SUSE-IU-2026:8644-1: Security update of suse/sl-micro/6.2/baremetal-os-container
sle-container-updates at lists.suse.com
sle-container-updates at lists.suse.com
Tue Nov 10 09:12:05 UTC 2026
SUSE Image Update Advisory: suse/sl-micro/6.2/baremetal-os-container
-----------------------------------------------------------------
Image Advisory ID : SUSE-IU-2026:8644-1
Image Tags : suse/sl-micro/6.2/baremetal-os-container:2.3.2 , suse/sl-micro/6.2/baremetal-os-container:2.3.2-9.29 , suse/sl-micro/6.2/baremetal-os-container:latest
Image Release : 9.29
Severity : important
Type : security
References : 1265781 1266622 1266789 1272088 1277992 1278164 1279213 1279312
1279911 1279912 1279996 CVE-2026-19201 CVE-2026-33814 CVE-2026-37236
CVE-2026-39821 CVE-2026-56852 CVE-2026-79775 CVE-2026-83530 CVE-2026-84303
CVE-2026-84304
-----------------------------------------------------------------
The container suse/sl-micro/6.2/baremetal-os-container was updated. The following patches have been included in this update:
-----------------------------------------------------------------
Advisory ID: 2071
Released: Mon Nov 9 16:41:01 2026
Summary: Security update for elemental, elemental-register, elemental-system-agent, elemental-toolkit
Type: security
Severity: important
References: 1265781,1266622,1266789,1272088,1277992,1278164,1279213,1279312,1279911,1279912,1279996,CVE-2026-19201,CVE-2026-33814,CVE-2026-37236,CVE-2026-39821,CVE-2026-56852,CVE-2026-79775,CVE-2026-83530,CVE-2026-84303,CVE-2026-84304
This update for elemental, elemental-register, elemental-system-agent, elemental-toolkit fixes the following issues:
- CVE-2026-19201: github.com/google/go-attestation/attest: unbounded recursion in Windows ELAM parsing (bsc#1279911
bsc#1279912).
- CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE
(bsc#1265781).
- CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client can override the HTTP method of a POST
request through the X-HTTP-Method-Override header and bypass established access control (bsc#1277992).
- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation
bypass and privilege escalation (bsc#1266622 bsc#1266789).
- CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on truncated/invalid UTF-8 input (bsc#1272088).
- CVE-2026-79775: github.com/diskfs/go-diskfs: malformed SquashFS image can cause crashes and persistent CPU loops in
rclone's archive backend (bsc#1278164).
- CVE-2026-83530: github.com/google/cel-go/cel: no enforcement of expression size limit before source construction can
lead to excessive resource consumption (bsc#1279996).
- CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization
policies via mixed-case or canonical-case header matches (bsc#1279312).
- CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279213).
Changes for elemental-pool:
- Update to v2.3.2:
* 9e6df8e Update KVM flavor to include iptables
Changes for elemental-register-pool:
- Update to v1.9.3:
* ee57a686 Bump github.com/rancher-sandbox/go-tpm
* 2a6c4918 Fix sporadic failures in unit tests
* 717137bd bump yip library
* 9c08fcac User Rewrite function instead of a Director function in
ReverseProxy
* 3073bcc1 Bump rancher-sandbox/go-tpm
* 0746e6be Bump grpc library to v1.83.2. Includes fixes for:
- bsc#1279213 (CVE-2026-84304)
* 56c83652 Bump to golang 1.26
* f37b9d62 bump go-attestation. Includes fixes for:
- bsc#1279912 (CVE-2026-19201)
- bsc#1279911 (CVE-2026-19201)
* 48e0352f Bump test environment
* f78effcf Bump generators
* 6c7818a2 Bump wrangler to v3.6.1. Includes fixes for:
- bsc#1272088 (CVE-2026-56852)
- bsc#1279312 (CVE-2026-84303)
- bsc#1266789 (CVE-2026-39821)
- bsc#1266622 (CVE-2026-39821)
* 0eeb3eac Bump grpc-ecosystem/grpc-gateway/v2. Includes fixes for:
- bsc#1277992 (CVE-2026-37236)
* 0c104e17 fix(tpm): fix duplicate emulated TPM seeds on UUID suffix
collision (#1018)
* 3605ef3f Change tags order to facilitate OBS builds
- Changes on top of v1.9.2:
* 893fbf0f Fix reference in labels
* dfaf68ac Adapt labels to pass OBS container checks
Changes for elemental-system-agent-pool:
- Update to version 0.15.2:
* fix: swap kubectl download to cowboy-builder rpm
* Update module golang.org/x/crypto to v0.56.0 [SECURITY]
* Update module google.golang.org/grpc to v1.83.2 [SECURITY]
* Update module golang.org/x/mod to v0.40.0 [SECURITY]
* Update module github.com/google/cel-go to v0.30.0 [SECURITY]
* Update module go.etcd.io/etcd/client/pkg/v3 to v3.6.14 [SECURITY]
* Update module github.com/klauspost/compress to v1.18.7 [SECURITY]
This version includes fixes for:
- bsc#1279996 (CVE-2026-83530)
- bsc#1279312 (CVE-2026-84303)
- bsc#1279213 (CVE-2026-84304)
- Update to version 0.15.1:
* [2.15] Bump go toolchain to 1.26.7 (#426)
* Bump dependencies (#421)
* Update README (#404)
* add uninstall flag (#384)
* some cve fixes, notably x/net and kubectl versions (#359)
* Update actions/checkout action to v7
* Update actions/upload-artifact action to v7
* Update actions/setup-go action to v6.4.0
* Update rancher/renovate-config digest to fc79cf4
* Update registry.suse.com/bci/bci-micro Docker tag to v16
* switch renovate over to the newer configuration (#293)
* bump kubectl to 1.36.1 (#292)
* add release branches to renovate config (#289)
* Fix swapped kubectl checksums in SUC release image build (#286)
* Document versioning schema and branch strategy aligned with Rancher minor releases (#280)
* bumping CAPI to v1.13.2 and wrangler unrc version
* bump k8s v1.36
* fix logs collection
* test: add new Plan State integration tests
* chore: bump rancher/rancher/pkg/plan to consume Plan States
* test: add e2e tests for Plan States lifecycle
* feat: Adapt code to use Plan States
* Add README.md for integration tests
* Improve comments in scripts and logging
* Adapt test framework code to use new pkg/plan library from rancher/rancher
* Add test/vendor to .gitignore
* Utilize new pkg/plan library from rancher/rancher
* bump the fallback version to v0.3.16
* add initial version of integration tests
- bsc#1277992 (CVE-2026-37236)
- bsc#1272088 (CVE-2026-56852)
- bsc#1265781 (CVE-2026-33814)
- bsc#1266622 (CVE-2026-39821)
Changes for elemental-toolkit-pool:
- Update to v2.3.5:
* 61bb7271 use rsync checksum to reliably copy data
* a5e33158 Only consider global Boot#### variables when clearing stale
entries
* 74b76a97 Move to go1.26
* c591fd27 Bump yip library. Includes fixes for:
- bsc#1278164 (CVE-2026-79775)
* 3aa381e5 Fix logging messages
* 661d3ae2 Bump ginkgo
* 04624721 Bump containerd. Includes fixes for:
- bsc#1272088 (CVE-2026-56852)
The following package changes have been done:
- elemental-updater-2.3.2-160000.1.1 updated
- elemental-2.3.2-160000.1.1 updated
More information about the sle-container-updates
mailing list