SUSE-CU-2026:12087-1: Security update of suse/multi-linux-manager/5.2/x86_64/proxy-salt-broker
sle-container-updates at lists.suse.com
sle-container-updates at lists.suse.com
Fri Oct 9 09:14:07 UTC 2026
SUSE Container Update Advisory: suse/multi-linux-manager/5.2/x86_64/proxy-salt-broker
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2026:12087-1
Container Tags : suse/multi-linux-manager/5.2/x86_64/proxy-salt-broker:5.2.1 , suse/multi-linux-manager/5.2/x86_64/proxy-salt-broker:5.2.1.9.5.1 , suse/multi-linux-manager/5.2/x86_64/proxy-salt-broker:latest
Container Release : 9.5.1
Severity : important
Type : security
References : 1208800 1212476 1216950 1227370 1230568 1230949 1236136 1236165
1236599 1239009 1242233 1243014 1243459 1243564 1243830 1246570
1247463 1250233 1250234 1252286 1252306 1252696 1253025 1253043
1255764 1256070 1256829 1256831 1256832 1256833 1257151 1257274
1257463 1258311 1258382 1258500 1258567 1259225 1259652 1259825
1260342 1261678 1262157 1262315 1263366 1263367 1263656 1263658
1263822 1265219 1265472 1266343 1266344 1266347 1266481 1266786
1267261 1267610 1267871 1267912 1268131 1268228 1268325 1268473
1268587 1268673 1268755 1269192 1269253 1269316 1269534 1269679
1270033 1270039 1270040 1270047 1270141 1270694 1271075 1271116
1271124 1271329 1271332 1271382 1271467 1271523 1271678 1271681
1271712 1271712 1271841 1271902 1271963 1272298 1272392 1272404
1272538 1272621 1272988 1273073 1273131 1273144 1273846 1273853
1274023 1274227 1274613 1274720 1274723 1274726 1274740 1274774
1274774 1274775 1274777 1274788 1274788 1274790 1274791 1274792
1274795 1274795 1274796 1274797 1274798 1275660 1275837 1276892
1276946 1277247 1277262 1277707 1277708 1277709 1277710 1277711
1277713 1277921 1277922 1279893 1280050 1280051 1280052 1280053
1280054 1280587 1280589 1280590 1280591 1280592 1280594 1280595
1280596 1280597 1280598 1280599 1281125 CVE-2024-12797 CVE-2024-13176
CVE-2024-9143 CVE-2025-11187 CVE-2025-15444 CVE-2025-15468 CVE-2025-15469
CVE-2025-27587 CVE-2025-4575 CVE-2025-66199 CVE-2025-69277 CVE-2025-9231
CVE-2025-9232 CVE-2026-11850 CVE-2026-14456 CVE-2026-14457 CVE-2026-18374
CVE-2026-18798 CVE-2026-19499 CVE-2026-19542 CVE-2026-2673 CVE-2026-28390
CVE-2026-34181 CVE-2026-34182 CVE-2026-35189 CVE-2026-35191 CVE-2026-39821
CVE-2026-40355 CVE-2026-40356 CVE-2026-42250 CVE-2026-42764 CVE-2026-5435
CVE-2026-54872 CVE-2026-54874 CVE-2026-54874 CVE-2026-54875 CVE-2026-6238
CVE-2026-63007 CVE-2026-63009 CVE-2026-63072 CVE-2026-63072 CVE-2026-63073
CVE-2026-63074 CVE-2026-63075 CVE-2026-63076 CVE-2026-6368 CVE-2026-6791
CVE-2026-71400 CVE-2026-72897 CVE-2026-75803 CVE-2026-75804 CVE-2026-75805
CVE-2026-75806 CVE-2026-77117 CVE-2026-77696 CVE-2026-80489 CVE-2026-84782
CVE-2026-84784 CVE-2026-86145 CVE-2026-89156 CVE-2026-89157 CVE-2026-89158
CVE-2026-89160 CVE-2026-89161
-----------------------------------------------------------------
The container suse/multi-linux-manager/5.2/x86_64/proxy-salt-broker was updated. The following patches have been included in this update:
-----------------------------------------------------------------
Advisory ID: SUSE-OU-2025:2763-1
Released: Tue Aug 12 14:45:40 2025
Summary: Optional update for libyaml
Type: optional
Severity: moderate
References: 1246570
This update for libyaml ships the missing libyaml-0-2 library package to
SUSE MicroOS 5.1 and 5.2.
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:2848-1
Released: Fri Jul 10 13:38:57 2026
Summary: Security update for krb5, krb5-mini
Type: security
Severity: important
References: 1263366,1263367,1268131,CVE-2026-11850,CVE-2026-40355,CVE-2026-40356
This update for krb5, krb5-mini fixes the following issues
- CVE-2026-11850: integer underflow in berval2tl_data() leads to heap out-of-bounds read (bsc#1268131).
- CVE-2026-40355: Denial of Service via NULL pointer dereference in NegoEx mechanism (bsc#1263366).
- CVE-2026-40356: Denial of Service via integer underflow and out-of-bounds read (bsc#1263367).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3030-1
Released: Wed Jul 15 11:53:06 2026
Summary: Security update for glibc
Type: security
Severity: moderate
References: 1263656,1263658,CVE-2026-5435,CVE-2026-6238
This update for glibc fixes the following issues
- CVE-2026-5435: unchecked buffer writing in TSIG handling can lead to an out-of-bounds write (bsc#1263656).
- CVE-2026-6238: insufficient RDATA length validation can lead to application crashes or uninitialized memory disclosure
(bsc#1263658).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2026:3118-1
Released: Fri Jul 17 22:18:41 2026
Summary: Recommended update for gcc15
Type: recommended
Severity: moderate
References: 1252306,1253043,1257463
This update for gcc15 fixes the following issues:
- Update to GCC 15.3 release
- Drop -fhardened from RPM_OPT_FLAGS
- Avoid conflicts between %gcc_libc_bootstrap packages of different
versions if update-alternatives are still in use (SLE 15 and older)
- Allow conversions to/from uint32_t. Filter out -Wtime_t-conversion
from flags to build D target library files. [jsc#PED-15601]
- Remove loongarch64 from quadmath_arch. On LoongArch long double
is IEEE quad, so libquadmath is not needed and no longer built.
