SUSE-IU-2026:8795-1: Security update of suse/sle-micro/5.5

Fri Nov 13 08:38:52 UTC 2026

SUSE Image Update Advisory: suse/sle-micro/5.5
-----------------------------------------------------------------
Image Advisory ID : SUSE-IU-2026:8795-1
Image Tags        : suse/sle-micro/5.5:2.0.4 , suse/sle-micro/5.5:2.0.4-5.8.161 , suse/sle-micro/5.5:latest
Image Release     : 5.8.161
Severity          : important
Type              : security
References        : 1228084 1239107 1240541 1240969 1268352 1268353 1275171 1275258
                        1275260 1275261 1275262 CVE-2026-18724 CVE-2026-18725 CVE-2026-18726
                        CVE-2026-18727 CVE-2026-18728 CVE-2026-44943 CVE-2026-44944 
-----------------------------------------------------------------

The container suse/sle-micro/5.5 was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:5224-1
Released:    Thu Nov 12 18:55:57 2026
Summary:     Security update for open-iscsi
Type:        security
Severity:    important
References:  1228084,1239107,1240541,1240969,1268352,1268353,1275171,1275258,1275260,1275261,1275262,CVE-2026-18724,CVE-2026-18725,CVE-2026-18726,CVE-2026-18727,CVE-2026-18728,CVE-2026-44943,CVE-2026-44944
This update for open-iscsi fixes the following issues:

- CVE-2026-18724: Stack buffer overflow in idbm record parsing (bsc#1275171).
- CVE-2026-18725: Out-of-bounds access in iscsiuio ICMPv6 echo handling (bsc#1275258).
- CVE-2026-18726: Denial of service in iscsiuio Router Advertisement parsing (bsc#1275260).
- CVE-2026-18727: Integer underflow in iscsiuio DHCPv6 parsing (bsc#1275261).
- CVE-2026-18728: Integer underflow in iscsiuio IPv4 DHCP parsing (bsc#1275262).
- CVE-2026-44943: remote file-write as root via discovery (bsc#1268353).
- CVE-2026-44944: iscsiuio control-socket auth bypass (bsc#1268352).

Changes for open-iscsi:

