CVE-2026-39821,CVE-2026-43284,CVE-2026-56852,CVE-2026-79775,CVE-2026-83530,CVE-2026-84303,CVE-2026-84304
This update for elemental-operator, elemental-system-agent, elemental-toolkit fixes the following issues:
- CVE-2026-19201: github.com/google/go-attestation/attest: unbounded recursion in Windows ELAM parsing (bsc#1279911
bsc#1279912).
- CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE
(bsc#1265781).
- CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST
request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277992).
- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation
bypass and privilege escalation (bsc#1266622 bsc#1266789).
- CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272088).
- CVE-2026-79775: github.com/diskfs/go-diskfs: malformed SquashFS image can cause crashes and persistent CPU loops in
rclone's archive backend (bsc#1278164).
- CVE-2026-83530: github.com/google/cel-go/cel: no enforcement of expression size limit before source construction can
lead to excessive resource consumption (bsc#1279996).
- CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization
policies via mixed-case or canonical-case header matches (bsc#1279312).
- CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279213).
Changes for elemental-operator:
- Update to v1.7.6:
* c8a50f8d Bump k8s.io/kubernetes v1.34.2
* 4bcb1775 Fix unit tests after bumping libraries
* 4f5ba8f1 Fix sporadic failures in unit tests
* 39cb29e7 Bump github.com/rancher/yip v1.9.7
* 58bc6f97 User Rewrite function instead of a Director function in
ReverseProxy
* de920645 Bum github.com/rancher-sandbox/go-tpm
* 25012c7a Bump to golang 1.26
* 059e95d3 Bump github.com/google/go-attestation v0.6.4. Includes
fixes for:
- bsc#1279912 (CVE-2026-19201)
- bsc#1279911 (CVE-2026-19201)
* 24e86f69 Bump test environment
* 2230e1d6 Bump generators
* 0d1f058b Bump google.golang.org/grpc v1.83.2. Includes fixes for:
- bsc#1279213 (CVE-2026-84304)
* ab1381a3 Bump github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0.
Includes fixes for:
- bsc#1277992 (CVE-2026-37236)
* a7d549bf Bump github.com/rancher/wrangler/v3 v3.6.1. Includes
- bsc#1272088 (CVE-2026-56852)
- bsc#1279312 (CVE-2026-84303)
- bsc#1266789 (CVE-2026-39821)
- bsc#1266622 (CVE-2026-39821)
* b0686910 Bump wrangler from v2 to v3
* 78c027e4 Run make generator
* e84090f5 Update controller runtime options
* b95756fa Do not allow installing unpinned go modules
* c19b694f Add a checksum validation for go-tpm code
* 09c2a821 Run make vendor
* 273f3903 Updated cluster-api, steve, rancher/apis, client-go and k8s/api
to the level they were at rancher v2.13
Changes for elemental-system-agent-pool:
- Update to version 0.15.2:
* fix: swap kubectl download to cowboy-builder rpm
* Update module golang.org/x/crypto to v0.56.0 [SECURITY]
* Update module google.golang.org/grpc to v1.83.2 [SECURITY]
* Update module golang.org/x/mod to v0.40.0 [SECURITY]
* Update module github.com/google/cel-go to v0.30.0 [SECURITY]
* Update module go.etcd.io/etcd/client/pkg/v3 to v3.6.14 [SECURITY]
* Update module github.com/klauspost/compress to v1.18.7 [SECURITY]
This version includes fixes for:
- bsc#1279996 (CVE-2026-83530)
- bsc#1279312 (CVE-2026-84303)
- bsc#1279213 (CVE-2026-84304)
- Update to version 0.15.1:
* [2.15] Bump go toolchain to 1.26.7 (#426)
* Bump dependencies (#421)
* Update README (#404)
* add uninstall flag (#384)
* some cve fixes, notably x/net and kubectl versions (#359)
* Update actions/checkout action to v7
* Update actions/upload-artifact action to v7
* Update actions/setup-go action to v6.4.0
* Update rancher/renovate-config digest to fc79cf4
* Update registry.suse.com/bci/bci-micro Docker tag to v16
* switch renovate over to the newer configuration (#293)
* bump kubectl to 1.36.1 (#292)
* add release branches to renovate config (#289)
* Fix swapped kubectl checksums in SUC release image build (#286)
* Document versioning schema and branch strategy aligned with Rancher minor releases (#280)
* bumping CAPI to v1.13.2 and wrangler unrc version
* bump k8s v1.36
* fix logs collection
* test: add new Plan State integration tests
* chore: bump rancher/rancher/pkg/plan to consume Plan States
* test: add e2e tests for Plan States lifecycle
* feat: Adapt code to use Plan States
* Add README.md for integration tests
* Improve comments in scripts and logging
* Adapt test framework code to use new pkg/plan library from rancher/rancher
* Add test/vendor to .gitignore
* Utilize new pkg/plan library from rancher/rancher
* bump the fallback version to v0.3.16
* add initial version of integration tests
- bsc#1277992 (CVE-2026-37236)
- bsc#1272088 (CVE-2026-56852)
- bsc#1265781 (CVE-2026-33814)
- bsc#1266622 (CVE-2026-39821)
Changes for elemental-toolkit-pool:
- Update to v2.2.10:
* b4749140 Revert 'Update spec dependecies and dracut module dependencies'
* ef7c40e7 Fix specfile on Micro 6.1 there is no grub2-common
* 82e000aa Bump k8s.io/mount-utils v0.33.3
* 35da0397 use rsync checksum to reliably copy data
* c3589f8d Only consider global Boot#### variables when clearing stale
entries
* 1ccc8702 Move to go1.26
* a6e6700a Update spec dependecies and dracut module dependencies
* 8eb1a7ff bump github.com/rancher/yip v1.9.7. Includes fixes for:
- bsc#1278164 (CVE-2026-79775)
* d22698bf Fix logging messages
* 1ad64162 bump github.com/onsi/ginkgo/v2 v2.32.2
* 41301012 bump github.com/containerd/containerd v1.7.36. Includes
fixes for:
- bsc#1272088 (CVE-2026-56852)
The following package changes have been done:
- elemental-register-1.7.6-slfo.1.1_1.1 updated
- elemental-support-1.7.6-slfo.1.1_1.1 updated
- elemental-system-agent-0.15.2-slfo.1.1_1.1 updated
- elemental-toolkit-2.2.10-slfo.1.1_1.1 updated
- container:SL-Micro-base-container-2.2.1-5.214 updated
More information about the sle-container-updates
mailing list