- includes fix for bogus expression simplification [bsc#1257463]
even when not available at build time. [bsc#1253043]
- Backport fix that cures a miscompile of libgo on arm. [bsc#1252306]
- Check availability of builtins at expand time
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3444-1
Released: Fri Jul 31 22:04:31 2026
Summary: Security update for openssl-3
Type: security
Severity: moderate
References: 1271712
This update for openssl-3 fixes the following issues:
- HollowByte: DoS vector against OpenSSL TLS ClientHello via remote, attacker-controlled memory allocations
(bsc#1271712).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3578-1
Released: Tue Aug 11 15:58:41 2026
Summary: Security update for openssl-1_1
Type: security
Severity: moderate
References: 1271712
This update for openssl-1_1 fixes the following issues:
- HollowByte: DoS vector against OpenSSL TLS ClientHello via remote, attacker-controlled memory allocations
(bsc#1271712).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:3835-1
Released: Thu Aug 27 13:53:51 2026
Summary: Security update for openssl, openssl-3
Type: security
Severity: important
References: 1216950,1236136,1236599,1243014,1243459,1243564,1247463,1250233,1250234,1256829,1256831,1256832,1256833,1257274,1259652,1261678,1266344,1266347,CVE-2024-12797,CVE-2024-13176,CVE-2024-9143,CVE-2025-11187,CVE-2025-15468,CVE-2025-15469,CVE-2025-27587,CVE-2025-4575,CVE-2025-66199,CVE-2025-9231,CVE-2025-9232,CVE-2026-2673,CVE-2026-28390,CVE-2026-34182,CVE-2026-42764
This update for openssl, openssl-3 fixes the following issues:
OpenSSL is updated to 3.5.0 in SLE-15-SP7: (jsc#PED-16072)
* Enables Post-Quantum Cryptography (PQC) TLS support
Security issues fixed:
* CVE-2026-42764: NULL pointer dereference in QUIC server initial packet handling (bsc#1266347)
* CVE-2026-34182: CMS AuthEnvelopedData Processing May Accept Forged Messages (bsc#1266344)
* CVE-2026-28390: NULL pointer dereference during processing of a crafted CMS EnvelopedData message with KeyTransportRecipientInfo (bsc#1261678)
* CVE-2026-2673: TLS 1.3 servers may choose unexpected key agreement group (bsc#1259652)
* CVE-2025-66199: TLS 1.3 CompressedCertificate excessive memory allocation (bsc#1256833)
* CVE-2025-15469: 'openssl dgst' one-shot codepath silently truncates inputs greater than 16MB (bsc#1256832)
* CVE-2025-11187: Improper validation of PBMAC1 parameters in PKCS#12 MAC verification (bsc#1256829)
* CVE-2025-15468: NULL dereference in SSL_CIPHER_find() function on unknown cipher ID (bsc#1256831)
* CVE-2025-9231: Fix timing side-channel in SM2 algorithm on 64 bit ARM (bsc#1250233)
* CVE-2025-9232: Fix out-of-bounds read in HTTP client no_proxy handling (bsc#1250234)
* CVE-2025-4575: Fix the x509 application adding trusted use instead of rejected use (bsc#1243564)
* CVE-2025-27587: Minerva side channel vulnerability in P-384 (bsc#1243459)
* CVE-2024-12797: Fixed RFC7250 handshakes with unauthenticated servers don't abort as
expected. (bsc#1236599)
* CVE-2024-13176: Fixed timing side-channel in ECDSA signature computation.
* CVE-2024-9143: Fixed possible OOB memory access with invalid low-level GF(2^m) elliptic
curve parameters.
* CVE-2024-13176: Fix timing side-channel in ECDSA signature computation (bsc#1236136)
POWER performance enhancements:
* Optimized MLDSA NTT, supports p8 and above architectures (jsc#PED-14569)
- Adapt spec file for immutability via systemd-tmpfiles (jsc#PED-14813)
- Fix check %{suse_version} > 1600 (jsc#PED-15816)
- Fix NULL pointer dereference when processing an OCSP response
- Remove showciphers.c in favor of openssl ciphers
- Use %ldconfig_scriptlets
- Enable livepatching support for ppc64le [bsc#1257274]
- Move ssl configuration files to the libopenssl package [bsc#1247463]
- Don't install unneeded NOTES
- Disable LTO for userspace livepatching [jsc#PED-13245]
- Fix P-384 curve on lower-than-P9 PPC64 targets [bsc#1243014]
- FIPS: Fix the speed command in FIPS mode for KMAC
- FIPS: Restore the check to deny SHA1 signatures in FIPS mode and
the functionality to allow/deny via crypto-policies. [jsc#PED-12224]
Update to 3.5.0:
* Changes:
- Default encryption cipher for the req, cms, and smime applications
changed from des-ede3-cbc to aes-256-cbc.
- The default TLS supported groups list has been changed to include
and prefer hybrid PQC KEM groups. Some practically unused groups
were removed from the default list.
- The default TLS keyshares have been changed to offer X25519MLKEM768
and and X25519.
- All BIO_meth_get_*() functions were deprecated.
* New features:
- Support for server side QUIC (RFC 9000)
- Support for 3rd party QUIC stacks including 0-RTT support
- Support for PQC algorithms (ML-KEM, ML-DSA and SLH-DSA)
- A new configuration option no-tls-deprecated-ec to disable support
for TLS groups deprecated in RFC8422
- A new configuration option enable-fips-jitter to make the FIPS
provider to use the JITTER seed source
- Support for central key generation in CMP
- Support added for opaque symmetric key objects (EVP_SKEY)
- Support for multiple TLS keyshares and improved TLS key establishment
group configurability
- API support for pipelining in provided cipher algorithms
Changes between 3.3.0 and 3.4.0:
* Changes:
- Deprecation of TS_VERIFY_CTX_set_* functions and addition of
replacement TS_VERIFY_CTX_set0_* functions with improved semantics
- The X25519 and X448 key exchange implementation in the FIPS provider
is unapproved and has fips=no property.
- SHAKE-128 and SHAKE-256 implementations have no default digest length
anymore. That means these algorithms cannot be used with
EVP_DigestFinal/_ex() unless the xoflen param is set before.
- Setting config_diagnostics=1 in the config file will cause errors to
be returned from SSL_CTX_new() and SSL_CTX_new_ex() if there is an
error in the ssl module configuration.
- An empty renegotiate extension will be used in TLS client hellos
instead of the empty renegotiation SCSV, for all connections with a
minimum TLS version > 1.0.
- Deprecation of SSL_SESSION_get_time(), SSL_SESSION_set_time() and
SSL_CTX_flush_sessions() functions in favor of their respective _ex
functions which are Y2038-safe on platforms with Y2038-safe time_t
* New features:
- Support for directly fetched composite signature algorithms such as
RSA-SHA2-256 including new API functions
- FIPS indicators support in the FIPS provider and various updates of
the FIPS provider required for future FIPS 140-3 validations
- Implementation of RFC 9579 (PBMAC1) in PKCS#12
- An optional additional random seed source RNG JITTER using a statically
linked jitterentropy library
- New options -not_before and -not_after for explicit setting start and
end dates of certificates created with the req and x509 apps
- Support for integrity-only cipher suites TLS_SHA256_SHA256 and
TLS_SHA384_SHA384 in TLS 1.3, as defined in RFC 9150
- Support for retrieving certificate request templates and CRLs in CMP
- Support for additional X.509v3 extensions related to Attribute Certificates
- Initial Attribute Certificate (RFC 5755) support
- Possibility to customize ECC groups initialization to use precomputed
values to save CPU time and use of this feature by the P-256 implementation
Changes between 3.2.0 and 3.3.0:
* Changes:
- Optimized AES-CTR for ARM Neoverse V1 and V2
- Various optimizations for cryptographic routines using RISC-V vector
crypto extensions
- Added assembly implementation for md5 on loongarch64
- Accept longer context for TLS 1.2 exporters
- The activate and soft_load configuration settings for providers in
openssl.cnf have been updated to require a value of [1|yes|true|on]
(in lower or UPPER case) to enable the setting. Conversely a value of
[0|no|false|off] will disable the setting.
