SUSE-CU-2026:14100-1: Security update of rancher/elemental-operator

sle-container-updates at lists.suse.com sle-container-updates at lists.suse.com
Thu Nov 12 15:11:51 UTC 2026 

SUSE Container Update Advisory: rancher/elemental-operator
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2026:14100-1
Container Tags        : rancher/elemental-operator:1.8.3 , rancher/elemental-operator:1.8.3-7.1
Container Release     : 7.1
Severity              : important
Type                  : security
References            : 1268867 1269664 1272698 1274723 1274726 1276892 1276946 1277247
                        1277262 1277707 1277708 1277709 1277710 1277711 1277712 1277713
                        1277921 1277922 1279893 1279961 1280049 1280050 1280051 1280052
                        1280053 1280054 1280702 1281297 1282509 1283342 1286261 1287180
                        CVE-2026-103111 CVE-2026-114406 CVE-2026-13757 CVE-2026-18374
                        CVE-2026-18938 CVE-2026-19499 CVE-2026-19542 CVE-2026-54369 CVE-2026-54370
                        CVE-2026-54371 CVE-2026-56391 CVE-2026-6368 CVE-2026-6791 CVE-2026-77117
                        CVE-2026-80489 CVE-2026-86145 CVE-2026-8674 CVE-2026-86805 CVE-2026-89156
                        CVE-2026-89157 CVE-2026-89158 CVE-2026-89160 CVE-2026-89161 CVE-2026-89162
-----------------------------------------------------------------

The container rancher/elemental-operator was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: 1661
Released:    Fri Sep 11 13:45:57 2026
Summary:     Security update for acl, attr
Type:        security
Severity:    important
References:  1268867,CVE-2026-54369,CVE-2026-54370,CVE-2026-54371
This update for acl, attr fixes the following issue:

- CVE-2026-54369,CVE-2026-54370,CVE-2026-54371: Symlink Traversal Privilege Escalation via getfattr/setfattr,
  getfacl/setfacl/chacl, libacl (bsc#1268867).

Changes for acl:

- Update to 2.4.0 (jsc#PED-16501):
 Major Issues Fixed:
 - The libacl library functions acl_get_file(), acl_set_file(),
 acl_extended_file(), and acl_delete_def_file() take a pathname argument
 and follow symbolic links. When a privileged user calls one of those
 functions, an attacker that controls a pathname component can replace a
 file or directory with a symbolic link and redirect the operation to a
 different file. This can lead to local privilege escalation.
 (CVE-2026-54369, bsc#1268867)
 The library functions cannot be fixed without breaking compatibility; the
 described behaviour is by design.
 Instead, version 2.4.0 of the acl package introduces the additional
 functions acl_get_file_at(), acl_set_file_at(), acl_extended_file_at(), and
 acl_delete_def_file_at(). These functions each take a dirfd file
 descriptor argument and an at_flags argument and accept the
 AT_SYMLINK_NOFOLLOW and AT_EMPTY_PATH flags. Use these functions to
 control when to follow symbolic links. (CVE-2026-54370, bsc#1268867)
 In addition, the libacl functions acl_get_fd(), acl_set_fd(), and
 acl_extended_fd() functions always operate on the access ACL; the library
 previously did not offer a way to operate on the default ACL of a directory
 file descriptor. The new functions remove that restriction.
 It will be up to each individual program to start using these new library
 functions where appropriate.
 - When walking directory trees, the getfacl, setfacl, chacl, and getfattr
 utilities constructed the full pathname of each file in the tree and use that
 pathname to access the file. When a privileged user used those utilities,
 an attacker that controlled a pathname component could replace a directory with
 a symbolic link and redirect the operation to a different file, leading to
 a local privilege escalation. (CVE-2026-54371, bsc#1268867)
 This is fixed by using directory file descriptors and operating relative to
 those directory file descriptors.
 - When resolving the final pathname component, the getfacl, setfacl, chacl,
 getfattr, and setfattr utilities in some cases used functions that resolve
 symbolic links. This includes the above mentioned libacl functions, but
 also stat(), chmod(), and chown().
 This is fixed by using symlink-safe functions throughout the code.
 - When restoring a backup, the setfacl and setfattr utilities read the full
 pathnames of files from the backup. When those pathnames were resolved,
 pathname components that are symbolic links were traversed. An attacker
 that controlled a pathname component could replace it with a symbolic link,
 causing a privileged user to operate on a file other than the one intended.
 This could lead to the same kind of local privilege escalation as discussed
 before.
 This is fixed by using openat2(RESOLVE_NO_SYMLINKS) to resolve the
 directory components of a pathname, but see Compatibility Notes below for
 the details.
Minor Issues Fixed:
 - When a symbolic link was specified on the command line but symbolic link
 traversal was disabled using option -P (--physical), the getfacl and
 setfacl utilities previously silently ignored the symlink. Now, an ELOOP
 ('Too many levels of symbolic links') error will result instead.
 - acl_delete_entry() now verifies that the specified entry belongs to the
 specified acl.
 - Numeric uids and gids that cannot be represented in types uid_t and gid_t
 are checked more carefully and invalid numbers are rejected.
 - Functions acl_get_file(), acl_get_file_at(), and acl_get_fd() will retry
 several times when the size of an ACL grows unexpectedly; previously, they
 only grew the allocated buffer once before giving up.
 - When passed a directory file descriptor, function perm_copy_fd() didn't
 copy the default ACL from one directory to the other. It now does.
 - setfacl --restore accidentally ignored leading whitespace in filenames. It
 no longer does.
 - setfacl --restore accidentally called chmod() when in --test mode. It no
 longer does.
 - When the setfattr --restore option was used multiple times, a buffer was
 accessed after being freed. This no longer happens.
 - When the setfattr -h (--no-dereference) option was given after --restore,
 it was ignored. Now, the options can be passed in any order.
 - The -h (--no-dereference) option of getfattr prevented getfattr from
 recursing into 'symbolic link directories'. This is wrong. When dirlink
 is a symbolic link that refers to a directory, 'getfattr -Rh dirlink' will now
 visit that directory. The -P (--physical) option can be used to prevent
 that.
 - Similarly, when a symbolic link referring to a directory was specified on
 the getfacl or setfacl command line, the -R option did not cause that
 directory to be visited. This has been fixed so that those directories
 will now be visited. The -P (--physical) option can be used to prevent

