SUSE-IU-2026:8053-1: Security update of suse/sl-micro/6.1/baremetal-os-container
sle-container-updates at lists.suse.com
sle-container-updates at lists.suse.com
Tue Oct 20 07:20:57 UTC 2026
SUSE Image Update Advisory: suse/sl-micro/6.1/baremetal-os-container
-----------------------------------------------------------------
Image Advisory ID : SUSE-IU-2026:8053-1
Image Tags : suse/sl-micro/6.1/baremetal-os-container:2.2.1 , suse/sl-micro/6.1/baremetal-os-container:2.2.1-7.187 , suse/sl-micro/6.1/baremetal-os-container:latest
Image Release : 7.187
Severity : important
Type : security
References : 1258099 1258609 1259919 1260317 1264013 1264353 1264354 1264356
1265209 1276223 1276226 1276227 1277111 1280459 1280587 1280589
1280591 1280596 1280597 1280598 1280914 1281297 1282326 1282449
1282509 1283147 1283826 1283969 CVE-2025-54518 CVE-2026-15310
CVE-2026-15806 CVE-2026-17084 CVE-2026-19445 CVE-2026-19553 CVE-2026-19672
CVE-2026-25934 CVE-2026-26958 CVE-2026-33186 CVE-2026-35189 CVE-2026-41142
CVE-2026-42216 CVE-2026-42217 CVE-2026-4427 CVE-2026-46300 CVE-2026-54872
CVE-2026-75805 CVE-2026-75806 CVE-2026-77696 CVE-2026-78807 CVE-2026-82049
CVE-2026-84782 CVE-2026-8674 CVE-2026-86805 CVE-2026-89092 CVE-2026-94640
CVE-2026-97399
-----------------------------------------------------------------
The container suse/sl-micro/6.1/baremetal-os-container was updated. The following patches have been included in this update:
-----------------------------------------------------------------
Advisory ID: 756
Released: Mon Oct 19 11:40:42 2026
Summary: Security update for openssl-3
Type: security
Severity: important
References: 1280587,1280589,1280591,1280596,1280597,1280598,CVE-2026-35189,CVE-2026-54872,CVE-2026-75805,CVE-2026-75806,CVE-2026-77696,CVE-2026-84782
This update for openssl-3 fixes the following issues:
- CVE-2026-35189: Excessive Memory Allocation in Relative CRLDP Processing (bsc#1280589).
- CVE-2026-54872: Timing Side-Channel in Scalar Multiplication for Non-NIST EC Curves (bsc#1280591).
- CVE-2026-75805: NULL Pointer Dereference in CMP Client Revocation Response Handling (bsc#1280596).
- CVE-2026-75806: Unauthenticated and Undersized DTLS 1.2 AEAD Record Causes DoS (bsc#1280597).
- CVE-2026-77696: Timing Side-Channel in SM2 Signature Generation (bsc#1280598).
- CVE-2026-84782: DTLS Retransmits Handshake Messages From a Stale Buffer Offset (bsc#1280587).
-----------------------------------------------------------------
Advisory ID: 753
Released: Mon Oct 19 11:46:17 2026
Summary: Security update for wpa_supplicant
Type: security
Severity: important
References: 1264013,1265209,1280914,CVE-2025-54518,CVE-2026-46300,CVE-2026-78807
This update for wpa_supplicant fixes the following issue:
- CVE-2026-78807: Security bypass via missing PMKSA validation (bsc#1280914).
-----------------------------------------------------------------
Advisory ID: 747
Released: Mon Oct 19 11:52:54 2026
Summary: Security update for rpcbind
Type: security
Severity: important
References: 1258099,1258609,1259919,1260317,1282326,CVE-2026-25934,CVE-2026-26958,CVE-2026-33186,CVE-2026-4427,CVE-2026-94640
This update for rpcbind fixes the following issue:
- CVE-2026-94640: unbounded memory allocation in statistics tracking allows for unauthenticated remote denial of service
(bsc#1282326).
-----------------------------------------------------------------
Advisory ID: 750
Released: Mon Oct 19 12:15:52 2026
Summary: Security update for python311
Type: security
Severity: important
References: 1264353,1264354,1264356,1276223,1276226,1276227,1277111,1280459,1283826,1283969,CVE-2026-15310,CVE-2026-15806,CVE-2026-17084,CVE-2026-19445,CVE-2026-19553,CVE-2026-19672,CVE-2026-41142,CVE-2026-42216,CVE-2026-42217,CVE-2026-82049
This update for python311 fixes the following issues:
- CVE-2026-15310: memory exhaustion in zipfile in bzip2/LZMA/Zstandard decompression (bsc#1277111).
- CVE-2026-15806: urllib.request.HTTPPasswordMgr credentials for one URL scheme sent over another scheme (bsc#1276223).
- CVE-2026-17084: StringPrep algorithm considered Unicode codepoint attributes outside Unicode 3.2.0 (bsc#1276226).
- CVE-2026-19445: reassigned SNI callbacks with unreferenced SSLContext instances can cause use-after-free
(bsc#1283969).
- CVE-2026-19553: omitted server_hostname arguments in wrap_bio() can cause silent hostname verification bypasses
(bsc#1283826).
- CVE-2026-19672: tarfile extraction filter bypass allows creation of directories outside the destination (bsc#1276227).
- CVE-2026-82049: tarfile extraction filters mishandle archives containing a hard link to a symbolic link, allowing file
modification and content disclosure (bsc#1280459).
