SUSE-CU-2026:12084-1: Security update of suse/multi-linux-manager/5.2/x86_64/monitoring-grafana
sle-container-updates at lists.suse.com
sle-container-updates at lists.suse.com
Fri Oct 9 09:13:59 UTC 2026
SUSE Container Update Advisory: suse/multi-linux-manager/5.2/x86_64/monitoring-grafana
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2026:12084-1
Container Tags : suse/multi-linux-manager/5.2/x86_64/monitoring-grafana:12.4.5 , suse/multi-linux-manager/5.2/x86_64/monitoring-grafana:5.2.1 , suse/multi-linux-manager/5.2/x86_64/monitoring-grafana:5.2.1.5.5.1 , suse/multi-linux-manager/5.2/x86_64/monitoring-grafana:latest
Container Release : 5.5.1
Severity : important
Type : security
References : 1212476 1216950 1227370 1236136 1236165 1236599 1239009 1242233
1243014 1243459 1243564 1243830 1247463 1250233 1250234 1252306
1252696 1253025 1253043 1256829 1256831 1256832 1256833 1257274
1257463 1258311 1259542 1259652 1259825 1261678 1262187 1262315
1263272 1263366 1263367 1263656 1263658 1264764 1265281 1265282
1265283 1265284 1265285 1265286 1265287 1265288 1265289 1265290
1266343 1266344 1266347 1266600 1266786 1267153 1267610 1268131
1268290 1268867 1270393 1271327 1271331 1271712 1273300 1274217
1274723 1274726 1274740 1274774 1274777 1274788 1274790 1274791
1274792 1274795 1274796 1274797 1274798 1275660 1275837 1275902
1276892 1276946 1277247 1277262 1277707 1277708 1277709 1277710
1277711 1277713 1277921 1277922 1278351 1279893 1280050 1280051
1280052 1280053 1280054 1280587 1280589 1280590 1280591 1280592
1280594 1280595 1280596 1280597 1280598 1280599 1281125 CVE-2024-12797
CVE-2024-13176 CVE-2024-9143 CVE-2025-11187 CVE-2025-12141 CVE-2025-15468
CVE-2025-15469 CVE-2025-27587 CVE-2025-30153 CVE-2025-4575 CVE-2025-66199
CVE-2025-9231 CVE-2025-9232 CVE-2026-11850 CVE-2026-14456 CVE-2026-14457
CVE-2026-18374 CVE-2026-18798 CVE-2026-19499 CVE-2026-19542 CVE-2026-21725
CVE-2026-25680 CVE-2026-25681 CVE-2026-2673 CVE-2026-27136 CVE-2026-28374
CVE-2026-28376 CVE-2026-28379 CVE-2026-28380 CVE-2026-28383 CVE-2026-28390
CVE-2026-33376 CVE-2026-33377 CVE-2026-33378 CVE-2026-33380 CVE-2026-33381
CVE-2026-33382 CVE-2026-34181 CVE-2026-34182 CVE-2026-35189 CVE-2026-35191
CVE-2026-39821 CVE-2026-39882 CVE-2026-40355 CVE-2026-40356 CVE-2026-41607
CVE-2026-42250 CVE-2026-42502 CVE-2026-42506 CVE-2026-42764 CVE-2026-5435
CVE-2026-54369 CVE-2026-54370 CVE-2026-54371 CVE-2026-54411 CVE-2026-54872
CVE-2026-54874 CVE-2026-54875 CVE-2026-6238 CVE-2026-63072 CVE-2026-63073
CVE-2026-63074 CVE-2026-63075 CVE-2026-63076 CVE-2026-6368 CVE-2026-6791
CVE-2026-72897 CVE-2026-75803 CVE-2026-75804 CVE-2026-75805 CVE-2026-75806
CVE-2026-77117 CVE-2026-77696 CVE-2026-80489 CVE-2026-84782 CVE-2026-84784
CVE-2026-86145 CVE-2026-89156 CVE-2026-89157 CVE-2026-89158 CVE-2026-89160
CVE-2026-89161
-----------------------------------------------------------------
The container suse/multi-linux-manager/5.2/x86_64/monitoring-grafana was updated. The following patches have been included in this update:
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:2848-1
Released: Fri Jul 10 13:38:57 2026
Summary: Security update for krb5, krb5-mini
Type: security
Severity: important
References: 1263366,1263367,1268131,CVE-2026-11850,CVE-2026-40355,CVE-2026-40356
This update for krb5, krb5-mini fixes the following issues
- CVE-2026-11850: integer underflow in berval2tl_data() leads to heap out-of-bounds read (bsc#1268131).
- CVE-2026-40355: Denial of Service via NULL pointer dereference in NegoEx mechanism (bsc#1263366).
- CVE-2026-40356: Denial of Service via integer underflow and out-of-bounds read (bsc#1263367).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3030-1
Released: Wed Jul 15 11:53:06 2026
Summary: Security update for glibc
Type: security
Severity: moderate
References: 1263656,1263658,CVE-2026-5435,CVE-2026-6238
This update for glibc fixes the following issues
- CVE-2026-5435: unchecked buffer writing in TSIG handling can lead to an out-of-bounds write (bsc#1263656).
- CVE-2026-6238: insufficient RDATA length validation can lead to application crashes or uninitialized memory disclosure
(bsc#1263658).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2026:3118-1
Released: Fri Jul 17 22:18:41 2026
Summary: Recommended update for gcc15
Type: recommended
Severity: moderate
References: 1252306,1253043,1257463
This update for gcc15 fixes the following issues:
- Update to GCC 15.3 release
- Drop -fhardened from RPM_OPT_FLAGS
- Avoid conflicts between %gcc_libc_bootstrap packages of different
versions if update-alternatives are still in use (SLE 15 and older)
- Allow conversions to/from uint32_t. Filter out -Wtime_t-conversion
from flags to build D target library files. [jsc#PED-15601]
- Remove loongarch64 from quadmath_arch. On LoongArch long double
is IEEE quad, so libquadmath is not needed and no longer built.
