SUSE-IU-2026:8217-1: Security update of suse/sl-micro/6.1/baremetal-os-container

[sle-container-updates at lists.suse.com]

SUSE Image Update Advisory: suse/sl-micro/6.1/baremetal-os-container
-----------------------------------------------------------------
Image Advisory ID : SUSE-IU-2026:8217-1
Image Tags        : suse/sl-micro/6.1/baremetal-os-container:2.2.1 , suse/sl-micro/6.1/baremetal-os-container:2.2.1-7.192 , suse/sl-micro/6.1/baremetal-os-container:latest
Image Release     : 7.192
Severity          : important
Type              : security
References        : 1259462 1264459 1271044 1271046 1271048 1271049 1271052 1271053
                        1271054 1271055 1275074 1275075 1275079 CVE-2026-43284 CVE-2026-59995
                        CVE-2026-59996 CVE-2026-59997 CVE-2026-59998 CVE-2026-59999 CVE-2026-60000
                        CVE-2026-60001 CVE-2026-60002 CVE-2026-73281 CVE-2026-73282 CVE-2026-73283
-----------------------------------------------------------------

The container suse/sl-micro/6.1/baremetal-os-container was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: 766
Released:    Fri Oct 23 13:58:00 2026
Summary:     Security update for openssh
Type:        security
Severity:    important
References:  1259462,1264459,1271044,1271046,1271048,1271049,1271052,1271053,1271054,1271055,1275074,1275075,1275079,CVE-2026-43284,CVE-2026-59995,CVE-2026-59996,CVE-2026-59997,CVE-2026-59998,CVE-2026-59999,CVE-2026-60000,CVE-2026-60001,CVE-2026-60002,CVE-2026-73281,CVE-2026-73282,CVE-2026-73283
This update for openssh fixes the following issues:

- CVE-2026-59995: sftp: a malicious server could change the the location of downloaded files (bsc#1271044).
- CVE-2026-59996: scp: a malicious server could write files to the parent directory of the intended target directory
  (bsc#1271046).
- CVE-2026-59997: sshd: internal-sftp command lines are silently truncated after the 9th argument (bsc#1271048).
- CVE-2026-59998: sshd: Undocumented GSSAPIStrictAcceptorCheck behavior impacts security in Windows Active Directory
  (bsc#1271049).
- CVE-2026-59999: sshd: DisableForwarding=yes didn't override PermitTunnel=yes (bsc#1271052).
- CVE-2026-60000: sshd: pre-authentication denial of service when GSSAPIAuthentication is enabled (bsc#1271053).
- CVE-2026-60001: sshd: honor the minimum authentication delay (bsc#1271054).
- CVE-2026-60002: ssh: client-side use-after-free when a server changes its host key during a key reexchange
  (bsc#1271055).
- CVE-2026-73281: refused binding requests on locked SSH agents can allow destination restriction bypasses
  (bsc#1275075).
- CVE-2026-73282: unsynchronized remote forwarding updates in SSH client multiplexing can cause use-after-free
  (bsc#1275074).
- CVE-2026-73283: unenforced restriction keywords on tunnel forwarding can allow administrative security policy bypasses
  (bsc#1275079).


The following package changes have been done:

- openssh-common-9.6p1-slfo.1.1_7.1 updated
- openssh-server-9.6p1-slfo.1.1_7.1 updated
- openssh-clients-9.6p1-slfo.1.1_7.1 updated
- openssh-9.6p1-slfo.1.1_7.1 updated