SUSE-CU-2026:12487-1: Security update of private-registry/1.2/harbor-trivy-adapter

[sle-container-updates at lists.suse.com]

SUSE Container Update Advisory: private-registry/1.2/harbor-trivy-adapter
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2026:12487-1
Container Tags        : private-registry/1.2/harbor-trivy-adapter:1.2.2 , private-registry/1.2/harbor-trivy-adapter:1.2.2-1.136 , private-registry/1.2/harbor-trivy-adapter:latest
Container Release     : 1.136
Severity              : important
Type                  : security
References            : 1278624 1280111 1284829 1285541 CVE-2026-19585 CVE-2026-53495
                        CVE-2026-56854 CVE-2026-56855 CVE-2026-78662 CVE-2026-78669 
-----------------------------------------------------------------

The container private-registry/1.2/harbor-trivy-adapter was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4737-1
Released:    Mon Oct 19 14:57:15 2026
Summary:     Security update for trivy
Type:        security
Severity:    important
References:  1278624,1280111,1284829,1285541,CVE-2026-19585,CVE-2026-53495,CVE-2026-56854,CVE-2026-56855,CVE-2026-78662,CVE-2026-78669
This update for trivy fixes the following issues:

- CVE-2026-19585: github.com/hashicorp/go-getter: path traversal during S3 and GCS directory downloads may allow files
  to be written outside the requested destination (bsc#1284829).
- CVE-2026-53495: containerd: CRI ExecSync Goroutine Leak Leads to Node-Level Denial of Service (bsc#1280111).
- CVE-2026-56854: golang.org/x/crypto/ssh: source-address restriction bypassed in 5 callback families (bsc#1278624).
- CVE-2026-56855: golang.org/x/crypto/ssh: prevent DoS on deadlocked established channel (bsc#1278624).
- CVE-2026-78662: golang.org/x/crypto/ssh: prevent DoS on deadlocked undecided channel (bsc#1278624).
- CVE-2026-78669: golang.org/x/net/http2: excessive CPU consumption from repeated initial window changes (bsc#1285541).

Changes for trivy:

- Updated to version 0.76.0.


The following package changes have been done:

- trivy-0.76.0-150000.1.36.1 updated