SUSE-SU-2026:24645-1: important: Security update for elemental, elemental-register, elemental-system-agent, elemental-toolkit
SLE-SECURITY-UPDATES
null at suse.de
Wed Nov 11 13:01:11 UTC 2026
# Security update for elemental, elemental-register, elemental-system-agent,
elemental-toolkit
Announcement ID: SUSE-SU-2026:24645-1
Release Date: 2026-11-09T15:41:01Z
Rating: important
References:
* bsc#1265781
* bsc#1266622
* bsc#1266789
* bsc#1272088
* bsc#1277992
* bsc#1278164
* bsc#1279213
* bsc#1279312
* bsc#1279911
* bsc#1279912
* bsc#1279996
Cross-References:
* CVE-2026-19201
* CVE-2026-33814
* CVE-2026-37236
* CVE-2026-39821
* CVE-2026-56852
* CVE-2026-79775
* CVE-2026-83530
* CVE-2026-84303
* CVE-2026-84304
CVSS scores:
* CVE-2026-19201 ( SUSE ): 8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
* CVE-2026-19201 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-19201 ( NVD ): 6.6
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
* CVE-2026-19201 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-33814 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-33814 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-33814 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-33814 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-37236 ( SUSE ): 6.3
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
* CVE-2026-37236 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
* CVE-2026-37236 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-39821 ( SUSE ): 9.1
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
* CVE-2026-39821 ( SUSE ): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
* CVE-2026-39821 ( NVD ): 9.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
* CVE-2026-39821 ( NVD ): 8.2 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
* CVE-2026-56852 ( SUSE ): 6.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
* CVE-2026-56852 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-56852 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-79775 ( SUSE ): 7.1
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
* CVE-2026-79775 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-79775 ( NVD ): 7.1
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
* CVE-2026-79775 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-83530 ( SUSE ): 6.9
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
* CVE-2026-83530 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
* CVE-2026-83530 ( NVD ): 6.9
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
* CVE-2026-83530 ( NVD ): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
* CVE-2026-84303 ( SUSE ): 9.1
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
* CVE-2026-84303 ( SUSE ): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
* CVE-2026-84303 ( NVD ): 6.3
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
* CVE-2026-84304 ( SUSE ): 8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
* CVE-2026-84304 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-84304 ( NVD ): 8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Affected Products:
* SUSE Linux Micro 6.2
An update that solves nine vulnerabilities and has two fixes can now be
installed.
## Description:
This update for elemental, elemental-register, elemental-system-agent,
elemental-toolkit fixes the following issues:
* CVE-2026-19201: github.com/google/go-attestation/attest: unbounded recursion
in Windows ELAM parsing (bsc#1279911 bsc#1279912).
* CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport
when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265781).
* CVE-2026-37236: github.com/grpc-ecosystem/grpc-gateway/v2/runtime: client
can override the HTTP method of a POST request through the X-HTTP-Method-
Override header and bypass established access control (bsc#1277992).
* CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only
Punycode-encoded labels allows for validation bypass and privilege
escalation (bsc#1266622 bsc#1266789).
* CVE-2026-56852: golang.org/x/text/unicode/norm: infinite loop on
truncated/invalid UTF-8 input (bsc#1272088).
* CVE-2026-79775: github.com/diskfs/go-diskfs: malformed SquashFS image can
cause crashes and persistent CPU loops in rclone's archive backend
(bsc#1278164).
* CVE-2026-83530: github.com/google/cel-go/cel: no enforcement of expression
size limit before source construction can lead to excessive resource
consumption (bsc#1279996).
* CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation
issue allows for bypass of authorization policies via mixed-case or
canonical-case header matches (bsc#1279312).
* CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2
DATA frame fragmentation (bsc#1279213).