- includes fix for bogus expression simplification [bsc#1257463]
even when not available at build time. [bsc#1253043]
- Backport fix that cures a miscompile of libgo on arm. [bsc#1252306]
- Check availability of builtins at expand time
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2026:3141-1
Released: Tue Jul 21 09:04:39 2026
Summary: Recommended update for shadow
Type: recommended
Severity: important
References: 1270393
This update for shadow fixes the following issues:
- Fix regression about default GID by setting USERGROUPS_ENAB to no Update (bsc#1270393)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3163-1
Released: Tue Jul 21 16:50:54 2026
Summary: Security update for pam
Type: security
Severity: moderate
References: 1268290,CVE-2026-54411
This update for pam fixes the following issue
- CVE-2026-54411: timing discrepancy in the pam_userdb module's plaintext-password comparison (bsc#1268290).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3444-1
Released: Fri Jul 31 22:04:31 2026
Summary: Security update for openssl-3
Type: security
Severity: moderate
References: 1271712
This update for openssl-3 fixes the following issues:
- HollowByte: DoS vector against OpenSSL TLS ClientHello via remote, attacker-controlled memory allocations
(bsc#1271712).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3718-1
Released: Mon Aug 24 11:23:27 2026
Summary: Security update for grafana
Type: security
Severity: important
References: 1262187,1263272,1264764,1265281,1265282,1265283,1265284,1265285,1265286,1265287,1265288,1265289,1265290,1266600,1267153,1271327,1271331,1274217,CVE-2025-12141,CVE-2025-30153,CVE-2026-21725,CVE-2026-25680,CVE-2026-25681,CVE-2026-27136,CVE-2026-28374,CVE-2026-28376,CVE-2026-28379,CVE-2026-28380,CVE-2026-28383,CVE-2026-33376,CVE-2026-33377,CVE-2026-33378,CVE-2026-33380,CVE-2026-33381,CVE-2026-33382,CVE-2026-39821,CVE-2026-39882,CVE-2026-41607,CVE-2026-42502,CVE-2026-42506
This update for grafana fixes the following issues:
grafana updated from version 11.6.14+security04 to version 12.4.5:
Security fixes:
- CVE-2026-39882: Prevent memory exhaustion DoS in OpenTelemetry OTLP HTTP exporters (bsc#1274217)
- CVE-2026-33382: Limit the size of the request body before processing it at several Grafana API endpoints (bsc#1271331)
- CVE-2025-12141: Fixed information leakage in Grafana Alerting (bsc#1262187)
- CVE-2026-41607: Fix potential information disclosure in Apache Thrift (bsc#1263272)
Breaking chahnges introduced in version 12.0.0:
- BREAKING: Removed AngularJS and all deprecated UI Extensions APIs.
- BREAKING: Enforced stricter version compatibility checks in plugin CLI install commands.
- BREAKING: Enabled the failWrongDSUID feature flag by default, which rejects data sources with incorrect UIDs.
Other changes introduced from version 11.6.14+security04 to version 12.4.5 (jsc#PED-16512):
- Add Legal-Review-Notice (bsc#1271327)
- Datasources: return 400 when payload UID does not match URL UID in PUT /api/datasources/uid/:uid
- Analytics: Keep internal dashboard id.
- Reporting: Correctly apply appSubURL to report settings requests
- Alerting: Document Grafana HA Alertmanager cluster metrics prefix change.
- Dependency updates to core plugins and UI libraries.
- Updates to data source provisioning and dashboard schemas.
- Introduced dynamic dashboards in public preview.
- Added a new side toolbar that replaces the second top toolbar to provide additional vertical space.
- Added the ability to create dashboards from templates using sample data.
- Revamped the gauge visualization with rounded bars, configurable bar thickness, and endpoint markers.
- Added support to map one variable to multiple values.
- Released a completely redesigned logs visualization.
- Added the ability to export dashboards directly as PNG images.
- Introduced an interactive learning experience within the Grafana UI.
- Added a Switch template variable type to quickly toggle between values in queries.
- Added functionality to style table cells using CSS properties via the field cell option.
- Added support for Entra Workload Identity to enhance authentication capabilities with federated credentials.
- Redesigned the alert rule list page.
- Renamed Mute Timings to Active Time Intervals in Grafana Alerting.
- Added support for Service Account Impersonation in the BigQuery data source.
- Introduced the Grafana Advisor in public preview.
- Introduced a new dashboard schema to replace the original single grid layout.
- MIGRATION: Triggered a full-table rewrite for the annotation table, which may temporarily increase disk usage.
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3835-1
Released: Thu Aug 27 13:53:51 2026
Summary: Security update for openssl, openssl-3
Type: security
Severity: important
References: 1216950,1236136,1236599,1243014,1243459,1243564,1247463,1250233,1250234,1256829,1256831,1256832,1256833,1257274,1259652,1261678,1266344,1266347,CVE-2024-12797,CVE-2024-13176,CVE-2024-9143,CVE-2025-11187,CVE-2025-15468,CVE-2025-15469,CVE-2025-27587,CVE-2025-4575,CVE-2025-66199,CVE-2025-9231,CVE-2025-9232,CVE-2026-2673,CVE-2026-28390,CVE-2026-34182,CVE-2026-42764
This update for openssl, openssl-3 fixes the following issues:
OpenSSL is updated to 3.5.0 in SLE-15-SP7: (jsc#PED-16072)
* Enables Post-Quantum Cryptography (PQC) TLS support
Security issues fixed:
* CVE-2026-42764: NULL pointer dereference in QUIC server initial packet handling (bsc#1266347)
* CVE-2026-34182: CMS AuthEnvelopedData Processing May Accept Forged Messages (bsc#1266344)
* CVE-2026-28390: NULL pointer dereference during processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo (bsc#1261678)
* CVE-2026-2673: TLS 1.3 servers may choose unexpected key agreement group (bsc#1259652)
* CVE-2025-66199: TLS 1.3 CompressedCertificate excessive memory allocation (bsc#1256833)
* CVE-2025-15469: 'openssl dgst' one-shot codepath silently truncates inputs greater than 16MB (bsc#1256832)
* CVE-2025-11187: Improper validation of PBMAC1 parameters in PKCS#12 MAC verification (bsc#1256829)
* CVE-2025-15468: NULL dereference in SSL_CIPHER_find() function on unknown cipher ID (bsc#1256831)
* CVE-2025-9231: Fix timing side-channel in SM2 algorithm on 64 bit ARM (bsc#1250233)
* CVE-2025-9232: Fix out-of-bounds read in HTTP client no_proxy handling (bsc#1250234)
* CVE-2025-4575: Fix the x509 application adding trusted use instead of rejected use (bsc#1243564)
* CVE-2025-27587: Minerva side channel vulnerability in P-384 (bsc#1243459)
* CVE-2024-12797: Fixed RFC7250 handshakes with unauthenticated servers don't abort as
expected. (bsc#1236599)
* CVE-2024-13176: Fixed timing side-channel in ECDSA signature computation.
* CVE-2024-9143: Fixed possible OOB memory access with invalid low-level GF(2^m) elliptic
curve parameters.