Changes for python311:
- Update to 3.11.17:
- Security
- gh-158446: Fix a crash or incorrect output that could occur
when formatting a float or complex with a precision close
to the platform's INT_MAX. PyOS_double_to_string() now
raises ValueError for any precision of that magnitude,
regardless of presentation type or value, as the format
string parsers already did for precisions above INT_MAX.
- gh-157190: Fixed a vulnerability in the tarfile data and
tar extraction filters where a crafted archive using a hard
link to a symbolic link could change the permissions and
modification time of a file outside the destination
directory, and expose its contents inside the extracted
tree. This addresses CVE 2026-82049. (bsc#1280459,
CVE-2026-82049)
- gh-156793: asyncio: loop.start_tls() and
loop.create_connection() now validate the server_hostname
argument if an ssl.SSLContext is passed with check_hostname
set to True, emitting DeprecationWarning if server_hostname
is missing. (This will raise ValueError in Python 3.13 and
later.) (bsc#1283826, CVE-2026-19553)
- gh-156793: ssl.SSLContext.wrap_bio() now validates its
server_side, server_hostname and session arguments similar
to ssl.SSLContext.wrap_socket(), but for backward
compatiblity reasons emits DeprecationWarning instead of
ValueError.
In particular, a context with check_hostname enabled and no
server_hostname passed to wrap_bio() now emits
DeprecationWarning to indicate the hostname wasn't
checked. (In Python 3.13 and later, this raises
ValueError.)
- gh-157265: In tarfile, when extracting a link falls back to
extracting a member of the archive, skip the member when
the filter function returns None when called with the
extracted member's name replaced with the link's.
- gh-157953: Update bundled libexpat to version 2.8.5.
- gh-156002: Bound the amount of data zipfile decompresses
per read for members compressed with bzip2, LZMA, or
Zstandard, matching the existing limit for deflate. A small
archive member could previously expand into an unbounded
allocation even when read in small chunks. (bsc#1277111,
CVE-2026-15310)
- gh-155999: Fix the tarfile tar and data extraction filters
creating directories outside the destination for members
whose name leaves the destination and returns to it, such
as ../evil/../dest/sub/file. The containment check used the
resolved path, but intermediate directories were created
from the name as given. (bsc#1276227, CVE-2026-19672)
- gh-156293: Fix a crash in ssl when an sni_callback switches
a connection to another SSLContext and the context that
carries the callback is no longer referenced by the
application. Servers that keep their sni_callback context
alive (the usual case when it wraps the listening socket or
is stored on the server object) were not affected. This
addresses CVE-2026-19445. (bsc#1283969, CVE-2026-19445)
- gh-155292: Change the stringprep module and encodings.idna
codec to not consider Unicode codepoint attributes beyond
those defined in RFC 3454. (bsc#1276226, CVE-2026-17084)
- gh-155694: Fix CVE-2026-15806 by scoping HTTPPasswordMgr
credentials to the URL scheme, preventing credentials
stored for an HTTPS URL from being used for a matching HTTP
URL, while URIs without a scheme continue to match any
scheme. (bsc#1276223, CVE-2026-15806)
- Library
- gh-156002: zipfile again reads members through a
third-party decompressor installed by monkey-patching the
private _get_decompressor() to return an object that only
implements old BZ2Decompressor API from Python 3.3. Note
that decompressors without needs_input and two-argument
decompress() are vulnerable to CVE 2026-15310.
- gh-156353: Fix configparser parsing when using whitespace
in delimiters.
- Build
- gh-155757: Set the --argv0 argument to wasmtime for WASI
builds so the test suite passes. Otherwise the calculated
paths to the stdlib for frozen modules is incorrect.
- CVE-2026-15310: bound zipfile decompression for
bzip2/LZMA (bsc#1277111, gh#python/cpython#156002)
- CVE-2026-19672: in tarfile, handle a member that leaves the
destination and comes back (bsc#1276227, gh#python/cpython#156000)
-----------------------------------------------------------------
Advisory ID: 751
Released: Mon Oct 19 12:26:04 2026
Summary: Security update for glibc
Type: security
Severity: important
References: 1281297,1282449,1282509,1283147,CVE-2026-8674,CVE-2026-86805,CVE-2026-89092,CVE-2026-97399
This update for glibc fixes the following issues:
- CVE-2026-8674: reachable assert in `resolv/resolv_conf.c:update_from_conf` allows an attacker in a local network to
trigger a process crash (bsc#1281297).
- CVE-2026-86805: TOCTOU race condition in the dynamic loader allows local attackers to escalate privileges
(bsc#1282509).
- CVE-2026-89092: nscd stack overflow leads to degraded DNS resolution (bsc#1282449).
- CVE-2026-97399: one byte out-of-bounds read via function `strncasecmp` on Power8 can lead to a program crash
(bsc#1283147).
The following package changes have been done:
- glibc-2.38-slfo.1.1_11.1 updated
- libopenssl3-3.1.4-slfo.1.1_14.1 updated
- SL-Micro-release-6.1-slfo.1.12.80 updated
- wpa_supplicant-2.11-slfo.1.1_3.1 updated
- glibc-locale-base-2.38-slfo.1.1_11.1 updated
- python311-base-3.11.17-slfo.1.1_1.1 updated
- libpython3_11-1_0-3.11.17-slfo.1.1_1.1 updated
- python311-3.11.17-slfo.1.1_1.1 updated
- rpcbind-1.2.9-slfo.1.1_3.1 updated
- container:SL-Micro-base-container-2.2.1-5.201 updated
More information about the sle-container-updates
mailing list