- In openssl speed, changed the default hash function used with hmac from
md5 to sha256.
- The -verify option to the openssl crl and openssl req will make the
program exit with 1 on failure.
- The d2i_ASN1_GENERALIZEDTIME(), d2i_ASN1_UTCTIME(), ASN1_TIME_check(),
and related functions have been augmented to check for a minimum length
of the input string, in accordance with ITU-T X.690 section 11.7 and 11.8.
- OPENSSL_sk_push() and sk__push() functions now return 0 instead of -1
if called with a NULL stack argument.
- New limit on HTTP response headers is introduced to HTTP client.
The default limit is set to 256 header lines.
* Bug fixes and mitigations:
- The BIO_get_new_index() function can only be called 127 times before
it reaches its upper bound of BIO_TYPE_MASK and will now return -1
once its exhausted.
* new features:
- Support for qlog for tracing QUIC connections has been added
- Added APIs to allow configuring the negotiated idle timeout for QUIC
connections, and to allow determining the number of additional streams
that can currently be created for a QUIC connection.
- Added APIs to allow disabling implicit QUIC event processing for QUIC
SSL objects
- Added APIs to allow querying the size and utilisation of a QUIC
stream's write buffer
- New API SSL_write_ex2, which can be used to send an end-of-stream (FIN)
condition in an optimised way when using QUIC.
- Limited support for polling of QUIC connection and stream objects in a
non-blocking manner.
- Added a new EVP_DigestSqueeze() API. This allows SHAKE to squeeze multiple
times with different output sizes.
- The BLAKE2s hash algorithm matches BLAKE2b's support for configurable
output length.
- The EVP_PKEY_fromdata function has been augmented to allow for the
derivation of CRT (Chinese Remainder Theorem) parameters when requested
- Added API functions SSL_SESSION_get_time_ex(), SSL_SESSION_set_time_ex()
using time_t which is Y2038 safe on 32 bit systems when 64 bit time
is enabled.
- Unknown entries in TLS SignatureAlgorithms, ClientSignatureAlgorithms
config
options and the respective calls to SSL[_CTX]_set1_sigalgs() and
SSL[_CTX]_set1_client_sigalgs() that start with ? character are ignored
and the configuration will still be used.
- Added -set_issuer and -set_subject options to openssl x509 to override
the Issuer and Subject when creating a certificate. The -subj option
now is an alias for -set_subject.
- Added several new features of CMPv3 defined in RFC 9480 and RFC 9483
- New option SSL_OP_PREFER_NO_DHE_KEX, which allows configuring a TLS1.3
server to prefer session resumption using PSK-only key exchange over
PSK with DHE, if both are available.
- New atexit configuration switch, which controls whether the OPENSSL_cleanup
is registered when libcrypto is unloaded.
- Added X509_STORE_get1_objects to avoid issues with the existing
X509_STORE_get0_objects API in multi-threaded applications.
- Support for using certificate profiles and extened delayed delivery in CMP
- FIPS: Mark SHA-1 as non-approved in the SLI. [jsc#PED-12224]
- Introduce --without lto. When %{optflags} contains -flto=*, tests cases are
also built using -flto=* which significantly increases build times, this
option disables lto which improve iteration times when developing.
Update to 3.2.4:
- Remove the engines' directories and symlinks that were added to
allow parallel installations with openssl-1_1.
- Add ktls capability [bsc#1216950]
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2026:3980-1
Released: Sun Sep 6 09:44:23 2026
Summary: Recommended update for libtirpc
Type: recommended
Severity: important
References: 1274740
This update for libtirpc fixes the following issues:
- Fix: Possible mem leak from libtirpc [ thread::XRF51s_MK4mkPFEu7JKj0Ss:: ] (bsc#1274740):
* rpcb_clnt.c: fix memory leak in destroy_addr
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4039-1
Released: Mon Sep 7 10:29:11 2026
Summary: Security update for openssl-3
Type: security
Severity: important
References: 1266343,1274774,1274777,1274788,1274790,1274791,1274792,1274795,1274796,1274797,1274798,1275837,CVE-2026-14456,CVE-2026-14457,CVE-2026-18798,CVE-2026-34181,CVE-2026-54874,CVE-2026-63072,CVE-2026-63073,CVE-2026-63074,CVE-2026-63075,CVE-2026-63076,CVE-2026-75803
This update for openssl-3 fixes the following issues:
August 2026 release.
- CVE-2026-14456: unbounded memory growth in QUIC server incoming channel queue (bsc#1274791).
- CVE-2026-14457: RPK server signature algorithm selection can dereference a missing certificate (bsc#1274792).
- CVE-2026-18798: QUIC server may trigger double free when processing INITIAL packet (bsc#1274777).
- CVE-2026-34181: PKCS#12 files with PBMAC1 are accepted with short HMAC keys (bsc#1266343).
- CVE-2026-54874: excessive Memory Use Buffering DTLS Records for a Future Epoch (bsc#1274795).
- CVE-2026-63072: heap buffer overflow in CMS key unwrapping (bsc#1274788).
- CVE-2026-63073: untrusted sender DN used as format string in CMP response validation (bsc#1274796).
- CVE-2026-63074: CMP indefinite cache growth of `ExtraCerts` (bsc#1274797).
- CVE-2026-63075: QUIC ACK-only packet retention can cause memory exhaustion (bsc#1274798).
- CVE-2026-63076: invalid pointer dereference in CMP server via crafted `protectionAlg` (bsc#1274790).
- CVE-2026-75803: AEAD forgeries with empty ciphertext when using `EVP_Cipher()` (bsc#1275837).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4041-1
Released: Mon Sep 7 10:29:44 2026
Summary: Security update for openssl-1_1
Type: security
Severity: important
References: 1274774,1274788,1274795,CVE-2026-54874,CVE-2026-63072
This update for openssl-1_1 fixes the following issues:
August 2026 release.
- CVE-2026-54874: excessive memory use buffering DTLS records for a future epoch (bsc#1274795).