* CVE-2024-13176: Fix timing side-channel in ECDSA signature computation (bsc#1236136)
POWER performance enhancements:
* Optimized MLDSA NTT, supports p8 and above architectures (jsc#PED-14569)
- Adapt spec file for immutability via systemd-tmpfiles (jsc#PED-14813)
- Fix check %{suse_version} > 1600 (jsc#PED-15816)
- Fix NULL pointer dereference when processing an OCSP response
- Remove showciphers.c in favor of openssl ciphers
- Use %ldconfig_scriptlets
- Enable livepatching support for ppc64le [bsc#1257274]
- Move ssl configuration files to the libopenssl package [bsc#1247463]
- Don't install unneeded NOTES
- Disable LTO for userspace livepatching [jsc#PED-13245]
- Fix P-384 curve on lower-than-P9 PPC64 targets [bsc#1243014]
- FIPS: Fix the speed command in FIPS mode for KMAC
- FIPS: Restore the check to deny SHA1 signatures in FIPS mode and
the functionality to allow/deny via crypto-policies. [jsc#PED-12224]
Update to 3.5.0:
* Changes:
- Default encryption cipher for the req, cms, and smime applications
changed from des-ede3-cbc to aes-256-cbc.
- The default TLS supported groups list has been changed to include
and prefer hybrid PQC KEM groups. Some practically unused groups
were removed from the default list.
- The default TLS keyshares have been changed to offer X25519MLKEM768
and and X25519.
- All BIO_meth_get_*() functions were deprecated.
* New features:
- Support for server side QUIC (RFC 9000)
- Support for 3rd party QUIC stacks including 0-RTT support
- Support for PQC algorithms (ML-KEM, ML-DSA and SLH-DSA)
- A new configuration option no-tls-deprecated-ec to disable support
for TLS groups deprecated in RFC8422
- A new configuration option enable-fips-jitter to make the FIPS
provider to use the JITTER seed source
- Support for central key generation in CMP
- Support added for opaque symmetric key objects (EVP_SKEY)
- Support for multiple TLS keyshares and improved TLS key establishment
group configurability
- API support for pipelining in provided cipher algorithms
Changes between 3.3.0 and 3.4.0:
* Changes:
- Deprecation of TS_VERIFY_CTX_set_* functions and addition of
replacement TS_VERIFY_CTX_set0_* functions with improved semantics
- The X25519 and X448 key exchange implementation in the FIPS provider
is unapproved and has fips=no property.
- SHAKE-128 and SHAKE-256 implementations have no default digest length
anymore. That means these algorithms cannot be used with
EVP_DigestFinal/_ex() unless the xoflen param is set before.
- Setting config_diagnostics=1 in the config file will cause errors to
be returned from SSL_CTX_new() and SSL_CTX_new_ex() if there is an
error in the ssl module configuration.
- An empty renegotiate extension will be used in TLS client hellos
instead of the empty renegotiation SCSV, for all connections with a
minimum TLS version > 1.0.
- Deprecation of SSL_SESSION_get_time(), SSL_SESSION_set_time() and
SSL_CTX_flush_sessions() functions in favor of their respective _ex
functions which are Y2038-safe on platforms with Y2038-safe time_t
* New features:
- Support for directly fetched composite signature algorithms such as
RSA-SHA2-256 including new API functions
- FIPS indicators support in the FIPS provider and various updates of
the FIPS provider required for future FIPS 140-3 validations
- Implementation of RFC 9579 (PBMAC1) in PKCS#12
- An optional additional random seed source RNG JITTER using a statically
linked jitterentropy library
- New options -not_before and -not_after for explicit setting start and
end dates of certificates created with the req and x509 apps
- Support for integrity-only cipher suites TLS_SHA256_SHA256 and
TLS_SHA384_SHA384 in TLS 1.3, as defined in RFC 9150
- Support for retrieving certificate request templates and CRLs in CMP
- Support for additional X.509v3 extensions related to Attribute Certificates
- Initial Attribute Certificate (RFC 5755) support
- Possibility to customize ECC groups initialization to use precomputed
values to save CPU time and use of this feature by the P-256 implementation
Changes between 3.2.0 and 3.3.0:
* Changes:
- Optimized AES-CTR for ARM Neoverse V1 and V2
- Various optimizations for cryptographic routines using RISC-V vector
crypto extensions
- Added assembly implementation for md5 on loongarch64
- Accept longer context for TLS 1.2 exporters
- The activate and soft_load configuration settings for providers in
openssl.cnf have been updated to require a value of [1|yes|true|on]
(in lower or UPPER case) to enable the setting. Conversely a value of
[0|no|false|off] will disable the setting.
- In openssl speed, changed the default hash function used with hmac from
md5 to sha256.
- The -verify option to the openssl crl and openssl req will make the
program exit with 1 on failure.
- The d2i_ASN1_GENERALIZEDTIME(), d2i_ASN1_UTCTIME(), ASN1_TIME_check(),
and related functions have been augmented to check for a minimum length
of the input string, in accordance with ITU-T X.690 section 11.7 and 11.8.
- OPENSSL_sk_push() and sk__push() functions now return 0 instead of -1
if called with a NULL stack argument.
- New limit on HTTP response headers is introduced to HTTP client.
The default limit is set to 256 header lines.
* Bug fixes and mitigations:
- The BIO_get_new_index() function can only be called 127 times before
it reaches its upper bound of BIO_TYPE_MASK and will now return -1
once its exhausted.
* new features:
- Support for qlog for tracing QUIC connections has been added
- Added APIs to allow configuring the negotiated idle timeout for QUIC
connections, and to allow determining the number of additional streams
that can currently be created for a QUIC connection.
- Added APIs to allow disabling implicit QUIC event processing for QUIC
SSL objects
- Added APIs to allow querying the size and utilisation of a QUIC
stream's write buffer
- New API SSL_write_ex2, which can be used to send an end-of-stream (FIN)
condition in an optimised way when using QUIC.
- Limited support for polling of QUIC connection and stream objects in a
non-blocking manner.
- Added a new EVP_DigestSqueeze() API. This allows SHAKE to squeeze multiple
times with different output sizes.
- The BLAKE2s hash algorithm matches BLAKE2b's support for configurable
output length.
- The EVP_PKEY_fromdata function has been augmented to allow for the
derivation of CRT (Chinese Remainder Theorem) parameters when requested
- Added API functions SSL_SESSION_get_time_ex(), SSL_SESSION_set_time_ex()
using time_t which is Y2038 safe on 32 bit systems when 64 bit time
is enabled.
- Unknown entries in TLS SignatureAlgorithms, ClientSignatureAlgorithms
config
options and the respective calls to SSL[_CTX]_set1_sigalgs() and
SSL[_CTX]_set1_client_sigalgs() that start with ? character are ignored
and the configuration will still be used.
- Added -set_issuer and -set_subject options to openssl x509 to override
the Issuer and Subject when creating a certificate. The -subj option
now is an alias for -set_subject.