- Update to version 2.1.13.suse+4.dc2446a1:
 * iscsid: honor REPORT LUNS DATA HAS CHANGED again (#557)
 * Convert shell scripts to POSIX sh (#552)
 * Preparing for version 2.1.13
 * iscsiuio: fix incorrect comparison of IPv6 subnet mask
 * usr: verify IPC peer credentials before sending data
 * login: fix infinite redirect loops with configurable limits
 * iscsiuio: strengthen IPv6 payload length validation in uip_process()
 * iscsiuio: strengthen DHCPv6 option parsing loop bound check
 * iscsiuio: validate DHCPv6 IA_NA option lengths to prevent OOB reads
 * usr: network code ioctl handling improvements
 * fix typo in user-facing error message in verify_mode_params() (#548)
 * gitignore: ignore generated build artifacts (#550)
 * iscsiadm: handle getopt errors directly (#551)
 * Fix iscsi_conn_iface_has_ip error handling (#531)
 * Fix reopen log freq change (#542)
 * iscsi_net_util: fix broken VLAN support in find_vlan_dev (#545)
 * Fixes for CVEs CVE-2026-18724 - CVE-2026-18728 (#544)
 * usr: fix '-Wdiscarded-qualifiers' warning in auth.c (#539)
 * usr: Fix -Wdiscarded-qualifiers warning in iqn_name_valid (#537)
 * iscsiuio: Fix -Waddress-of-packed-member (#534)
- Update to version 2.1.12.suse+0.8f77cf16:
 * Preparing for version 2.1.12 (#536)
 * iscsi-init.service: Use iscsi-gen-initiatorname
 * iscsi-gen-initiatorname use @IQN_PREFIX@ as default
 * avoid possible double free of found in idbm_rec_update_param (#528)
 * iscsi: validate interface IP against target address family (#527)
- Update to version 2.1.11.suse+88.8e0635b3:
 * Make iface.example a doc file. (#526)
 * Updated SPEC file to deliver iface.example as a %doc
 file, no longer in the database directory.
- Update to version 2.1.11.suse+85.4ef97a15:
 * Fix unused variable warning in usr/io.c (#524)
 * Remove old rpm subdirectory, no longer needed.
 * Add tcp.congestion_control configuration option (#520)
 * Small cleanups for firmware discovery. (#522)
 * Fix incorrect parsing of node.discovery_type 'static' and 'fw' (#518)
 * iscsi_net_util: avoid copying NULL pointers with strlcpy() (#515)
 * iscsi: delay reconnect until interface has valid IP. (#511)
- Update to version 2.1.11.suse+73.1723affc61eb:
 * README for rpm build directory
 * Fix issue with IPv6 adapter interfaces (#508, bsc#1240969)
 * fwparam_ppc.c: Fix the calloc-transposed-args issue (#504)
 * Makefile: fix 'No rule to make target 'iscsiuio/Makefile.in' issue (#506)
 * Fix typo in initiator.c (#507)
- Fixed some issues in this changes file
 * One date had incorrect format from 2014
 * Two separator lines were formatted incrrectly
- Update to version 2.1.11.suse+66.13c070123738:
 * Fix iscsid.conf NOP configuration (bsc#1240541)
- Change SPEC file so that open-iscsi lock files always go
 in /run/lock/iscsi (bsc#1239107)
- Update to version 2.1.11.suse+65.65365e1cdedb:
 * doc: fixup iscsiadm man page option for -r (#501)
 * Modify log function to print session id (#498)
 * Fix minor typo ('authenticaton') (#500)
 * Preparing for version 2.1.11 (#499)
 * iscsid: Rate limit session reopen log messages (#492)
 * IPv6 support for iBFT iSCSI boot (#493)
 * Improve iscsiadm command line parsing messages (#494)
 * More testing cleanup, and fix dprint test usage (#491)
 * Fix a typo in test/README (#486)
 * iscsid: Fix hang during login with scan=manual (#485)
 * fix 4 issues which are finded when building with clang 17 (#478)
- Drop rcFOO symlinks for CODE16 (PED-266).
- Update to version 2.1.10.suse+51.fea0fde82ed1:
 * Incudes upstream version 2.1.10 plus some fixes
 * Fix firmware targets startup to always be 'onboot' (#482)
 (bsc#1228084)
 * Change a discovery function to void return type (#481)
 * Fix gcc issues (#480)
 * Bugfix read specific sysfs value 'off' of session attribute (#466)
 * Fix bug where abort_tmo read failures were ignored. (#467)
 * grammar nitpicks (#464)
 * Fix memory leak in iscsi_check_session_use_count (#465)
 * improve the comments in idbm_lock() (#458)
 * Make it visible when memory allocation failure (#457)
 * Better handle multiple iscsiadm commands (#453)
 * iscsiadm: allow hostnames in node-mode commands (#451)
 * Modify how workqueue priority is set (#445)
 * Fix authmethod check by printing a warning message when CHAP used and authmethod=None (#443)
 * iscsid: Rescan devices on relogin (#444)
 * Adds missing characters in README. (#440)
 * Turn off iSCSI NOP-Outs, by default.
 * fix: add usr/iscsid_req.h missinig underline (#431) (#436)
- Updated to latest upstream: two small changes, with no known
 functional changes:
 * Incorrect documentation for `iscsiadm -m session` print level
 (upstream issue #432)
 * Stop using deprecated inet_aton and inet_ntoa (upstream issue
 #435)

The following package changes have been done:

- libopeniscsiusr0-0.2.0-150500.46.6.1 updated
- open-iscsi-2.1.13-150500.46.6.1 updated