SUSE-CU-2026:14196-1: Security update of bci/golang
sle-container-updates at lists.suse.com
sle-container-updates at lists.suse.com
Fri Nov 13 10:33:37 UTC 2026
SUSE Container Update Advisory: bci/golang
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2026:14196-1
Container Tags : bci/golang:1.26 , bci/golang:1.26-sles15 , bci/golang:1.26.11 , bci/golang:1.26.11-2.75.8 , bci/golang:oldstable
Container Release : 75.8
Severity : important
Type : security
References : 1255111 1268975 1281325 1287778 1289978 1289979 1289980 1289981
1289982 1289983 1289984 1289985 1289986 1289987 1289988 1289989
CVE-2026-111497 CVE-2026-34182 CVE-2026-97033 CVE-2026-97034
CVE-2026-97035 CVE-2026-97036 CVE-2026-97037 CVE-2026-97038 CVE-2026-97039
CVE-2026-97040 CVE-2026-97041 CVE-2026-97042 CVE-2026-97043 CVE-2026-97054
-----------------------------------------------------------------
The container bci/golang was updated. The following patches have been included in this update:
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4945-1
Released: Thu Oct 29 17:30:42 2026
Summary: Security update for brotli
Type: security
Severity: important
References: 1287778,CVE-2026-111497
This update for brotli fixes the following issue:
- CVE-2026-111497: Brotli decoder out-of-bounds write permits remote code execution (bsc#1287778).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2026:5149-1
Released: Mon Nov 9 18:43:07 2026
Summary: Recommended update for openssl-3
Type: recommended
Severity: moderate
References: 1281325,CVE-2026-34182
This update for openssl-3 fixes the following issues:
- Build with enable-sslkeylog to support the SSLKEYLOGFILE
environment variable usage. (jsc#PED-17079)
- Allow to bypass the strict tag initialization and length
enforcement added in the fix for CVE-2026-34182 when the env
variable OPENSSL_ALLOW_CMS_UNAUTHENTICATED_AEAD is defined and
set to a non-zero value. (bsc#1281325)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2026:5187-1
Released: Tue Nov 10 20:28:23 2026
Summary: Recommended update for libxmlb, snowball, bash
Type: recommended
Severity: moderate
References: 1268975
This update for libxmlb, snowball, bash fixes the following issues:
- Upgrade libxmlb, snowball, bash in preparation for fwupd upgrade.
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:5227-1
Released: Thu Nov 12 20:55:43 2026
Summary: Security update for go1.26
Type: security
Severity: important
References: 1255111,1289978,1289979,1289980,1289981,1289982,1289983,1289984,1289985,1289986,1289987,1289988,1289989,CVE-2026-97033,CVE-2026-97034,CVE-2026-97035,CVE-2026-97036,CVE-2026-97037,CVE-2026-97038,CVE-2026-97039,CVE-2026-97040,CVE-2026-97041,CVE-2026-97042,CVE-2026-97043,CVE-2026-97054
This update for go1.26 fixes the following issue:
Security issues fixed:
- CVE-2026-97033: `cmd/go`: unexpected code execution via `--sysroot`, `-target`, `-isysroot`, `-Wl,-syslibroot`, and
`-x cgo` flags (bsc#1289978).
- CVE-2026-97034: `cmd/go`: arbitrary command execution via GCC spec files in `cgo` linker search directories
(bsc#1289979).
- CVE-2026-97035: `cmd/go`: unexpected code execution and arbitrary file write via Clang `-gen-*` and GCC `-gnat*`
flags in `cgo` (bsc#1289980).
- CVE-2026-97036: `cmd/go`: arbitrary code execution during build on darwin via `-l to_library` in `cgo` (bsc#1289981).
- CVE-2026-97037: `cmd/go`: linker script injection via split `-Wl,` flags and Darwin or symbol linker flags in `cgo`
(bsc#1289982).
- CVE-2026-97038: `cmd/go`: arbitrary code execution via crafted `.syso` files and `cgo` linker input files
(bsc#1289983).
- CVE-2026-97039: `cmd/go`: flag sanitization bypass via `#cgo pkg-config:` directives (bsc#1289984).
- CVE-2026-97040: `cmd/go`, `cmd/link`: `cgo` directive injection via `.syso` files disguised as Go object files
(bsc#1289985).
- CVE-2026-97041: `cmd/compile`, `cmd/link`: host linker flag injection via `//go:cgo_*` directives (bsc#1289986).
- CVE-2026-97042: `cmd/cgo`, `cmd/compile`, `cmd/link`: linker flag injection via `cgo_import_dynamic` and PE DLL
names (bsc#1289987).
- CVE-2026-97043: `cmd/go`, `cmd/compile`: unexpected code execution via escaped quotes in `//go:cgo_ldflag`
(bsc#1289988).
- CVE-2026-97054: `net/http`: HTTP/1 server crash due to `MaxBytesReader` header race (bsc#1289989).
Changes for go1.26:
Update to version go1.26.11 (bsc#1255111):
- go#81865 `cmd/compile`: `branchelim` optimization can eliminate result of store
- go#81869 `cmd/compile`: generic shift-by-constant canonicalization gives `Const64` the wrong type
- go#81926 `cmd/asm`: amd64 assembler loops forever on a forward jump to a labelled `PCALIGN` when a branch needs
widening
- go#81946 `net/http`: backport fix to protect against middleware changing server response body
- go#82022 `net`: `Dialer.Dial{TCP,UDP,IP}` incorrectly treats invalid addresses as `::`
- go#82149 `runtime`: linux/mips `time64` nanosecond layout causes busy waits and empty CPU profiles
- go#82333 `cmd/dist`: `GOFIPS140` bootstrap from Go 1.26 fails
- go#82626 `crypto/fips140`: minor compliance improvements
- go#82642 `cmd/compile`: ICE on 386 when inlining nested bit rotations (`Int64Lo` not lowered)
The following package changes have been done:
- libbrotlicommon1-1.0.7-150200.3.8.1 updated
- libbrotlidec1-1.0.7-150200.3.8.1 updated
- libreadline7-7.0-150400.27.13.3 updated
- bash-4.4-150400.27.13.3 updated
- bash-sh-4.4-150400.27.13.3 updated
- libopenssl3-3.5.0-150700.5.56.1 updated
- libopenssl-3-fips-provider-3.5.0-150700.5.56.1 updated
- go1.26-doc-1.26.11-150000.1.39.1 updated
- go1.26-1.26.11-150000.1.39.1 updated
- go1.26-race-1.26.11-150000.1.39.1 updated
- container:registry.suse.com-bci-bci-base-15.7-dc390c80df991196a1dfc3337ec2d31e77a5ad5ee5a932d1efc636a005a5d4c5-0 updated
More information about the sle-container-updates
mailing list