SUSE-SU-2026:22328-1: important: Security update for google-cloud-sap-agent
SLE-SECURITY-UPDATES
null at suse.de
Wed Jul 1 16:40:27 UTC 2026
# Security update for google-cloud-sap-agent
Announcement ID: SUSE-SU-2026:22328-1
Release Date: 2026-06-22T14:30:38Z
Rating: important
References:
* bsc#1265764
* bsc#1265991
* bsc#1266604
Cross-References:
* CVE-2026-33186
* CVE-2026-33814
* CVE-2026-34986
* CVE-2026-39821
CVSS scores:
* CVE-2026-33186 ( SUSE ): 8.6
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
* CVE-2026-33186 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
* CVE-2026-33186 ( NVD ): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
* CVE-2026-33186 ( NVD ): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
* CVE-2026-33814 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-33814 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-33814 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-33814 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-34986 ( SUSE ): 8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
* CVE-2026-34986 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-34986 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-34986 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-39821 ( SUSE ): 9.1
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
* CVE-2026-39821 ( SUSE ): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
* CVE-2026-39821 ( NVD ): 9.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
* CVE-2026-39821 ( NVD ): 8.2 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
Affected Products:
* SUSE Linux Enterprise Server 16.0
* SUSE Linux Enterprise Server for SAP applications 16.0
An update that solves four vulnerabilities can now be installed.
## Description:
This update for google-cloud-sap-agent fixes the following issues
* CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport
when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265764).
* CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only
Punycode-encoded labels allows for validation bypass and privilege
escalation (bsc#1266604).
Changes for google-cloud-sap-agent:
* Update to version 3.15
* Remove LoggingClient error failure for hanadiskrestore and hanadiskbackup.
* Add checks for unexpected arguments in hanadiskbackup and hanadiskrestore.
* Update SAP Agent version to 3.15.
* Refactor grubBootLoaderX5 to check for BLS support via grub2-mkconfig help.
* Update all go dependencies
* Check grub2-mkconfig for BLS support on X4 instances.
* Add tenant SID collection to supportbundle.
* Update golang.org/x/net dependency. This is to address (#444)
* Fork tuned.conf to tuned-x5.conf for X5 series configurations
* Enable configureX5 in configureinstance.
* Create skeleton implementation and tests for X5 configureinstance support.
* Enable detection of x5 machine types in configureinstance
* Update to version 3.14 (bsc#1265991)
* Update Daemon Restart method to pass the correct cancel function to the new
handler.
* Remove redundant error logging in HANA disk restore.
* Fetch and rename Logical Volume during HANA disk restore.
* Add usage metrics for CMEK disk restore.
* Add multi-region and global KMS keys location checks.
* Convert HANA SID to uppercase in hanadiskbackup and hanadiskrestore.
* Log warning instead of erroring out on KMS key get failure.
* Initialize GCE client in status onetime command.
* Validate presence of KMS key in hanadiskrestore.
* Add SID parameter to HANA backup/restore path functions.
* Add KMS key location validation for HANA disk restore.
* Update agent version to 3.14.
* Fixes an issue if there is a whitespace around an argument passed in
* Add validation to prevent using both CSEK and KMS keys in hanadiskrestore.
* Handle disk recreation in HANA disk restore when IOPS, throughput, size, or
KMS key are specified.
* Refactor disk restore and configuration logic.
* Add support for CMEK encryption of restored disks.
* Remove obsolete TODOs.
* Update to version 3.13
* Replace strings.TrimSuffix with strings.TrimSpace in hanabackup.go
* Improve error messages in hanabackup.go.
* Add system state logging and logical device verification.
* Minor version bump
* Improve SAP instance comparison for process metrics collectors to prevent
unnecessary restarts of collectors.
* Delete supportbundlehandler package.
* Remove configurehandler from sapguestactions.
* Delete hanadiskbackuphandler from sapguestactions.
* Remove Guest Actions and GCBDR Actions from initial daemon start.
* Remove `gsutil` check from collection definition.
* Delete performancediagnosticshandler package.
* Remove unused handlers and shell command execution.
* status feature fixes - pass secret name
* Fix an issue in system discovery if discovering a network fails,
particularly due to an IAM permission error.
* Add verification for HANA data volume state after disk restore.
* Error handling for rescanVolumegroups and improved logging.
* Add link to What's New page in the sapagent README.
* Add secret manager IAM checks if secret key is preset in status
## Patch Instructions:
To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
* SUSE Linux Enterprise Server for SAP applications 16.0
zypper in -t patch SUSE-SLES-16.0-1022=1
* SUSE Linux Enterprise Server 16.0
zypper in -t patch SUSE-SLES-16.0-1022=1
## Package List:
* SUSE Linux Enterprise Server for SAP applications 16.0 (x86_64)
* google-cloud-sap-agent-3.15-160000.1.1
* google-cloud-sap-agent-debuginfo-3.15-160000.1.1
* SUSE Linux Enterprise Server 16.0 (aarch64 x86_64)
* google-cloud-sap-agent-3.15-160000.1.1
* google-cloud-sap-agent-debuginfo-3.15-160000.1.1
## References:
* https://www.suse.com/security/cve/CVE-2026-33186.html
* https://www.suse.com/security/cve/CVE-2026-33814.html
* https://www.suse.com/security/cve/CVE-2026-34986.html
* https://www.suse.com/security/cve/CVE-2026-39821.html
* https://bugzilla.suse.com/show_bug.cgi?id=1265764
* https://bugzilla.suse.com/show_bug.cgi?id=1265991
* https://bugzilla.suse.com/show_bug.cgi?id=1266604
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.suse.com/pipermail/sle-security-updates/attachments/20260701/40c47483/attachment.htm>
More information about the sle-security-updates
mailing list