- Added several new features of CMPv3 defined in RFC 9480 and RFC 9483
- New option SSL_OP_PREFER_NO_DHE_KEX, which allows configuring a TLS1.3
server to prefer session resumption using PSK-only key exchange over
PSK with DHE, if both are available.
- New atexit configuration switch, which controls whether the OPENSSL_cleanup
is registered when libcrypto is unloaded.
- Added X509_STORE_get1_objects to avoid issues with the existing
X509_STORE_get0_objects API in multi-threaded applications.
- Support for using certificate profiles and extened delayed delivery in CMP
- FIPS: Mark SHA-1 as non-approved in the SLI. [jsc#PED-12224]
- Introduce --without lto. When %{optflags} contains -flto=*, tests cases are
also built using -flto=* which significantly increases build times, this
option disables lto which improve iteration times when developing.
Update to 3.2.4:
- Remove the engines' directories and symlinks that were added to
allow parallel installations with openssl-1_1.
- Add ktls capability [bsc#1216950]
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2026:3927-1
Released: Thu Sep 3 06:27:06 2026
Summary: Recommended update for shadow
Type: recommended
Severity: important
References: 1259542,1275902
This update for shadow fixes the following issues:
- Mark /etc/default/useradd as %config(noreplace) to restore the behavior
prior to the file being removed from shadow. (bsc#1275902)
- Fix regression caused in (bsc#1259542)
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2026:3980-1
Released: Sun Sep 6 09:44:23 2026
Summary: Recommended update for libtirpc
Type: recommended
Severity: important
References: 1274740
This update for libtirpc fixes the following issues:
- Fix: Possible mem leak from libtirpc [ thread::XRF51s_MK4mkPFEu7JKj0Ss:: ] (bsc#1274740):
* rpcb_clnt.c: fix memory leak in destroy_addr
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4039-1
Released: Mon Sep 7 10:29:11 2026
Summary: Security update for openssl-3
Type: security
Severity: important
References: 1266343,1274774,1274777,1274788,1274790,1274791,1274792,1274795,1274796,1274797,1274798,1275837,CVE-2026-14456,CVE-2026-14457,CVE-2026-18798,CVE-2026-34181,CVE-2026-54874,CVE-2026-63072,CVE-2026-63073,CVE-2026-63074,CVE-2026-63075,CVE-2026-63076,CVE-2026-75803
This update for openssl-3 fixes the following issues:
August 2026 release.
- CVE-2026-14456: unbounded memory growth in QUIC server incoming channel queue (bsc#1274791).
- CVE-2026-14457: RPK server signature algorithm selection can dereference a missing certificate (bsc#1274792).
- CVE-2026-18798: QUIC server may trigger double free when processing INITIAL packet (bsc#1274777).
- CVE-2026-34181: PKCS#12 files with PBMAC1 are accepted with short HMAC keys (bsc#1266343).
- CVE-2026-54874: excessive Memory Use Buffering DTLS Records for a Future Epoch (bsc#1274795).
- CVE-2026-63072: heap buffer overflow in CMS key unwrapping (bsc#1274788).
- CVE-2026-63073: untrusted sender DN used as format string in CMP response validation (bsc#1274796).
- CVE-2026-63074: CMP indefinite cache growth of `ExtraCerts` (bsc#1274797).
- CVE-2026-63075: QUIC ACK-only packet retention can cause memory exhaustion (bsc#1274798).
- CVE-2026-63076: invalid pointer dereference in CMP server via crafted `protectionAlg` (bsc#1274790).
- CVE-2026-75803: AEAD forgeries with empty ciphertext when using `EVP_Cipher()` (bsc#1275837).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4055-1
Released: Mon Sep 7 17:48:12 2026
Summary: Security update for bzip2
Type: security
Severity: low
References: 1266786,CVE-2026-42250
This update for bzip2 fixes the following issue:
- CVE-2026-42250: off-by-one error in the bzip2recover utility when processing a specially crafted file can lead to a
crash (bsc#1266786).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2026:4110-1
Released: Wed Sep 9 17:00:16 2026
Summary: Recommended update for crypto-policies
Type: recommended
Severity: important
References: 1212476,1227370,1236165,1239009,1242233,1243830,1252696,1253025,1258311,1259825,1262315,1275660
This update for crypto-policies fixes the following issues:
- Update crypto-policies for Post-Quantum Cryptography (PQC) TLS
support in SLE-15-SP7 (jsc#PED-16072):
* Add support for mlkem768x25519-sha256 in openssh 9.6p1 (bsc#1275660)
* Add support for python36 (jsc#PED-16072)
* Add support for sntrup761x25519-sha512 at openssh.com and remove
it for sntrup761x25519-sha512 in openssh 9.6p1 in SLE-15-SP7
as it only lists the former (bsc#1258311, bsc#1259825)
- Allow X25519 as required for sntrup761x25519-sha512 at openssh.com
and sntrup761x25519-sha512 in the DEFAULT policy. (bsc#1259825)
- Add PQC support for OpenSSH (bsc#1258311, bsc#1259825)
* Enable sntrup761x25519-sha512 for OpenSSH by default
- Modify the output of fips-mode-setup to hint the user when
setting the FIPS mode in transactional systems to use the
command 'transactional-update setup-fips'. (bsc#1262315)
- Adapt the manpages to SUSE/openSUSE:
* Compress all the man pages for update-crypto-policies.8.gz,
crypto-policies.7.gz, fips-finish-install.8.gz and
fips-mode-setup.8.gz into man-crypto-policies.tar.xz
- Update to version 20250714.cd6043a: [bsc#1253025, bsc#1252696]
* gnutls: enable ML-DSA, for both secure-sig and secure-sig-for-cert
* python, policies, tests: alias X25519-MLKEM768 to MLKEM768-X25519
* FIPS: disable MLKEM768-X25519 for openssh (no-op)
* FIPS: deprioritize X25519-MLKEM768 over P256-MLKEM768 for openssl...
* TEST-PQ: be more careful with the ordering
* openssl: send one PQ and one classic key_share; prioritize PQ groups
* sequoia: Generate AEAD policy
* Do not include EdDSA in FIPS policy
* sequoia: Add PQC algorithm
* sequoia: Run tests against PQC capable policy-config-check
* Revert 'openssl, policies: implement group_key_share option'
* openssl, policies: implement group_key_share option
* FIPS: enable hybrid ML-KEM (TLS only) and pure ML-DSA
* python/build-crypto-policies: output diffs on --test mismatches
* sequoia, rpm-sequoia: use ignore_invalid with sha3, x25519, ...