- CVE-2026-63072: heap buffer overflow in CMS key unwrapping (bsc#1274788).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4055-1
Released: Mon Sep 7 17:48:12 2026
Summary: Security update for bzip2
Type: security
Severity: low
References: 1266786,CVE-2026-42250
This update for bzip2 fixes the following issue:
- CVE-2026-42250: off-by-one error in the bzip2recover utility when processing a specially crafted file can lead to a
crash (bsc#1266786).
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2026:4110-1
Released: Wed Sep 9 17:00:16 2026
Summary: Recommended update for crypto-policies
Type: recommended
Severity: important
References: 1212476,1227370,1236165,1239009,1242233,1243830,1252696,1253025,1258311,1259825,1262315,1275660
This update for crypto-policies fixes the following issues:
- Update crypto-policies for Post-Quantum Cryptography (PQC) TLS
support in SLE-15-SP7 (jsc#PED-16072):
* Add support for mlkem768x25519-sha256 in openssh 9.6p1 (bsc#1275660)
* Add support for python36 (jsc#PED-16072)
* Add support for sntrup761x25519-sha512 at openssh.com and remove
it for sntrup761x25519-sha512 in openssh 9.6p1 in SLE-15-SP7
as it only lists the former (bsc#1258311, bsc#1259825)
- Allow X25519 as required for sntrup761x25519-sha512 at openssh.com
and sntrup761x25519-sha512 in the DEFAULT policy. (bsc#1259825)
- Add PQC support for OpenSSH (bsc#1258311, bsc#1259825)
* Enable sntrup761x25519-sha512 for OpenSSH by default
- Modify the output of fips-mode-setup to hint the user when
setting the FIPS mode in transactional systems to use the
command 'transactional-update setup-fips'. (bsc#1262315)
- Adapt the manpages to SUSE/openSUSE:
* Compress all the man pages for update-crypto-policies.8.gz,
crypto-policies.7.gz, fips-finish-install.8.gz and
fips-mode-setup.8.gz into man-crypto-policies.tar.xz
- Update to version 20250714.cd6043a: [bsc#1253025, bsc#1252696]
* gnutls: enable ML-DSA, for both secure-sig and secure-sig-for-cert
* python, policies, tests: alias X25519-MLKEM768 to MLKEM768-X25519
* FIPS: disable MLKEM768-X25519 for openssh (no-op)
* FIPS: deprioritize X25519-MLKEM768 over P256-MLKEM768 for openssl...
* TEST-PQ: be more careful with the ordering
* openssl: send one PQ and one classic key_share; prioritize PQ groups
* sequoia: Generate AEAD policy
* Do not include EdDSA in FIPS policy
* sequoia: Add PQC algorithm
* sequoia: Run tests against PQC capable policy-config-check
* Revert 'openssl, policies: implement group_key_share option'
* openssl, policies: implement group_key_share option
* FIPS: enable hybrid ML-KEM (TLS only) and pure ML-DSA
* python/build-crypto-policies: output diffs on --test mismatches
* sequoia, rpm-sequoia: use ignore_invalid with sha3, x25519, ...
* policies, alg_lists, openssl: remove KYBER from allowed values
* openssl: stricter enabling of Ciphersuites
* openssl: make use of -CBC and -AESGCM keywords
* openssl: add TLS 1.3 Brainpool identifiers
* fix warning on using experimental key_exchanges
* update-crypto-policies: don't output FIPS warning in fips mode
* openssh: map mlkem768x25519-sha256 to KEM-ECDH & MLKEM768-X25519 & SHA2-256
* openssh, libssh: refactor kx maps to use tuples
* alg_lists: mark MLKEM768/SNTRUP kex experimental
* nss: revert enabling mlkem768secp256r1
* nss: add mlkem768x25519 and mlkem768secp256r1, remove xyber
* gnutls: add GROUP-X25519-MLKEM768 and GROUP-SECP256R1-MLKEM768
* openssl: use both names for SecP256r1MLKEM768 / X25519MLKEM768
* openssh, TEST-PQ: rename MLKEM key_exchange to MLKEM768
* openssh: add support for sntrup761x25519-sha512 and mlkem768x25519-sha256
* LEGACY: enable 192-bit ciphers for nss pkcs12/smime
* openssl: map NULL to TLS_SHA256_SHA256:TLS_SHA384_SHA384...
* nss: be stricter with new purposes
* python/update-crypto-policies: pacify pylint
* fips-mode-setup: tolerate fips dracut module presence w/o FIPS
* fips-mode-setup: small Argon2 detection fix
* SHA1: add __openssl_block_sha1_signatures = 0
* fips-mode-setup: block if LUKS devices using Argon2 are detected
* update-crypto-policies: skip warning on --set=FIPS if bootc
* fips-setup-helper: skip warning, BTW
* fips-mode-setup: force --no-bootcfg when UKI is detected
* fips-crypto-policy-overlay: automount FIPS policy
* nss: rewrite backend for 3.101
* cryptopolicies: parent scopes for dumping purposes
* policygenerators: move scoping inside generators
* openssh: make dss no longer enableble, support is dropped
* gnutls: wire GROUP-X25519-KYBER768 to X25519-KYBER768
* TEST-PQ: disable pure Kyber768
* DEFAULT: switch to rh-allow-sha1-signatures = no...
* java: drop unused javasystem backend
* java: stop specifying jdk.tls.namedGroups in javasystem
* ec_min_size: introduce and use in java, default to 256
* java: use and include jdk.disabled.namedCurves
* BSI: Update BSI policy for new 2024 minimum recommendations
* fips-mode-setup: flashy ticking warning upon use
* fips-mode-setup: add another scary 'unsupported'
* BSI: switch to 3072 minimum RSA key size
* java: make hash, mac and sign more orthogonal
* java: specify jdk.tls.namedGroups system property
* java: respect more key size restrictions
* java: disable anon ciphersuites, tying them to NULL...
* java: start controlling / disable DTLSv1.0
* nss: wire KYBER768 to XYBER768D00
- Update to version 20250425.9267dee:
* openssl: fix mistakes in integrity-only cipher definitions
* NO-PQ, cryptopolicies: add experimental value suppression
* nss: add mlkem768x25519 and mlkem768secp256r1
* gnutls: 'allow-rsa-pkcs1-encrypt = false' everywhere but in LEGACY
* TEST-PQ, openssh: add support for MLKEM768 key_exchange
* LEGACY: drop cipher at pkcs12 = SEED-CBC
* fips-crypto-policy-overlay: automount FIPS policy, follow-up fixes
* nss: TLS-REQUIRE-EMS in FIPS
* DEFAULT: disable RSA key exchange
* LEGACY: disable sign = *-SHA1
* nss: wire XYBER768D00 to X25519-KYBER768, not KYBER768
- Add the FIPS scripts fips-finish-install and fips-mode-setup as
sources in the spec file as they have been removed upstream.
* We will maintain these scripts downstream.
* Update the man pages for update-crypto-policies.8.gz
* Add man pages in text file in compressed form in the file
man-fips-scripts.tar.xz and add them to the Makefile.