Changes for attr:

- Update to 2.6.0 (jsc#PED-16501):
Major Issues Fixed:
 - The libacl library functions acl_get_file(), acl_set_file(),
 acl_extended_file(), and acl_delete_def_file() take a pathname argument
 and follow symbolic links. When a privileged user calls one of those
 functions, an attacker that controls a pathname component can replace a
 file or directory with a symbolic link and redirect the operation to a
 different file. This can lead to local privilege escalation.
 (CVE-2026-54369, bsc#1268867)
 The library functions cannot be fixed without breaking compatibility; the
 described behaviour is by design.
 Instead, version 2.4.0 of the acl package introduces the additional
 functions acl_get_file_at(), acl_set_file_at(), acl_extended_file_at(), and
 acl_delete_def_file_at(). These functions each take a dirfd file
 descriptor argument and an at_flags argument and accept the
 AT_SYMLINK_NOFOLLOW and AT_EMPTY_PATH flags. Use these functions to
 control when to follow symbolic links. (CVE-2026-54370, bsc#1268867)
 In addition, the libacl functions acl_get_fd(), acl_set_fd(), and
 acl_extended_fd() functions always operate on the access ACL; the library
 previously did not offer a way to operate on the default ACL of a directory
 file descriptor. The new functions remove that restriction.
 It will be up to each individual program to start using these new library
 functions where appropriate.
 - When walking directory trees, the getfacl, setfacl, chacl, and getfattr
 utilities constructed the full pathname of each file in the tree
and use that
 pathname to access the file. When a privileged user used those utilities,
 an attacker that controlled a pathname component could replace a
directory with
 a symbolic link and redirect the operation to a different file, leading to
 a local privilege escalation. (CVE-2026-54371, bsc#1268867)
 This is fixed by using directory file descriptors and operating relative to
 those directory file descriptors.
 - When resolving the final pathname component, the getfacl, setfacl, chacl,
 getfattr, and setfattr utilities in some cases used functions that resolve
 symbolic links. This includes the above mentioned libacl functions, but
 also stat(), chmod(), and chown().
 This is fixed by using symlink-safe functions throughout the code.
 - When restoring a backup, the setfacl and setfattr utilities read the full
 pathnames of files from the backup. When those pathnames were resolved,
 pathname components that are symbolic links were traversed. An attacker
 that controlled a pathname component could replace it with a symbolic link,
 causing a privileged user to operate on a file other than the one intended.
 This could lead to the same kind of local privilege escalation as discussed
 before.
 This is fixed by using openat2(RESOLVE_NO_SYMLINKS) to resolve the
 directory components of a pathname, but see Compatibility Notes below for
 the details.
Minor Issues Fixed:
 - When a symbolic link was specified on the command line but symbolic link
 traversal was disabled using option -P (--physical), the getfacl and
 setfacl utilities previously silently ignored the symlink. Now, an ELOOP
 ('Too many levels of symbolic links') error will result instead.
 - acl_delete_entry() now verifies that the specified entry belongs to the
 specified acl.
 - Numeric uids and gids that cannot be represented in types uid_t and gid_t
 are checked more carefully and invalid numbers are rejected.
 - Functions acl_get_file(), acl_get_file_at(), and acl_get_fd() will retry
 several times when the size of an ACL grows unexpectedly; previously, they
 only grew the allocated buffer once before giving up.
 - When passed a directory file descriptor, function perm_copy_fd() didn't
 copy the default ACL from one directory to the other. It now does.
 - setfacl --restore accidentally ignored leading whitespace in filenames. It
 no longer does.
 - setfacl --restore accidentally called chmod() when in --test mode. It no
 longer does.
 - When the setfattr --restore option was used multiple times, a buffer was
 accessed after being freed. This no longer happens.
 - When the setfattr -h (--no-dereference) option was given after --restore,
 it was ignored. Now, the options can be passed in any order.
 - The -h (--no-dereference) option of getfattr prevented getfattr from
 recursing into 'symbolic link directories'. This is wrong. When dirlink
 is a symbolic link that refers to a directory, 'getfattr -Rh
dirlink' will now
 visit that directory. The -P (--physical) option can be used to prevent
 that.
 - Similarly, when a symbolic link referring to a directory was specified on
 the getfacl or setfacl command line, the -R option did not cause that
 directory to be visited. This has been fixed so that those directories
 will now be visited. The -P (--physical) option can be used to prevent