* policies, alg_lists, openssl: remove KYBER from allowed values
* openssl: stricter enabling of Ciphersuites
* openssl: make use of -CBC and -AESGCM keywords
* openssl: add TLS 1.3 Brainpool identifiers
* fix warning on using experimental key_exchanges
* update-crypto-policies: don't output FIPS warning in fips mode
* openssh: map mlkem768x25519-sha256 to KEM-ECDH & MLKEM768-X25519 & SHA2-256
* openssh, libssh: refactor kx maps to use tuples
* alg_lists: mark MLKEM768/SNTRUP kex experimental
* nss: revert enabling mlkem768secp256r1
* nss: add mlkem768x25519 and mlkem768secp256r1, remove xyber
* gnutls: add GROUP-X25519-MLKEM768 and GROUP-SECP256R1-MLKEM768
* openssl: use both names for SecP256r1MLKEM768 / X25519MLKEM768
* openssh, TEST-PQ: rename MLKEM key_exchange to MLKEM768
* openssh: add support for sntrup761x25519-sha512 and mlkem768x25519-sha256
* LEGACY: enable 192-bit ciphers for nss pkcs12/smime
* openssl: map NULL to TLS_SHA256_SHA256:TLS_SHA384_SHA384...
* nss: be stricter with new purposes
* python/update-crypto-policies: pacify pylint
* fips-mode-setup: tolerate fips dracut module presence w/o FIPS
* fips-mode-setup: small Argon2 detection fix
* SHA1: add __openssl_block_sha1_signatures = 0
* fips-mode-setup: block if LUKS devices using Argon2 are detected
* update-crypto-policies: skip warning on --set=FIPS if bootc
* fips-setup-helper: skip warning, BTW
* fips-mode-setup: force --no-bootcfg when UKI is detected
* fips-crypto-policy-overlay: automount FIPS policy
* nss: rewrite backend for 3.101
* cryptopolicies: parent scopes for dumping purposes
* policygenerators: move scoping inside generators
* openssh: make dss no longer enableble, support is dropped
* gnutls: wire GROUP-X25519-KYBER768 to X25519-KYBER768
* TEST-PQ: disable pure Kyber768
* DEFAULT: switch to rh-allow-sha1-signatures = no...
* java: drop unused javasystem backend
* java: stop specifying jdk.tls.namedGroups in javasystem
* ec_min_size: introduce and use in java, default to 256
* java: use and include jdk.disabled.namedCurves
* BSI: Update BSI policy for new 2024 minimum recommendations
* fips-mode-setup: flashy ticking warning upon use
* fips-mode-setup: add another scary 'unsupported'
* BSI: switch to 3072 minimum RSA key size
* java: make hash, mac and sign more orthogonal
* java: specify jdk.tls.namedGroups system property
* java: respect more key size restrictions
* java: disable anon ciphersuites, tying them to NULL...
* java: start controlling / disable DTLSv1.0
* nss: wire KYBER768 to XYBER768D00
- Update to version 20250425.9267dee:
* openssl: fix mistakes in integrity-only cipher definitions
* NO-PQ, cryptopolicies: add experimental value suppression
* nss: add mlkem768x25519 and mlkem768secp256r1
* gnutls: 'allow-rsa-pkcs1-encrypt = false' everywhere but in LEGACY
* TEST-PQ, openssh: add support for MLKEM768 key_exchange
* LEGACY: drop cipher at pkcs12 = SEED-CBC
* fips-crypto-policy-overlay: automount FIPS policy, follow-up fixes
* nss: TLS-REQUIRE-EMS in FIPS
* DEFAULT: disable RSA key exchange
* LEGACY: disable sign = *-SHA1
* nss: wire XYBER768D00 to X25519-KYBER768, not KYBER768
- Add the FIPS scripts fips-finish-install and fips-mode-setup as
sources in the spec file as they have been removed upstream.
* We will maintain these scripts downstream.
* Update the man pages for update-crypto-policies.8.gz
* Add man pages in text file in compressed form in the file
man-fips-scripts.tar.xz and add them to the Makefile.
- Update to version 20250324.3714354:
* NO-PQ: introduce
* LEGACY/DEFAULT/FUTURE: enable hybrid ML-KEM and pure ML-DSA
* _openssl_block_sha1_signatures: flip the default to 1
* sequoia: add sha3, x25519, ed25519, x448, ed448, but not for rpm-sequoia
* sequoia: refactor a bit
* openssl: specify default key size for req
* gnutls: support P384-MLKEM1024
* openssl: stop generating `openssl` in favour of `opensslcnf`
* gnutls: drop kyber (switching to leancrypto took it away)
* openssl: use both names for P384-MLKEM1024
* Detect the presence of nss-policy-check
* Don't use hardcoded python3 path
* Make xsltproc settable as XSLTPROC
* python/cryptopolicies/validation/scope.py: fix new ruff rule RUF021
* Update the info in the README.SUSE file
* Remove the FEDORA policies and directories
- Allow openssl to load when using the DEFAULT policy, and also
other policies, in FIPS mode. [bsc#1243830, bsc#1242233]
- Relax the nss version requirement since the mlkem768secp256r1
enablement has been reverted.
- Allow sshd in FIPS mode when using the DEFAULT policy [bsc#1227370]
- Enable SHA1 sigver in the DEFAULT policy.
- Remove also sequoia config and generator files
- Remove not needed fips bind mount service
- Update to version 20250124.4d262e7: [bsc#1239009, bsc#1236165]
* openssl: stricter enabling of Ciphersuites
* openssl: make use of -CBC and -AESGCM keywords
* openssl: add TLS 1.3 Brainpool identifiers
* fix warning on using experimental key_exchanges
* update-crypto-policies: don't output FIPS warning in fips mode
* openssh: map mlkem768x25519-sha256 to KEM-ECDH & MLKEM768-X25519 & SHA2-256
* openssh, libssh: refactor kx maps to use tuples
* alg_lists: mark MLKEM768/SNTRUP kex experimental
* nss: revert enabling mlkem768secp256r1
* nss: add mlkem768x25519 and mlkem768secp256r1, remove xyber
* gnutls: add GROUP-X25519-MLKEM768 and GROUP-SECP256R1-MLKEM768
* openssl: use both names for SecP256r1MLKEM768 / X25519MLKEM768
* openssh, TEST-PQ: rename MLKEM key_exchange to MLKEM768
* openssh: add support for sntrup761x25519-sha512 and mlkem768x25519-sha256
* openssl: map NULL to TLS_SHA256_SHA256:TLS_SHA384_SHA384...