- Update to version 20250324.3714354:
* NO-PQ: introduce
* LEGACY/DEFAULT/FUTURE: enable hybrid ML-KEM and pure ML-DSA
* _openssl_block_sha1_signatures: flip the default to 1
* sequoia: add sha3, x25519, ed25519, x448, ed448, but not for rpm-sequoia
* sequoia: refactor a bit
* openssl: specify default key size for req
* gnutls: support P384-MLKEM1024
* openssl: stop generating `openssl` in favour of `opensslcnf`
* gnutls: drop kyber (switching to leancrypto took it away)
* openssl: use both names for P384-MLKEM1024
* Detect the presence of nss-policy-check
* Don't use hardcoded python3 path
* Make xsltproc settable as XSLTPROC
* python/cryptopolicies/validation/scope.py: fix new ruff rule RUF021
* Update the info in the README.SUSE file
* Remove the FEDORA policies and directories
- Allow openssl to load when using the DEFAULT policy, and also
other policies, in FIPS mode. [bsc#1243830, bsc#1242233]
- Relax the nss version requirement since the mlkem768secp256r1
enablement has been reverted.
- Allow sshd in FIPS mode when using the DEFAULT policy [bsc#1227370]
- Enable SHA1 sigver in the DEFAULT policy.
- Remove also sequoia config and generator files
- Remove not needed fips bind mount service
- Update to version 20250124.4d262e7: [bsc#1239009, bsc#1236165]
* openssl: stricter enabling of Ciphersuites
* openssl: make use of -CBC and -AESGCM keywords
* openssl: add TLS 1.3 Brainpool identifiers
* fix warning on using experimental key_exchanges
* update-crypto-policies: don't output FIPS warning in fips mode
* openssh: map mlkem768x25519-sha256 to KEM-ECDH & MLKEM768-X25519 & SHA2-256
* openssh, libssh: refactor kx maps to use tuples
* alg_lists: mark MLKEM768/SNTRUP kex experimental
* nss: revert enabling mlkem768secp256r1
* nss: add mlkem768x25519 and mlkem768secp256r1, remove xyber
* gnutls: add GROUP-X25519-MLKEM768 and GROUP-SECP256R1-MLKEM768
* openssl: use both names for SecP256r1MLKEM768 / X25519MLKEM768
* openssh, TEST-PQ: rename MLKEM key_exchange to MLKEM768
* openssh: add support for sntrup761x25519-sha512 and mlkem768x25519-sha256
* openssl: map NULL to TLS_SHA256_SHA256:TLS_SHA384_SHA384...
* python/update-crypto-policies: pacify pylint
* fips-mode-setup: tolerate fips dracut module presence w/o FIPS
* fips-mode-setup: small Argon2 detection fix
* SHA1: add __openssl_block_sha1_signatures = 0
* fips-mode-setup: block if LUKS devices using Argon2 are detected
* update-crypto-policies: skip warning on --set=FIPS if bootc
* fips-setup-helper: skip warning, BTW
* fips-mode-setup: force --no-bootcfg when UKI is detected
* fips-setup-helper: add a libexec helper for anaconda
* fips-crypto-policy-overlay: automount FIPS policy
* openssh: make dss no longer enableble, support is dropped
* gnutls: wire GROUP-X25519-KYBER768 to X25519-KYBER768
* DEFAULT: switch to rh-allow-sha1-signatures = no...
* java: drop unused javasystem backend
* java: stop specifying jdk.tls.namedGroups in javasystem
* ec_min_size: introduce and use in java, default to 256
* java: use and include jdk.disabled.namedCurves
* BSI: Update BSI policy for new 2024 minimum recommendations
* fips-mode-setup: flashy ticking warning upon use
* fips-mode-setup: add another scary 'unsupported'
* CONTRIBUTING.md: add a small section on updating policies
* CONTRIBUTING.md: remove trailing punctuation from headers
* BSI: switch to 3072 minimum RSA key size
* java: make hash, mac and sign more orthogonal
* java: specify jdk.tls.namedGroups system property
* java: respect more key size restrictions
* java: disable anon ciphersuites, tying them to NULL...
* java: start controlling / disable DTLSv1.0
* nss: wire KYBER768 to XYBER768D00
* nss: unconditionally load p11-kit-proxy.so
* gnutls: make DTLS0.9 controllable again
* gnutls: retire GNUTLS_NO_TLS_SESSION_HASH
* openssh: remove OPENSSH_MIN_RSA_SIZE / OPENSSH_MIN_RSA_SIZE_FORCE
* gnutls: remove extraneous newline
* sequoia: move away from subprocess.getstatusoutput
* python/cryptopolicies/cryptopolicies.py: add trailing commas
* python, tests: rename MalformedLine to MalformedLineError
* Makefile: introduce SKIP_LINTING flag for packagers to use
* Makefile: run ruff
* tests: use pathlib
* tests: run(check=True) + CalledProcessError where convenient
* tests: use subprocess.run
* tests/krb5.py: check all generated policies
* tests: print to stderr on error paths
* tests/nss.py: also use encoding='utf-8'
* tests/nss.py: also use removesuffix
* tests/nss.py: skip creating tempfiles
* tests/java.pl -> tests/java.py
* tests/gnutls.pl -> tests/gnutls.py
* tests/openssl.pl -> tests/openssl.py
* tests/verify-output.pl: remove
* libreswan: do not use up pfs= / ikev2= keywords for default behaviour
- Update to version 20241010.5930b9a:
* LEGACY: enable 192-bit ciphers for nss pkcs12/smime
* nss: be stricter with new purposes
* nss: rewrite backend for 3.101
* cryptopolicies: parent scopes for dumping purposes
* policygenerators: move scoping inside generators
* TEST-PQ: disable pure Kyber768
* nss: wire XYBER768D00 to X25519-KYBER768
* TEST-PQ: update
* TEST-PQ: also enable sntrup761x25519-sha512 at openssh.com
* TEST-PQ, alg_lists, openssl: enable more experimental `sign` values
* TEST-PQ, python: add more groups, mark experimental
* openssl: mark liboqsprovider groups optional with ?