-----------------------------------------------------------------
Advisory ID: 1747
Released:    Wed Sep 23 21:42:24 2026
Summary:     Security update for pcre2
Type:        security
Severity:    important
References:  1277707,1277708,1277709,1277710,1277711,1277712,1277713,1279893,1280049,1280050,1280051,1280052,1280053,1280054,CVE-2026-86145,CVE-2026-89156,CVE-2026-89157,CVE-2026-89158,CVE-2026-89160,CVE-2026-89161,CVE-2026-89162
This update for pcre2 fixes the following issues:

- CVE-2026-86145: missing size checks in `pcre2_dfa_match` code can lead to an out-of-bounds write (bsc#1279893).
- CVE-2026-89156: out-of-bounds read via invalid UTF data during JIT fallback (bsc#1280054).
- CVE-2026-89157: out-of-bounds write via large pattern input (bsc#1280053).
- CVE-2026-89158: out-of-bounds write due to integer overflow in `pcre2_compile_32` for 32-bit platforms (bsc#1280052).
- CVE-2026-89160: out-of-bounds read during the `PCRE2_MATCH_INVALID_UTF` matching of an invalid UTF subject
  (bsc#1280051).
- CVE-2026-89161: incorrect free operation due to mishandling of a previously copied subject in `pcre2_jit_match`
  (bsc#1280050).
- CVE-2026-89162: information disclosure via `pcre2_serialize_encode` (bsc#1280049).

-----------------------------------------------------------------
Advisory ID: 1769
Released:    Tue Sep 29 14:25:10 2026
Summary:     Security update for glibc
Type:        security
Severity:    important
References:  1274723,1274726,1276892,1276946,1277247,1277262,1277921,1277922,1281297,1282509,CVE-2026-18374,CVE-2026-19499,CVE-2026-19542,CVE-2026-6368,CVE-2026-6791,CVE-2026-77117,CVE-2026-80489,CVE-2026-8674,CVE-2026-86805
This update for glibc fixes the following issues:

- CVE-2026-6368: invalid free via wordexp WRDE_APPEND rollback (bsc#1274726).
- CVE-2026-6791: stack overflow in wordexp tilde expansion (bsc#1274723).
- CVE-2026-8674: reachable assert in `resolv/resolv_conf.c:update_from_conf` allows an attacker in a local network to
  trigger a process crash (bsc#1281297).
- CVE-2026-18374: heap buffer overflow in the fopen ccs extension (bsc#1277262).
- CVE-2026-19499: buffer overflow in strfmon right-justification padding (bsc#1276892).
- CVE-2026-19542: out-of-bounds array write in tdelete (bsc#1276946).
- CVE-2026-77117: SHIFT_JISX0213 decoding lacks pending character reset (bsc#1277921).
- CVE-2026-80489: EUC_JISX0213 decoding lacks pending character reset (bsc#1277922).
- CVE-2026-86805: TOCTOU race condition in the dynamic loader allows local attackers to escalate privileges
  (bsc#1282509).