* python/update-crypto-policies: pacify pylint
* fips-mode-setup: tolerate fips dracut module presence w/o FIPS
* fips-mode-setup: small Argon2 detection fix
* SHA1: add __openssl_block_sha1_signatures = 0
* fips-mode-setup: block if LUKS devices using Argon2 are detected
* update-crypto-policies: skip warning on --set=FIPS if bootc
* fips-setup-helper: skip warning, BTW
* fips-mode-setup: force --no-bootcfg when UKI is detected
* fips-setup-helper: add a libexec helper for anaconda
* fips-crypto-policy-overlay: automount FIPS policy
* openssh: make dss no longer enableble, support is dropped
* gnutls: wire GROUP-X25519-KYBER768 to X25519-KYBER768
* DEFAULT: switch to rh-allow-sha1-signatures = no...
* java: drop unused javasystem backend
* java: stop specifying jdk.tls.namedGroups in javasystem
* ec_min_size: introduce and use in java, default to 256
* java: use and include jdk.disabled.namedCurves
* BSI: Update BSI policy for new 2024 minimum recommendations
* fips-mode-setup: flashy ticking warning upon use
* fips-mode-setup: add another scary 'unsupported'
* CONTRIBUTING.md: add a small section on updating policies
* CONTRIBUTING.md: remove trailing punctuation from headers
* BSI: switch to 3072 minimum RSA key size
* java: make hash, mac and sign more orthogonal
* java: specify jdk.tls.namedGroups system property
* java: respect more key size restrictions
* java: disable anon ciphersuites, tying them to NULL...
* java: start controlling / disable DTLSv1.0
* nss: wire KYBER768 to XYBER768D00
* nss: unconditionally load p11-kit-proxy.so
* gnutls: make DTLS0.9 controllable again
* gnutls: retire GNUTLS_NO_TLS_SESSION_HASH
* openssh: remove OPENSSH_MIN_RSA_SIZE / OPENSSH_MIN_RSA_SIZE_FORCE
* gnutls: remove extraneous newline
* sequoia: move away from subprocess.getstatusoutput
* python/cryptopolicies/cryptopolicies.py: add trailing commas
* python, tests: rename MalformedLine to MalformedLineError
* Makefile: introduce SKIP_LINTING flag for packagers to use
* Makefile: run ruff
* tests: use pathlib
* tests: run(check=True) + CalledProcessError where convenient
* tests: use subprocess.run
* tests/krb5.py: check all generated policies
* tests: print to stderr on error paths
* tests/nss.py: also use encoding='utf-8'
* tests/nss.py: also use removesuffix
* tests/nss.py: skip creating tempfiles
* tests/java.pl -> tests/java.py
* tests/gnutls.pl -> tests/gnutls.py
* tests/openssl.pl -> tests/openssl.py
* tests/verify-output.pl: remove
* libreswan: do not use up pfs= / ikev2= keywords for default behaviour
- Update to version 20241010.5930b9a:
* LEGACY: enable 192-bit ciphers for nss pkcs12/smime
* nss: be stricter with new purposes
* nss: rewrite backend for 3.101
* cryptopolicies: parent scopes for dumping purposes
* policygenerators: move scoping inside generators
* TEST-PQ: disable pure Kyber768
* nss: wire XYBER768D00 to X25519-KYBER768
* TEST-PQ: update
* TEST-PQ: also enable sntrup761x25519-sha512 at openssh.com
* TEST-PQ, alg_lists, openssl: enable more experimental `sign` values
* TEST-PQ, python: add more groups, mark experimental
* openssl: mark liboqsprovider groups optional with ?
- Update to version 20240201.9f501f3:
* .gitlab-ci.yml: install sequoia-policy-config
* java: disable ChaCha20-Poly1305 where applicable
* fips-mode-setup: make sure ostree is detected in chroot
* fips-finish-install: make sure ostree is detected in chroot
* TEST-PQ: enable X25519-KYBER768 / P384-KYBER768 for openssl
* TEST-PQ: add a no-op subpolicy
* update-crypto-policies: Keep mid-sentence upper case
* fips-mode-setup: Write error messages to stderr
* fips-mode-setup: Fix some shellcheck warnings
* fips-mode-setup: Fix test for empty /boot
* fips-mode-setup: Avoid 'boot=UUID=' if /boot == /
* Update man pages
- Update to version 20231108.adb5572b:
* Print matches in syntax deprecation warnings
* Restore support for scoped ssh_etm directives
* fips-mode-setup: Fix usage with --no-bootcfg
* turn ssh_etm into an etm at SSH tri-state
* fips-mode-setup: increase chroot-friendliness
* bind: fix a typo that led to duplication of ECDSAPxxxSHAxxx
* pylintrc: use-implicit-booleaness-not-comparison-to-*
- avoid the cycle rpm/cmake/crypto-policies/python-rpm-macros:
we only need python3-base here, we don't need the python
macros as no module is being built
- Remove dependency on /usr/bin/python3, making scripts to depends on
the real python3 binary, not the link. bsc#1212476
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2026:4124-1
Released: Thu Sep 10 18:11:41 2026
Summary: Recommended update for glibc
Type: recommended
Severity: moderate
References: 1277247
This update for glibc fixes the following issues:
- Add -flive-patching=inline-clone to avoid untraceable inter-procedural
optimizations (bsc#1277247).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2026:4127-1
Released: Fri Sep 11 08:49:46 2026
Summary: Recommended update for permissions
Type: recommended
Severity: moderate
References: 1273300,1278351
This update for permissions fixes the following issue:
- Update to version 20250826:
* profiles: backport nvidia-modprobe (bsc#1278351)
* profiles: add cacti-spine cap_net_raw (bsc#1273300)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4176-1
Released: Mon Sep 14 12:29:48 2026
Summary: Security update for acl, attr
Type: security
Severity: important
References: 1268867,CVE-2026-54369,CVE-2026-54370,CVE-2026-54371
This update for acl, attr fixes the following issue:
- CVE-2026-54369,CVE-2026-54370,CVE-2026-54371: Symlink Traversal Privilege Escalation via getfattr/setfattr,
getfacl/setfacl/chacl, libacl (bsc#1268867).
Changes for acl:
- Update to 2.4.0 (jsc#PED-16501):
Major Issues Fixed:
- The libacl library functions acl_get_file(), acl_set_file(),
acl_extended_file(), and acl_delete_def_file() take a pathname argument
and follow symbolic links. When a privileged user calls one of those
functions, an attacker that controls a pathname component can replace a
file or directory with a symbolic link and redirect the operation to a
different file. This can lead to local privilege escalation.
(CVE-2026-54369, bsc#1268867)
The library functions cannot be fixed without breaking compatibility; the
described behaviour is by design.
Instead, version 2.4.0 of the acl package introduces the additional
functions acl_get_file_at(), acl_set_file_at(), acl_extended_file_at(), and
acl_delete_def_file_at(). These functions each take a dirfd file
descriptor argument and an at_flags argument and accept the
AT_SYMLINK_NOFOLLOW and AT_EMPTY_PATH flags. Use these functions to
control when to follow symbolic links. (CVE-2026-54370, bsc#1268867)
In addition, the libacl functions acl_get_fd(), acl_set_fd(), and
acl_extended_fd() functions always operate on the access ACL; the library
previously did not offer a way to operate on the default ACL of a directory
file descriptor. The new functions remove that restriction.