- Update to version 20240201.9f501f3:
* .gitlab-ci.yml: install sequoia-policy-config
* java: disable ChaCha20-Poly1305 where applicable
* fips-mode-setup: make sure ostree is detected in chroot
* fips-finish-install: make sure ostree is detected in chroot
* TEST-PQ: enable X25519-KYBER768 / P384-KYBER768 for openssl
* TEST-PQ: add a no-op subpolicy
* update-crypto-policies: Keep mid-sentence upper case
* fips-mode-setup: Write error messages to stderr
* fips-mode-setup: Fix some shellcheck warnings
* fips-mode-setup: Fix test for empty /boot
* fips-mode-setup: Avoid 'boot=UUID=' if /boot == /
* Update man pages
- Update to version 20231108.adb5572b:
* Print matches in syntax deprecation warnings
* Restore support for scoped ssh_etm directives
* fips-mode-setup: Fix usage with --no-bootcfg
* turn ssh_etm into an etm at SSH tri-state
* fips-mode-setup: increase chroot-friendliness
* bind: fix a typo that led to duplication of ECDSAPxxxSHAxxx
* pylintrc: use-implicit-booleaness-not-comparison-to-*
- avoid the cycle rpm/cmake/crypto-policies/python-rpm-macros:
we only need python3-base here, we don't need the python
macros as no module is being built
- Remove dependency on /usr/bin/python3, making scripts to depends on
the real python3 binary, not the link. bsc#1212476
-----------------------------------------------------------------
Advisory ID: SUSE-RU-2026:4124-1
Released: Thu Sep 10 18:11:41 2026
Summary: Recommended update for glibc
Type: recommended
Severity: moderate
References: 1277247
This update for glibc fixes the following issues:
- Add -flive-patching=inline-clone to avoid untraceable inter-procedural
optimizations (bsc#1277247).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4241-1
Released: Thu Sep 17 13:48:51 2026
Summary: Security update for pcre2
Type: security
Severity: important
References: 1277707,1277708,1277709,1277710,1277711,1277713,1279893,1280050,1280051,1280052,1280053,1280054,CVE-2026-86145,CVE-2026-89156,CVE-2026-89157,CVE-2026-89158,CVE-2026-89160,CVE-2026-89161
This update for pcre2 fixes the following issues:
- CVE-2026-86145: missing size checks in `pcre2_dfa_match` code can lead to an out-of-bounds write (bsc#1279893).
- CVE-2026-89156: out-of-bounds read via invalid UTF data during JIT fallback (bsc#1280054).
- CVE-2026-89157: out-of-bounds write via large pattern input (bsc#1280053).
- CVE-2026-89158: out-of-bounds write due to integer overflow in `pcre2_compile_32` for 32-bit platforms (bsc#1280052).
- CVE-2026-89160: out-of-bounds read during the `PCRE2_MATCH_INVALID_UTF` matching of an invalid UTF subject
(bsc#1280051).
- CVE-2026-89161: incorrect free operation due to mishandling of a previously copied subject in `pcre2_jit_match`
(bsc#1280050).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4250-1
Released: Thu Sep 17 18:00:36 2026
Summary: Security update for glibc
Type: security
Severity: moderate
References: 1267610,1274723,1274726,1276892,1276946,1277262,1277921,1277922,CVE-2026-18374,CVE-2026-19499,CVE-2026-19542,CVE-2026-6368,CVE-2026-6791,CVE-2026-77117,CVE-2026-80489
This update for glibc fixes the following issues:
- CVE-2026-6368: invalid free via wordexp WRDE_APPEND rollback (bsc#1274726).
- CVE-2026-6791: stack overflow in wordexp tilde expansion (bsc#1274723).
- CVE-2026-18374: heap buffer overflow in the fopen ccs extension (bsc#1277262).
- CVE-2026-19499: buffer overflow in strfmon right-justification padding (bsc#1276892).
- CVE-2026-19542: out-of-bounds array write in tdelete (bsc#1276946).
- CVE-2026-77117: SHIFT_JISX0213 decoding lacks pending character reset (bsc#1277921).
- CVE-2026-80489: EUC_JISX0213 decoding lacks pending character reset (bsc#1277922).
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4368-1
Released: Mon Sep 28 17:05:01 2026
Summary: Security update for libsodium
Type: security
Severity: moderate
References: 1255764,1256070,CVE-2025-15444,CVE-2025-69277
This update for libsodium fixes the following issues:
Update to 1.0.22 (jsc#PED-16890):
* Post-quantum key encapsulation is now available. ML-KEM768, the
NIST-standardized lattice-based KEM, is accessible through the
crypto_kem_mlkem768_*() functions.
* X-Wing, a hybrid KEM combining ML-KEM768 with X25519 for protection
against both classical and quantum adversaries, is available through the
crypto_kem_*() functions. X-Wing is the recommended KEM for most
applications.
* SHA-3 hash functions are now available as crypto_hash_sha3256_*()
and crypto_hash_sha3512_*(), with both one-shot and streaming APIs.
* Performance: NEON optimizations for Argon2 on ARM platforms.
* Performance: SHA3 (Keccak1600) now leverages ARM SHA3 instructions when
available on ARM platforms.
* Performance: WebAssembly SIMD implementations of Argon2 have been added.
* XOF state alignment has been relaxed.
* crypto_core_keccak1600_state has been added.
* Export missing crypto_ipcrypt_nd_keygen() helper function.
* crypto_auth_hmacsha256_init and crypto_auth_hmacsha512_init now
accept NULL key pointers (with a zero key length), for consistency with
other _init functions.
* Fixed compilation with GCC on aarch64 and gcc 4.x.
* On aarch64, aes256-gcm is now enabled even when not using clang,
including MSVC.
* Libsodium can be directly used as a dependency in a Zig project.
Update to 1.0.21 (bsc#1256070, CVE-2025-15444, bsc#1255764, CVE-2025-69277):
* The new crypto_ipcrypt_* functions implement mechanisms for securely
encrypting and anonymizing IP addresses.
* The sodium_bin2ip and sodium_ip2bin helper functions have been added to
complement the crypto_ipcrypt_* functions and easily convert addresses
between bytes and strings.
* XOF: the crypto_xof_shake* and crypto_xof_turboshake* functions are
* standard
extendable output functions. From input of any length, they can derive
output of any length with the same properties as hash functions. These
primitives are required by many post-quantum mechanisms, but can also be
used for a wide range of applications, including key derivation, session
encryption and more.
* Performance of AES256-GCM and AEGIS on ARM has been improved with some
compilers
* Security: optblockers have been introduced in critical code paths to prevent
compilers from introducing unwanted side channels via conditional jumps. This
was observed on RISC-V targets with specific compilers and options.
* Security: crypto_core_ed25519_is_valid_point() now properly rejects
small-order points that are not in the main subgroup
* ((nonnull)) attributes have been relaxed on some crypto_stream* functions to
allow NULL output buffers when the output length is zero
* A cross-compilation issue with old clang versions has been fixed
* crypto_aead_aes256gcm_is_available is exported to JavaScript
* Security: memory fences have been added after MAC verification in AEAD to
prevent speculative access to plaintext before authentication is complete
* Assembly files now include .gnu.property notes for proper IBT and Shadow
Stack support when building with CET instrumentation.
