SUSE-CU-2026:12788-1: Security update of suse/hpc/warewulf4-x86_64/sle-hpc-node

[sle-container-updates at lists.suse.com]

SUSE Container Update Advisory: suse/hpc/warewulf4-x86_64/sle-hpc-node
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2026:12788-1
Container Tags        : suse/hpc/warewulf4-x86_64/sle-hpc-node:15.7 , suse/hpc/warewulf4-x86_64/sle-hpc-node:15.7.20.8.194 , suse/hpc/warewulf4-x86_64/sle-hpc-node:latest
Container Release     : 20.8.194
Severity              : important
Type                  : security
References            : 1259462 1259515 1275074 1275075 1275079 1283183 1284687 1286261
                        1287180 CVE-2026-107161 CVE-2026-114406 CVE-2026-46675 CVE-2026-73281
                        CVE-2026-73282 CVE-2026-73283 
-----------------------------------------------------------------

The container suse/hpc/warewulf4-x86_64/sle-hpc-node was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: SUSE-RU-2026:4792-1
Released:    Wed Oct 21 09:08:51 2026
Summary:     Recommended update for crypto-policies
Type:        recommended
Severity:    moderate
References:  1259515
This update for crypto-policies fixes the following issues:

- Disable umac-128* in DEFAULT, FUTURE and BSI openssh policies (bsc#1259515)

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4796-1
Released:    Wed Oct 21 09:53:08 2026
Summary:     Security update for libpng16
Type:        security
Severity:    moderate
References:  1283183,CVE-2026-46675
This update for libpng16 fixes the following issue:

- CVE-2026-46675: Use-after-free of zlib input in `png_read_end` after incomplete zTXt, iTXt or iCCP decompression
  (bsc#1283183).

Changes for libpng16:

- version update to 1.6.59:
 * Fixed a regression introduced in version 1.6.47 that caused libpng to reject
   hIST chunks in their correct position, after PLTE.
 * Prevented a double free of `png_struct` members after an allocation failure.
 * Applied fixes and updates to the CMake build.
 * Adopted the REUSE Specification for licensing the CI files.

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4827-1
Released:    Wed Oct 21 13:57:12 2026
Summary:     Security update for openssh
Type:        security
Severity:    moderate
References:  1259462,1275074,1275075,1275079,CVE-2026-73281,CVE-2026-73282,CVE-2026-73283
This update for openssh fixes the following issues:

- CVE-2026-73281: refused binding requests on locked SSH agents can allow destination restriction bypasses
  (bsc#1275075).
- CVE-2026-73282: unsynchronized remote forwarding updates in SSH client multiplexing can cause use-after-free
  (bsc#1275074).
- CVE-2026-73283: unenforced restriction keywords on tunnel forwarding can allow administrative security policy bypasses
  (bsc#1275079).

Changes for openssh:
- Included mentions of the configuration drop-in directories (bsc#1259462).

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4836-1
Released:    Wed Oct 21 14:52:06 2026
Summary:     Security update for cyrus-sasl
Type:        security
Severity:    important
References:  1284687,CVE-2026-107161
This update for cyrus-sasl fixes the following issue:

- CVE-2026-107161: Heap buffer overflow in cyrus-sasl add_to_challenge() allows malicious server to crash or compromise
  DIGEST-MD5 clients (bsc#1284687).

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4847-1
Released:    Fri Oct 23 15:10:44 2026
Summary:     Security update for ca-certificates-mozilla
Type:        security
Severity:    important
References:  1286261,1287180,CVE-2026-114406
This update for ca-certificates-mozilla fixes the following issue:
  
Updated to 2.92 state (bsc#1286261 CVE-2026-114406 bsc#1287180)
Removed:
  
 - emSign ECC Root CA - C3
 - emSign ECC Root CA - G3
 - emSign Root CA - C1


The following package changes have been done:

- ca-certificates-mozilla-2.92-150200.50.2 updated
- container-suseconnect-2.6.0-150700.4.99.1 updated
- crypto-policies-20250714.cd6043a-150700.6.7.1 updated
- libpng16-16-1.6.59-150600.3.26.1 updated
- libsasl2-3-2.1.28-150600.7.17.1 updated
- openssh-clients-9.6p1-150600.6.52.2 updated
- openssh-common-9.6p1-150600.6.52.2 updated
- openssh-server-9.6p1-150600.6.52.2 updated
- openssh-9.6p1-150600.6.52.2 updated