Other changes:

- Add -flive-patching=inline-clone to avoid untraceable inter-procedural optimizations (bsc#1277247).

-----------------------------------------------------------------
Advisory ID: 1790
Released:    Wed Sep 30 11:29:23 2026
Summary:     Recommended update for ca-certificates-mozilla
Type:        recommended
Severity:    moderate
References:  1279961
This update for ca-certificates-mozilla fixes the following issues:

Changes in ca-certificates-mozilla:

- Updated to 2.90 state (bsc#1279961):
    * Removed:
        +  AffirmTrust Commercial
        + AffirmTrust Networking
        + AffirmTrust Premium
        + AffirmTrust Premium ECC
        + certSIGN ROOT CA
        + Entrust Root Certification Authority
        + PKI Root Certification Authority
        + FIRMAPROFESIONAL CA ROOT-A WEB
        + GLOBALTRUST 2020
        + Secure Global CA
        + SecureSign Root CA12
        + SecureTrust CA
        + TeliaSonera Root CA v1
        + Trustwave Global Certification Authority
        + Trustwave Global ECC P256 Certification Authority
        + Trustwave Global ECC P384 Certification Authority
        + XRamp Global Certification Authority
    * Added:
        + SECOM SMIME RSA Root CA 2024
        + SECOM TLS ECC Root CA 2024
        + SECOM TLS RSA Root CA 2024
        + SecureSign Root CA16
        + Telia EC Email Root CA v3
        + Telia EC TLS Root CA v3
        + Telia RSA Email Root CA v3
        + Telia RSA TLS Root CA v3

-----------------------------------------------------------------
Advisory ID: 1919
Released:    Thu Oct 15 14:13:14 2026
Summary:     Security update for p11-kit
Type:        security
Severity:    moderate
References:  1269664,1280702,CVE-2026-13757,CVE-2026-18938
This update for p11-kit fixes the following issues:

- CVE-2026-13757: Stack exhaustion via unbounded recursion in RPC attribute parsing (bsc#1269664).
- CVE-2026-18938: integer overflow in RPC attribute-array length calculation can under-allocate nested attribute storage
  on 32 bit systems (bsc#1280702).

-----------------------------------------------------------------
Advisory ID: 1951
Released:    Wed Oct 21 10:10:37 2026
Summary:     Security update for coreutils
Type:        security
Severity:    moderate
References:  1272698,CVE-2026-56391
This update for coreutils fixes the following issue:

- CVE-2026-56391: uniq: denial of service and information disclosure via out-of-bounds read with multibyte input
  (bsc#1272698).

-----------------------------------------------------------------
Advisory ID: 1958
Released:    Fri Oct 23 15:50:54 2026
Summary:     Security update for ca-certificates-mozilla
Type:        security
Severity:    moderate
References:  1286261,1287180,CVE-2026-114406
This update for ca-certificates-mozilla fixes the following issue:

Updated to 2.92 state (bsc#1286261 CVE-2026-114406 bsc#1287180)
Removed:

 - emSign ECC Root CA - C3
 - emSign ECC Root CA - G3
 - emSign Root CA - C1

-----------------------------------------------------------------
Advisory ID: 2045
Released:    Wed Nov  4 18:07:08 2026
Summary:     Security update for pcre2
Type:        security
Severity:    important
References:  1283342,CVE-2026-103111
This update for pcre2 fixes the following issue:

- CVE-2026-103111: there is an attacker-controlled regular expression and certain JIT API usage, allowing an out-of-
  bounds write with arbitrary data (bsc#1283342).


The following package changes have been done:

- elemental-operator-1.8.3-160000.1.1 updated
- glibc-2.40-160000.7.1 updated
- libpcre2-8-0-10.45-160000.5.1 updated
- libattr1-2.6.0-160000.1.1 updated
- libacl1-2.4.0-160000.1.1 updated
- libp11-kit0-0.25.5-160000.3.1 updated
- p11-kit-0.25.5-160000.3.1 updated
- p11-kit-tools-0.25.5-160000.3.1 updated
- coreutils-9.6-160000.3.1 updated
- ca-certificates-mozilla-2.92-160000.1.1 updated
- container:bci-bci-base-16.0-f1e8d646d8608529472a09294358b504dfd818e55257797c889699e790842108-0 updated

More information about the sle-container-updates mailing list