Update to 1.0.20:
* build system updates and portability fixes
Includes changes from 1.0.19:
* New AEADs: AEGIS-128L and AEGIS-256
* The HKDF key derivation mechanism, required by many standard
protocols
- A test designed to trigger an OOM condition didn't work on
Linux systems with memory overcommit turned on. It has been
- Emscripten: UTF8ToString() is now exported since
- New target: WebAssembly/WASI
- New functions to map a hash to an edwards25519 point
or get a random point:
- crypto_core_ed25519_scalar_mul() has been implemented for
- Support for the Ristretto group has been implemented for
- Bug fix: sodium_pad() didn't properly support block sizes
- JS/WebAssembly: some old iOS versions can't instantiate the
crypto_pwhash_scryptsalsa208sha256_str_needs_rehash()didn't
returnEINVAL` on input strings with a short length, unlike
- Added a workaround for Visual Studio 2010 bug causing CPU
- New low-level APIs for arithmetic mod the order of the prime
- crypto_core_ed25519_scalar_random(),
- crypto_core_ed25519_scalar_invert(),
- crypto_core_ed25519_scalar_complement(),
crypto_core_ed25519_scalar_add() and
crypto_scalarmult_ed25519_base_noclamp() and
crypto_scalarmult_ed25519_noclamp().
* AVX2 detection is more reliable.
Intel platforms. crypto_generichash() is now faster than MD5 and
* In addition to sodium_bin2hex(), sodium_hex2bin() is now a
* crypto_generichash_statebytes(), crypto_auth_*_statebytes()
and crypto_hash_*_statebytes() have been added in order to
retrieve the size of structures keeping states from foreign
* The JavaScript target doesn't require /dev/urandom or an
external randombytes() implementation any more. Other minor
Emscripten-related improvements have been made in order to
* Custom randombytes implementations do not need to provide
their own implementation of randombytes_uniform() any more.
randombytes_stir() and randombytes_close() can also be NULL
* On Linux, getrandom(2) is being used instead of directly
accessing /dev/urandom, if the kernel supports this system
Also libsodium users were rebuilt: zeromq, dnsdist, unbound, php7, and usbguard.
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4414-1
Released: Fri Oct 2 09:37:26 2026
Summary: Security update for openssl-3
Type: security
Severity: important
References: 1280587,1280589,1280590,1280591,1280592,1280594,1280595,1280596,1280597,1280598,1280599,1281125,CVE-2026-35189,CVE-2026-35191,CVE-2026-54872,CVE-2026-54875,CVE-2026-72897,CVE-2026-75804,CVE-2026-75805,CVE-2026-75806,CVE-2026-77696,CVE-2026-84782,CVE-2026-84784
This update for openssl-3 fixes the following issues:
- CVE-2026-35189: Excessive Memory Allocation in Relative CRLDP Processing (bsc#1280589).
- CVE-2026-35191: QUIC Unvalidated Amplification Credit may be Over Accounted (bsc#1280590).
- CVE-2026-54872: Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves (bsc#1280591).
- CVE-2026-54875: Non-Constant-Time SM2 Scalar Multiplication on ARM64 and RISC-V (bsc#1280592).
- CVE-2026-72897: Out-of-Bounds Access After SSL_set_SSL_CTX() During a Handshake (bsc#1280594).
- CVE-2026-75804: QUIC Connection-Level Flow Control is Not Enforced for Streams (bsc#1280595).
- CVE-2026-75805: NULL Pointer Dereference in CMP Client Revocation Response Handling (bsc#1280596).
- CVE-2026-75806: Unauthenticated and Undersized DTLS 1.2 AEAD Record Causes DoS (bsc#1280597).
- CVE-2026-77696: Timing Side-Channel in SM2 Signature Generation (bsc#1280598).
- CVE-2026-84782: DTLS Retransmits Handshake Messages From a Stale Buffer Offset (bsc#1280587).
- CVE-2026-84784: QUIC: Unbounded RETIRE_CONNECTION_ID Backlog (bsc#1280599).
Other non-security fixes:
- Add a conflicts with previous crypto-policies versions (bsc#1281125)
-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4571-1
Released: Thu Oct 8 10:02:12 2026
Summary: Maintenance update for Multi-Linux Manager 5.2: Server, Proxy and Retail Branch Server
Type: security
Severity: important
References: 1208800,1230568,1230949,1252286,1257151,1258382,1258500,1258567,1259225,1260342,1262157,1263822,1265219,1265472,1266481,1267261,1267871,1267912,1268228,1268325,1268473,1268587,1268673,1268755,1269192,1269253,1269316,1269534,1269679,1270033,1270039,1270040,1270047,1270141,1270694,1271075,1271116,1271124,1271329,1271332,1271382,1271467,1271523,1271678,1271681,1271841,1271902,1271963,1272298,1272392,1272404,1272538,1272621,1272988,1273073,1273131,1273144,1273846,1273853,1274023,1274227,1274613,1274720,1274775,CVE-2026-39821,CVE-2026-63007,CVE-2026-63009,CVE-2026-71400
Maintenance update for Multi-Linux Manager 5.2: Server, Proxy and Retail Branch Server
This is a codestream only update
The following package changes have been done:
- crypto-policies-20250714.cd6043a-150700.6.4.2 updated
- libtirpc-netconfig-1.3.4-150300.3.26.1 updated
- glibc-2.38-150600.14.58.1 updated
- libpcre2-8-0-10.42-150600.3.3.1 updated
- libgcc_s1-15.3.0+git11272-150000.1.12.1 updated
- libbz2-1-1.0.8-150400.3.4.1 updated
- libstdc++6-15.3.0+git11272-150000.1.12.1 updated
- libopenssl3-3.5.0-150700.5.53.2 updated
- libopenssl-3-fips-provider-3.5.0-150700.5.53.2 updated
- krb5-1.20.1-150600.11.19.1 updated
- libtirpc3-1.3.4-150300.3.26.1 updated
- libopenssl1_1-1.1.1w-150700.11.30.1 updated
- libsodium26-1.0.22-150000.4.17.1 added
- libyaml-0-2-0.1.7-150000.3.4.1 added
- libzmq5-4.2.3-150000.3.17.1 updated
