SUSE-SU-2026:23233-1: important: Security update for himmelblau

Tue Aug 25 16:32:08 UTC 2026

# Security update for himmelblau

Announcement ID: SUSE-SU-2026:23233-1  
Release Date: 2026-08-12T08:19:59Z  
Rating: important  
References:

  * bsc#1270946
  * bsc#1270985
  * bsc#1273910
  * bsc#1273911
  * bsc#1273912

Cross-References:

  * CVE-2026-45784

CVSS scores:

  * CVE-2026-45784 ( SUSE ):  5.1
    CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
  * CVE-2026-45784 ( SUSE ):  6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
  * CVE-2026-45784 ( NVD ):  5.1
    CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  * CVE-2026-45784 ( NVD ):  7.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Affected Products:

  * SUSE Linux Enterprise Server 16.0
  * SUSE Linux Enterprise Server for SAP applications 16.0

An update that solves one vulnerability and has four fixes can now be installed.

## Description:

This update for himmelblau fixes the following issues:

Update to version 2.3.14+git0.e23b4c54.

Security issues fixed:

  * CVE-2026-45784: incorrect sizing of output buffers in
    `CipherCtxRef::cipher_update_inplace` when used with AES key-wrap-with-
    padding ciphers can lead to attacker-controlled heap corruption
    (bsc#1270985).
  * Arbitrary HTTP or HTTPS URLs classified as Office documents based on an
    attacker-controlled file query parameters are forwarded to Electron
    applications and allow for code execution through Electron (bsc#1273910).
  * Directory-provided RFC2307 user identifiers accepted without exclusion of
    systemd's dynamic-user range allows for daemon impersonation and command
    execution through the task helper (bsc#1273911).
  * Daemon acts on Hello PIN enrollment requests whose identity claims it never
    cryptographically verifies and allows for local authentication bypass
    (bsc#1273912).

Other updates and bugfixes:

  * Version 2.3.14+git0.e23b4c54:
  * fix(`nss`): avoid locked shadow entries
  * fix(`deps`): update libhimmelblau lockfile
  * fix(`pam`): make account denials terminal
  * `debian`: make the `pam_allow_groups` denial terminal in the account phase
  * Version 2.3.13:
  * Update `cargo vet` audits for backport
  * Fix `cargo-fuzz` install in fuzz CI
  * `cargo vet`
  * Update `ldap3_proto` to 0.7.1
  * Update `openssl`
  * Version 2.3.12:
  * Remove invalid `himmelblau.conf` example info
  * Fix SSHd configuration load order on Fedora/RHEL systems
  * `himmelblau-init-hsm-pin`: don't bind the `hsm-pin` to PCR7
  * `qr-greeter`: support GNOME Shell 50
  * Update `libhimmelblau` to latest version
  * deps(`rust`): bump `tonic` in the `all-cargo-updates` group across 1
    directory
  * `cargo audit`

## Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".  
Alternatively you can run the command listed for your product:

  * SUSE Linux Enterprise Server 16.0  
    zypper in -t patch SUSE-SLES-16.0-1455=1

  * SUSE Linux Enterprise Server for SAP applications 16.0  
    zypper in -t patch SUSE-SLES-16.0-1455=1

## Package List:

  * SUSE Linux Enterprise Server for SAP applications 16.0 (noarch)
    * himmelblau-qr-greeter-2.3.14+git0.e23b4c54-160000.1.1
    * himmelblau-sshd-config-2.3.14+git0.e23b4c54-160000.1.1
  * SUSE Linux Enterprise Server for SAP applications 16.0 (x86_64)
    * libnss_himmelblau2-2.3.14+git0.e23b4c54-160000.1.1
    * himmelblau-sso-debuginfo-2.3.14+git0.e23b4c54-160000.1.1
    * himmelblau-sso-2.3.14+git0.e23b4c54-160000.1.1
    * himmelblau-2.3.14+git0.e23b4c54-160000.1.1
    * pam-himmelblau-2.3.14+git0.e23b4c54-160000.1.1
    * himmelblau-debuginfo-2.3.14+git0.e23b4c54-160000.1.1
  * SUSE Linux Enterprise Server 16.0 (aarch64 x86_64)
    * libnss_himmelblau2-2.3.14+git0.e23b4c54-160000.1.1
    * himmelblau-sso-debuginfo-2.3.14+git0.e23b4c54-160000.1.1
    * himmelblau-sso-2.3.14+git0.e23b4c54-160000.1.1
    * himmelblau-2.3.14+git0.e23b4c54-160000.1.1
    * pam-himmelblau-2.3.14+git0.e23b4c54-160000.1.1
    * himmelblau-debuginfo-2.3.14+git0.e23b4c54-160000.1.1
  * SUSE Linux Enterprise Server 16.0 (noarch)
    * himmelblau-qr-greeter-2.3.14+git0.e23b4c54-160000.1.1
    * himmelblau-sshd-config-2.3.14+git0.e23b4c54-160000.1.1

## References:

  * https://www.suse.com/security/cve/CVE-2026-45784.html
  * https://bugzilla.suse.com/show_bug.cgi?id=1270946
  * https://bugzilla.suse.com/show_bug.cgi?id=1270985
  * https://bugzilla.suse.com/show_bug.cgi?id=1273910
  * https://bugzilla.suse.com/show_bug.cgi?id=1273911
  * https://bugzilla.suse.com/show_bug.cgi?id=1273912

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.suse.com/pipermail/sle-security-updates/attachments/20260825/ea5b1bdc/attachment-0001.htm>