SUSE-CU-2026:11645-1: Security update of suse/registry

[sle-container-updates at lists.suse.com]

SUSE Container Update Advisory: suse/registry
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2026:11645-1
Container Tags        : suse/registry:3.1 , suse/registry:3.1 , suse/registry:3.1-7.20 , suse/registry:latest
Container Release     : 7.20
Severity              : moderate
Type                  : security
References            : 1279961 1281468 1281469 1282301 CVE-2026-81871 CVE-2026-81872
-----------------------------------------------------------------

The container suse/registry was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: 1790
Released:    Wed Sep 30 11:29:23 2026
Summary:     Recommended update for ca-certificates-mozilla
Type:        recommended
Severity:    moderate
References:  1279961
This update for ca-certificates-mozilla fixes the following issues:

Changes in ca-certificates-mozilla:

- Updated to 2.90 state (bsc#1279961):
    * Removed:
        +  AffirmTrust Commercial
        + AffirmTrust Networking
        + AffirmTrust Premium
        + AffirmTrust Premium ECC
        + certSIGN ROOT CA
        + Entrust Root Certification Authority
        + PKI Root Certification Authority
        + FIRMAPROFESIONAL CA ROOT-A WEB
        + GLOBALTRUST 2020
        + Secure Global CA
        + SecureSign Root CA12
        + SecureTrust CA
        + TeliaSonera Root CA v1
        + Trustwave Global Certification Authority
        + Trustwave Global ECC P256 Certification Authority
        + Trustwave Global ECC P384 Certification Authority
        + XRamp Global Certification Authority
    * Added:
        + SECOM SMIME RSA Root CA 2024
        + SECOM TLS ECC Root CA 2024
        + SECOM TLS RSA Root CA 2024
        + SecureSign Root CA16
        + Telia EC Email Root CA v3
        + Telia EC TLS Root CA v3
        + Telia RSA Email Root CA v3
        + Telia RSA TLS Root CA v3

-----------------------------------------------------------------
Advisory ID: 1792
Released:    Wed Sep 30 17:02:45 2026
Summary:     Recommended update for jitterentropy
Type:        recommended
Severity:    moderate
References:  1282301
This update for jitterentropy fixes the following issues:

Changes in jitterentropy:

- OSR has to be at least 5 according to current reviews. (bsc#1282301)

-----------------------------------------------------------------
Advisory ID: 1801
Released:    Thu Oct  1 14:12:02 2026
Summary:     Security update for distribution
Type:        security
Severity:    moderate
References:  1281468,1281469,CVE-2026-81871,CVE-2026-81872
This update for distribution fixes the following issues:

- CVE-2026-81871: go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS certificate bypass
  allows log telemetry interception and alteration (bsc#1281468).
- CVE-2026-81872: go.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: Denial of Service via attacker-driven log emission
  (bsc#1281469).


The following package changes have been done:

- libjitterentropy3-3.6.3-160000.3.1 updated
- ca-certificates-mozilla-2.90-160000.1.1 updated
- distribution-registry-3.1.1-160000.4.1 updated
- container:bci-bci-base-16.0-fe992217653f22d768e6ffb14b59f989ec3fe1ec36030871c6501723050709e2-0 updated
- container:registry.suse.com-bci-bci-micro-16.0-55ecd37e6a166076d8648db0069b6fbdb38e8c6b228e9dd204c8e2bc221cf452-0 updated