- spacewalk-proxy-salt-5.2.6-150750.3.3.5 updated
- container:bci-bci-base-15.7-639cc27d64fa2f2a457d7b6d4dbdd89247dbfd872ad438f5a1799fb085c6c720-0 updated
- boost-license1_66_0-1.66.0-150200.12.7.1 removed
- ca-certificates-2+git20240416.98ae794-150300.4.3.3 removed
- ca-certificates-mozilla-2.84-150200.44.1 removed
- coreutils-8.32-150400.9.12.1 removed
- cracklib-2.9.11-150600.1.90 removed
- cracklib-dict-small-2.9.11-150600.1.90 removed
- dbus-1-1.12.2-150400.18.8.1 removed
- diffutils-3.6-4.3.1 removed
- file-5.32-7.14.1 removed
- file-magic-5.32-7.14.1 removed
- fillup-1.42-2.18 removed
- findutils-4.10.0-150700.2.6 removed
- gpg2-2.4.4-150600.3.15.1 removed
- grep-3.11-150700.1.8 removed
- info-6.5-4.17 removed
- iproute2-6.4-150600.7.15.1 removed
- iputils-20221126-150500.3.14.1 removed
- libacl1-2.2.52-4.3.1 removed
- libassuan0-2.5.5-150000.4.7.1 removed
- libattr1-2.4.47-2.19 removed
- libaudit1-3.0.6-150400.4.16.1 removed
- libboost_system1_66_0-1.66.0-150200.12.7.1 removed
- libboost_thread1_66_0-1.66.0-150200.12.7.1 removed
- libbpf1-1.5.0-150700.1.3 removed
- libbrotlicommon1-1.0.7-150200.3.5.1 removed
- libbrotlidec1-1.0.7-150200.3.5.1 removed
- libcap-ng0-0.7.9-4.37 removed
- libcap2-2.63-150400.3.6.1 removed
- libcrack2-2.9.11-150600.1.90 removed
- libcurl4-8.14.1-150700.7.17.1 removed
- libdbus-1-3-1.12.2-150400.18.8.1 removed
- libdw1-0.185-150400.5.8.3 removed
- libeconf0-0.5.2-150400.3.6.1 removed
- libelf1-0.185-150400.5.8.3 removed
- libgcrypt20-1.11.0-150700.5.7.1 removed
- libglib-2_0-0-2.78.6-150600.4.35.1 removed
- libgmp10-6.1.2-4.9.1 removed
- libgpg-error0-1.50-150700.1.8 removed
- libgpgme11-1.23.0-150600.3.5.1 removed
- libidn2-0-2.2.0-3.6.1 removed
- libksba8-1.6.4-150600.1.2 removed
- libldap-2_4-2-2.4.46-150600.25.3.1 removed
- libldap-data-2.4.46-150600.25.3.1 removed
- liblua5_3-5-5.3.6-3.6.1 removed
- liblz4-1-1.9.4-150600.1.4 removed
- libmagic1-5.32-7.14.1 removed
- libmnl0-1.0.4-1.25 removed
- libnghttp2-14-1.64.0-150700.3.3.1 removed
- libnpth0-1.5-2.11 removed
- libp11-kit0-0.23.22-150500.8.3.1 removed
- libpopt0-1.16-3.22 removed
- libprocps8-3.3.17-150000.7.42.1 removed
- libpsl5-0.20.1-150000.3.3.1 removed
- libpython3_11-1_0-3.11.15-150600.3.56.1 removed
- libsasl2-3-2.1.28-150600.7.14.1 removed
- libsemanage-conf-3.5-150600.1.48 removed
- libsemanage2-3.5-150600.1.48 removed
- libsepol2-3.5-150600.1.49 removed
- libsigc-2_0-0-2.12.1-150600.1.2 removed
- libsodium23-1.0.18-150000.4.14.1 removed
- libsolv-tools-base-0.7.39-150700.11.10.1 removed
- libssh-config-0.9.8-150600.11.12.1 removed
- libssh4-0.9.8-150600.11.12.1 removed
- libsubid5-4.17.2-150600.17.18.1 removed
- libsystemd0-254.27-150600.4.62.1 removed
- libtasn1-4.13-150000.4.14.1 removed
- libtasn1-6-4.13-150000.4.14.1 removed
- libudev1-254.27-150600.4.62.1 removed
- libunistring2-0.9.10-1.1 removed
- libusb-1_0-0-1.0.24-150400.3.3.1 removed
- libuuid1-2.40.4-150700.4.13.1 removed
- libxml2-2-2.12.10-150700.4.11.1 removed
- libxtables12-1.8.7-1.1 removed
- libyaml-cpp0_6-0.6.3-150400.4.3.1 removed
- libzck1-1.5.1-150700.1.2 removed
- libzio1-1.06-2.20 removed
- libzstd1-1.5.7-150700.1.2 removed
- login_defs-4.17.2-150600.17.18.1 removed
- logrotate-3.18.1-150400.3.10.1 removed
- openssl-3.2.3-150700.1.1 removed
- openssl-3-3.2.3-150700.5.36.1 removed
- p11-kit-0.23.22-150500.8.3.1 removed
- p11-kit-tools-0.23.22-150500.8.3.1 removed
- pam-1.3.0-150000.6.86.1 removed
- perl-base-5.26.1-150300.17.20.1 removed
- permissions-20240826-150700.14.4 removed
- pinentry-1.1.0-4.3.1 removed
- procps-3.3.17-150000.7.42.1 removed
- python311-3.11.15-150600.3.56.1 removed
- python311-Jinja2-3.1.2-150400.12.14.1 removed
- python311-M2Crypto-0.44.0-150400.3.12.1 removed
- python311-MarkupSafe-2.1.3-150400.11.5.2 removed
- python311-PyYAML-6.0.2-150600.10.3.1 removed
- python311-apipkg-3.0.1-150400.12.6.1 removed
- python311-base-3.11.15-150600.3.56.1 removed
- python311-certifi-2023.7.22-150400.12.6.2 removed
- python311-cffi-1.15.1-150400.8.7.2 removed
- python311-charset-normalizer-3.1.0-150400.9.7.2 removed
- python311-contextvars-2.4-150400.10.5.1 removed
- python311-cryptography-41.0.3-150600.23.6.1 removed
- python311-distro-1.9.0-150600.3.2.1 removed
- python311-idna-3.4-150400.11.10.1 removed
- python311-immutables-0.19-150400.10.5.1 removed
- python311-iniconfig-2.0.0-150400.10.6.1 removed
- python311-looseversion-1.3.0-150400.10.6.1 removed
- python311-msgpack-1.0.7-150600.3.2.1 removed
- python311-packaging-23.2-150600.1.1 removed
- python311-psutil-5.9.5-150400.6.11.1 removed
- python311-py-1.11.0-150400.12.7.2 removed
- python311-pyOpenSSL-23.2.0-150400.3.16.1 removed
- python311-pycparser-2.21-150400.12.7.2 removed
- python311-pyzmq-25.1.2-150400.12.6.1 removed
- python311-requests-2.31.0-150400.6.21.1 removed
- python311-rpm-4.14.3-150400.59.16.1 removed
- python311-salt-3006.0-150002.7.4 removed
- python311-tornado6-6.3.2-150400.9.15.1 removed
- python311-urllib3-2.0.7-150400.7.30.1 removed
- python311-zypp-plugin-0.6.5-150600.18.8.1 removed
- rpm-config-SUSE-1-150400.14.3.1 removed
- salt-3006.0-150002.7.4 removed
- saltbundle-libyaml-0.2.5-150002.1.2 removed
- shadow-4.17.2-150600.17.18.1 removed
- sudo-1.9.15p5-150600.3.15.1 removed
- update-alternatives-1.19.0.4-150000.4.7.1 removed
- xz-5.4.1-150600.3.6.1 removed
More information about the sle-container-updates
mailing list