It will be up to each individual program to start using these new library
functions where appropriate.
- When walking directory trees, the getfacl, setfacl, chacl, and getfattr
utilities constructed the full pathname of each file in the tree and use that
pathname to access the file. When a privileged user used those utilities,
an attacker that controlled a pathname component could replace a directory with
a symbolic link and redirect the operation to a different file, leading to
a local privilege escalation. (CVE-2026-54371, bsc#1268867)
This is fixed by using directory file descriptors and operating relative to
those directory file descriptors.
- When resolving the final pathname component, the getfacl, setfacl, chacl,
getfattr, and setfattr utilities in some cases used functions that resolve
symbolic links. This includes the above mentioned libacl functions, but
also stat(), chmod(), and chown().
This is fixed by using symlink-safe functions throughout the code.
- When restoring a backup, the setfacl and setfattr utilities read the full
pathnames of files from the backup. When those pathnames were resolved,
pathname components that are symbolic links were traversed. An attacker
that controlled a pathname component could replace it with a symbolic link,
causing a privileged user to operate on a file other than the one intended.
This could lead to the same kind of local privilege escalation as discussed
before.
This is fixed by using openat2(RESOLVE_NO_SYMLINKS) to resolve the
directory components of a pathname, but see Compatibility Notes below for
the details.
Minor Issues Fixed:
- When a symbolic link was specified on the command line but symbolic link
traversal was disabled using option -P (--physical), the getfacl and
setfacl utilities previously silently ignored the symlink. Now, an ELOOP
('Too many levels of symbolic links') error will result instead.
- acl_delete_entry() now verifies that the specified entry belongs to the
specified acl.
- Numeric uids and gids that cannot be represented in types uid_t and gid_t
are checked more carefully and invalid numbers are rejected.
- Functions acl_get_file(), acl_get_file_at(), and acl_get_fd() will retry
several times when the size of an ACL grows unexpectedly; previously, they
only grew the allocated buffer once before giving up.
- When passed a directory file descriptor, function perm_copy_fd() didn't
copy the default ACL from one directory to the other. It now does.
- setfacl --restore accidentally ignored leading whitespace in filenames. It
no longer does.
- setfacl --restore accidentally called chmod() when in --test mode. It no
longer does.
- When the setfattr --restore option was used multiple times, a buffer was
accessed after being freed. This no longer happens.
- When the setfattr -h (--no-dereference) option was given after --restore,
it was ignored. Now, the options can be passed in any order.
- The -h (--no-dereference) option of getfattr prevented getfattr from
recursing into 'symbolic link directories'. This is wrong. When dirlink
is a symbolic link that refers to a directory, 'getfattr -Rh dirlink' will now
visit that directory. The -P (--physical) option can be used to prevent
that.
- Similarly, when a symbolic link referring to a directory was specified on
the getfacl or setfacl command line, the -R option did not cause that
directory to be visited. This has been fixed so that those directories
will now be visited. The -P (--physical) option can be used to prevent
Changes for attr:
- Update to 2.6.0 (jsc#PED-16501):
Major Issues Fixed:
- The libacl library functions acl_get_file(), acl_set_file(),
acl_extended_file(), and acl_delete_def_file() take a pathname argument
and follow symbolic links. When a privileged user calls one of those
functions, an attacker that controls a pathname component can replace a
file or directory with a symbolic link and redirect the operation to a
different file. This can lead to local privilege escalation.
(CVE-2026-54369, bsc#1268867)
The library functions cannot be fixed without breaking compatibility; the
described behaviour is by design.
Instead, version 2.4.0 of the acl package introduces the additional
functions acl_get_file_at(), acl_set_file_at(), acl_extended_file_at(), and
acl_delete_def_file_at(). These functions each take a dirfd file
descriptor argument and an at_flags argument and accept the
AT_SYMLINK_NOFOLLOW and AT_EMPTY_PATH flags. Use these functions to
control when to follow symbolic links. (CVE-2026-54370, bsc#1268867)
In addition, the libacl functions acl_get_fd(), acl_set_fd(), and
acl_extended_fd() functions always operate on the access ACL; the library
previously did not offer a way to operate on the default ACL of a directory
file descriptor. The new functions remove that restriction.
It will be up to each individual program to start using these new library
functions where appropriate.
- When walking directory trees, the getfacl, setfacl, chacl, and getfattr
utilities constructed the full pathname of each file in the tree
and use that
pathname to access the file. When a privileged user used those utilities,
an attacker that controlled a pathname component could replace a
directory with
a symbolic link and redirect the operation to a different file, leading to
a local privilege escalation. (CVE-2026-54371, bsc#1268867)
This is fixed by using directory file descriptors and operating relative to
those directory file descriptors.
- When resolving the final pathname component, the getfacl, setfacl, chacl,
getfattr, and setfattr utilities in some cases used functions that resolve
symbolic links. This includes the above mentioned libacl functions, but
also stat(), chmod(), and chown().
This is fixed by using symlink-safe functions throughout the code.
- When restoring a backup, the setfacl and setfattr utilities read the full
pathnames of files from the backup. When those pathnames were resolved,
pathname components that are symbolic links were traversed. An attacker
that controlled a pathname component could replace it with a symbolic link,
causing a privileged user to operate on a file other than the one intended.
This could lead to the same kind of local privilege escalation as discussed
before.
This is fixed by using openat2(RESOLVE_NO_SYMLINKS) to resolve the
directory components of a pathname, but see Compatibility Notes below for
the details.
Minor Issues Fixed:
- When a symbolic link was specified on the command line but symbolic link
traversal was disabled using option -P (--physical), the getfacl and
setfacl utilities previously silently ignored the symlink. Now, an ELOOP
('Too many levels of symbolic links') error will result instead.
- acl_delete_entry() now verifies that the specified entry belongs to the
specified acl.
- Numeric uids and gids that cannot be represented in types uid_t and gid_t
are checked more carefully and invalid numbers are rejected.
- Functions acl_get_file(), acl_get_file_at(), and acl_get_fd() will retry
several times when the size of an ACL grows unexpectedly; previously, they
only grew the allocated buffer once before giving up.
- When passed a directory file descriptor, function perm_copy_fd() didn't
copy the default ACL from one directory to the other. It now does.
- setfacl --restore accidentally ignored leading whitespace in filenames. It
no longer does.
- setfacl --restore accidentally called chmod() when in --test mode. It no
longer does.
