SUSE-CU-2026:13344-1: Security update of private-registry/1.2/harbor-trivy-adapter

[sle-container-updates at lists.suse.com]

SUSE Container Update Advisory: private-registry/1.2/harbor-trivy-adapter
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2026:13344-1
Container Tags        : private-registry/1.2/harbor-trivy-adapter:1.2.2 , private-registry/1.2/harbor-trivy-adapter:1.2.2-1.146 , private-registry/1.2/harbor-trivy-adapter:latest
Container Release     : 1.146
Severity              : important
Type                  : security
References            : 1284829 1285541 1287329 CVE-2026-19585 CVE-2026-78669 CVE-2026-97032
-----------------------------------------------------------------

The container private-registry/1.2/harbor-trivy-adapter was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: SUSE-SU-2026:4925-1
Released:    Wed Oct 28 13:34:01 2026
Summary:     Security update for trivy
Type:        security
Severity:    important
References:  1284829,1285541,1287329,CVE-2026-19585,CVE-2026-78669,CVE-2026-97032
This update for trivy fixes the following issues:

- CVE-2026-19585: github.com/hashicorp/go-getter: path traversal during S3 and GCS directory downloads may allow files
  to be written outside the requested destination (bsc#1284829).
- CVE-2026-78669: golang.org/x/net/http2: excessive CPU consumption from repeated initial window changes (bsc#1285541).
- CVE-2026-97032: golang.org/x/net/http2: HTTP/2 server crash due to HPACK encoder race (bsc#1287329).

Changes for trivy:

- Updated to version 0.76.1.


The following package changes have been done:

- trivy-0.76.1-150000.1.39.1 updated
- container:suse-sle15-15.7-7df35f6ac67ddb16ac906885538442fa28f9bfbc35454db5bd43d13fd180b846-0 updated