SUSE-CU-2026:11006-1: Security update of bci/kiwi

[sle-container-updates at lists.suse.com]

SUSE Container Update Advisory: bci/kiwi
-----------------------------------------------------------------
Container Advisory ID : SUSE-CU-2026:11006-1
Container Tags        : bci/kiwi:10 , bci/kiwi:10.2 , bci/kiwi:10.2.33 , bci/kiwi:10.2.33-20.8
Container Release     : 20.8
Severity              : important
Type                  : security
References            : 1218459 1253139 1259215 1268747 1269150 1269571 1269584 CVE-2026-44604
                        CVE-2026-44605 
-----------------------------------------------------------------

The container bci/kiwi was updated. The following patches have been included in this update:

-----------------------------------------------------------------
Advisory ID: 1688
Released:    Wed Sep 16 16:28:22 2026
Summary:     Security update for rpm
Type:        security
Severity:    important
References:  1218459,1253139,1259215,1268747,1269150,1269571,1269584,CVE-2026-44604,CVE-2026-44605
This update for rpm fixes the following issues:

Changes in rpm:

- split imaevmsign plugin into a multibuild flavor

Changes in rpm:

- Add Requires: (rpm-plugin-selinux if selinux-policy)
- harden ndb code [bsc#1269584] [CVE-2026-44605]
- split all plugins into subpackages
  * this allows for an easy way to get rid of a plugin, it's also
    what other distributions do
- make the imaevmsign plugin build in a multibuild flavor
- rpm2archive: use size 0 for hardlinked files as bnew versions of
  gnu tar reject non-zero sizes [bsc#1269150]
- backport fix for add_sysuser macro [bsc#1269571]
- backport rpmuncompress security fix [bsc#1268747] [CVE-2026-44604]
- switch from rpmpgp_legacy to libpgpr
  * multiple bug fixes, support for v5 and v6 signatures
- turn on imaevm file signature support and move the imaevm code
  that needs the libimaevm library into a plugin. Put this
  plugin into a new 'rpm-imaevmsign' subpackage. [jsc#PED-7246]
- Fix 'unexpected EOF' when using rpmbuild to install ELF binaries
  due to syntax error in /usr/lib/rpm/brp-strip. (boo#1259215)
- Remove /var/lib/rpm migration scripting, retain an error if old
  location is found
- Use systemd-tmpfiles to create & maintain /var/lib/rpm symlink
  (boo#1253139)
- flush scriptlet notification messages in --runposttrans
  * needed to fix leaking tmp files [bsc#1218459]
  * added 'rpm_flushes_runposttrans' provides for libzypp


The following package changes have been done:

- rpm-4.20.1-160000.3.1 updated
- container:registry.suse.com-bci-bci-base-16.0-8186d3723a7484023a824b099e3aa11df82a9bac4538d2d6ab58fe8227ad0939-0 updated