- When the setfattr --restore option was used multiple times, a buffer was
accessed after being freed. This no longer happens.
- When the setfattr -h (--no-dereference) option was given after --restore,
it was ignored. Now, the options can be passed in any order.
- The -h (--no-dereference) option of getfattr prevented getfattr from
recursing into 'symbolic link directories'. This is wrong. When dirlink
is a symbolic link that refers to a directory, 'getfattr -Rh
dirlink' will now
visit that directory. The -P (--physical) option can be used to prevent
that.
- Similarly, when a symbolic link referring to a directory was specified on
the getfacl or setfacl command line, the -R option did not cause that
directory to be visited. This has been fixed so that those directories
will now be visited. The -P (--physical) option can be used to prevent
- update to 2.5.2:
* attr: eliminate a dead store in attr_copy_action()
* libattr: Set symbol versions for legacy syscalls via attribute
or asm
* exports: use LGPL for library code
* documentation updates
* translation updates (Polish, Dutch, Gregorian, French)
* build system updates
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4241-1
Released: Thu Sep 17 13:48:51 2026
Summary: Security update for pcre2
Type: security
Severity: important
References: 1277707,1277708,1277709,1277710,1277711,1277713,1279893,1280050,1280051,1280052,1280053,1280054,CVE-2026-86145,CVE-2026-89156,CVE-2026-89157,CVE-2026-89158,CVE-2026-89160,CVE-2026-89161
This update for pcre2 fixes the following issues:
- CVE-2026-86145: missing size checks in `pcre2_dfa_match` code can lead to an out-of-bounds write (bsc#1279893).
- CVE-2026-89156: out-of-bounds read via invalid UTF data during JIT fallback (bsc#1280054).
- CVE-2026-89157: out-of-bounds write via large pattern input (bsc#1280053).
- CVE-2026-89158: out-of-bounds write due to integer overflow in `pcre2_compile_32` for 32-bit platforms (bsc#1280052).
- CVE-2026-89160: out-of-bounds read during the `PCRE2_MATCH_INVALID_UTF` matching of an invalid UTF subject
(bsc#1280051).
- CVE-2026-89161: incorrect free operation due to mishandling of a previously copied subject in `pcre2_jit_match`
(bsc#1280050).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4250-1
Released: Thu Sep 17 18:00:36 2026
Summary: Security update for glibc
Type: security
Severity: moderate
References: 1267610,1274723,1274726,1276892,1276946,1277262,1277921,1277922,CVE-2026-18374,CVE-2026-19499,CVE-2026-19542,CVE-2026-6368,CVE-2026-6791,CVE-2026-77117,CVE-2026-80489
This update for glibc fixes the following issues:
- CVE-2026-6368: invalid free via wordexp WRDE_APPEND rollback (bsc#1274726).
- CVE-2026-6791: stack overflow in wordexp tilde expansion (bsc#1274723).
- CVE-2026-18374: heap buffer overflow in the fopen ccs extension (bsc#1277262).
- CVE-2026-19499: buffer overflow in strfmon right-justification padding (bsc#1276892).
- CVE-2026-19542: out-of-bounds array write in tdelete (bsc#1276946).
- CVE-2026-77117: SHIFT_JISX0213 decoding lacks pending character reset (bsc#1277921).
- CVE-2026-80489: EUC_JISX0213 decoding lacks pending character reset (bsc#1277922).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4414-1
Released: Fri Oct 2 09:37:26 2026
Summary: Security update for openssl-3
Type: security
Severity: important
References: 1280587,1280589,1280590,1280591,1280592,1280594,1280595,1280596,1280597,1280598,1280599,1281125,CVE-2026-35189,CVE-2026-35191,CVE-2026-54872,CVE-2026-54875,CVE-2026-72897,CVE-2026-75804,CVE-2026-75805,CVE-2026-75806,CVE-2026-77696,CVE-2026-84782,CVE-2026-84784
This update for openssl-3 fixes the following issues:
- CVE-2026-35189: Excessive Memory Allocation in Relative CRLDP Processing (bsc#1280589).
- CVE-2026-35191: QUIC Unvalidated Amplification Credit may be Over Accounted (bsc#1280590).
- CVE-2026-54872: Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves (bsc#1280591).
- CVE-2026-54875: Non-Constant-Time SM2 Scalar Multiplication on ARM64 and RISC-V (bsc#1280592).
- CVE-2026-72897: Out-of-Bounds Access After SSL_set_SSL_CTX() During a Handshake (bsc#1280594).
- CVE-2026-75804: QUIC Connection-Level Flow Control is Not Enforced for Streams (bsc#1280595).
- CVE-2026-75805: NULL Pointer Dereference in CMP Client Revocation Response Handling (bsc#1280596).
- CVE-2026-75806: Unauthenticated and Undersized DTLS 1.2 AEAD Record Causes DoS (bsc#1280597).
- CVE-2026-77696: Timing Side-Channel in SM2 Signature Generation (bsc#1280598).
- CVE-2026-84782: DTLS Retransmits Handshake Messages From a Stale Buffer Offset (bsc#1280587).
- CVE-2026-84784: QUIC: Unbounded RETIRE_CONNECTION_ID Backlog (bsc#1280599).
Other non-security fixes:
- Add a conflicts with previous crypto-policies versions (bsc#1281125)
The following package changes have been done:
- crypto-policies-20250714.cd6043a-150700.6.4.2 updated
- libtirpc-netconfig-1.3.4-150300.3.26.1 updated
- glibc-2.38-150600.14.58.1 updated
- libpcre2-8-0-10.42-150600.3.3.1 updated
- libgcc_s1-15.3.0+git11272-150000.1.12.1 updated
- libbz2-1-1.0.8-150400.3.4.1 updated
- libattr1-2.6.0-150000.4.3.1 updated
- libacl1-2.4.0-150000.4.6.1 updated
- libstdc++6-15.3.0+git11272-150000.1.12.1 updated
- login_defs-4.17.2-150600.17.24.1 updated
- permissions-20250826-150700.16.5.1 updated
- libopenssl3-3.5.0-150700.5.53.2 updated
- libopenssl-3-fips-provider-3.5.0-150700.5.53.2 updated
- krb5-1.20.1-150600.11.19.1 updated
- libtirpc3-1.3.4-150300.3.26.1 updated
- pam-1.3.0-150000.6.89.1 updated
- libsubid5-4.17.2-150600.17.24.1 updated
- shadow-4.17.2-150600.17.24.1 updated
- grafana-12.4.5-150200.3.91.1 updated
- container:bci-bci-base-15.7-639cc27d64fa2f2a457d7b6d4dbdd89247dbfd872ad438f5a1799fb085c6c720-0 updated
More information about the sle-container-updates
mailing list