Changes for elemental-pool:
* Update to v2.3.2:
* 9e6df8e Update KVM flavor to include iptables
Changes for elemental-register-pool:
* Update to v1.9.3:
* ee57a686 Bump github.com/rancher-sandbox/go-tpm
* 2a6c4918 Fix sporadic failures in unit tests
* 717137bd bump yip library
* 9c08fcac User Rewrite function instead of a Director function in
ReverseProxy
* 3073bcc1 Bump rancher-sandbox/go-tpm
* 0746e6be Bump grpc library to v1.83.2. Includes fixes for:
* bsc#1279213 (CVE-2026-84304)
* 56c83652 Bump to golang 1.26
* f37b9d62 bump go-attestation. Includes fixes for:
* bsc#1279912 (CVE-2026-19201)
* bsc#1279911 (CVE-2026-19201)
* 48e0352f Bump test environment
* f78effcf Bump generators
* 6c7818a2 Bump wrangler to v3.6.1. Includes fixes for:
* bsc#1272088 (CVE-2026-56852)
* bsc#1279312 (CVE-2026-84303)
* bsc#1266789 (CVE-2026-39821)
* bsc#1266622 (CVE-2026-39821)
* 0eeb3eac Bump grpc-ecosystem/grpc-gateway/v2. Includes fixes for:
* bsc#1277992 (CVE-2026-37236)
* 0c104e17 fix(tpm): fix duplicate emulated TPM seeds on UUID suffix collision
(#1018)
* 3605ef3f Change tags order to facilitate OBS builds
* Changes on top of v1.9.2:
* 893fbf0f Fix reference in labels
* dfaf68ac Adapt labels to pass OBS container checks
Changes for elemental-system-agent-pool:
* Update to version 0.15.2:
* fix: swap kubectl download to cowboy-builder rpm
* Update module golang.org/x/crypto to v0.56.0 [SECURITY]
* Update module google.golang.org/grpc to v1.83.2 [SECURITY]
* Update module golang.org/x/mod to v0.40.0 [SECURITY]
* Update module github.com/google/cel-go to v0.30.0 [SECURITY]
* Update module go.etcd.io/etcd/client/pkg/v3 to v3.6.14 [SECURITY]
* Update module github.com/klauspost/compress to v1.18.7 [SECURITY] This
version includes fixes for:
* bsc#1279996 (CVE-2026-83530)
* bsc#1279312 (CVE-2026-84303)
* bsc#1279213 (CVE-2026-84304)
* Update to version 0.15.1:
* [2.15] Bump go toolchain to 1.26.7 (#426)
* Bump dependencies (#421)
* Update README (#404)
* add uninstall flag (#384)
* some cve fixes, notably x/net and kubectl versions (#359)
* Update actions/checkout action to v7
* Update actions/upload-artifact action to v7
* Update actions/setup-go action to v6.4.0
* Update rancher/renovate-config digest to fc79cf4
* Update registry.suse.com/bci/bci-micro Docker tag to v16
* switch renovate over to the newer configuration (#293)
* bump kubectl to 1.36.1 (#292)
* add release branches to renovate config (#289)
* Fix swapped kubectl checksums in SUC release image build (#286)
* Document versioning schema and branch strategy aligned with Rancher minor
releases (#280)
* bumping CAPI to v1.13.2 and wrangler unrc version
* bump k8s v1.36
* fix logs collection
* test: add new Plan State integration tests
* chore: bump rancher/rancher/pkg/plan to consume Plan States
* test: add e2e tests for Plan States lifecycle
* feat: Adapt code to use Plan States
* Add README.md for integration tests
* Improve comments in scripts and logging
* Adapt test framework code to use new pkg/plan library from rancher/rancher
* Add test/vendor to .gitignore
* Utilize new pkg/plan library from rancher/rancher
* bump the fallback version to v0.3.16
* add initial version of integration tests
* bsc#1277992 (CVE-2026-37236)
* bsc#1272088 (CVE-2026-56852)
* bsc#1265781 (CVE-2026-33814)
* bsc#1266622 (CVE-2026-39821)
Changes for elemental-toolkit-pool:
* Update to v2.3.5:
* 61bb7271 use rsync checksum to reliably copy data
* a5e33158 Only consider global Boot#### variables when clearing stale entries
* 74b76a97 Move to go1.26
* c591fd27 Bump yip library. Includes fixes for:
* bsc#1278164 (CVE-2026-79775)
* 3aa381e5 Fix logging messages
* 661d3ae2 Bump ginkgo
* 04624721 Bump containerd. Includes fixes for:
* bsc#1272088 (CVE-2026-56852)
## Patch Instructions:
To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
* SUSE Linux Micro 6.2
zypper in -t patch SUSE-SL-Micro-6.2-2071
## Package List:
* SUSE Linux Micro 6.2 (noarch)
* elemental-2.3.2-160000.1.1
* elemental-updater-2.3.2-160000.1.1
* SUSE Linux Micro 6.2 (aarch64 x86_64)
* elemental-support-1.9.3-160000.1.1
* elemental-system-agent-0.15.2-160000.1.1
* elemental-register-1.9.3-160000.1.1
* elemental-toolkit-2.3.5-160000.1.1
## References:
* https://www.suse.com/security/cve/CVE-2026-19201.html
* https://www.suse.com/security/cve/CVE-2026-33814.html
* https://www.suse.com/security/cve/CVE-2026-37236.html
* https://www.suse.com/security/cve/CVE-2026-39821.html
* https://www.suse.com/security/cve/CVE-2026-56852.html
* https://www.suse.com/security/cve/CVE-2026-79775.html
* https://www.suse.com/security/cve/CVE-2026-83530.html
* https://www.suse.com/security/cve/CVE-2026-84303.html
* https://www.suse.com/security/cve/CVE-2026-84304.html
* https://bugzilla.suse.com/show_bug.cgi?id=1265781
* https://bugzilla.suse.com/show_bug.cgi?id=1266622
* https://bugzilla.suse.com/show_bug.cgi?id=1266789
* https://bugzilla.suse.com/show_bug.cgi?id=1272088
* https://bugzilla.suse.com/show_bug.cgi?id=1277992
* https://bugzilla.suse.com/show_bug.cgi?id=1278164
* https://bugzilla.suse.com/show_bug.cgi?id=1279213
* https://bugzilla.suse.com/show_bug.cgi?id=1279312
* https://bugzilla.suse.com/show_bug.cgi?id=1279911
* https://bugzilla.suse.com/show_bug.cgi?id=1279912
* https://bugzilla.suse.com/show_bug.cgi?id=1279996
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.suse.com/pipermail/sle-security-updates/attachments/20261111/9512c88e/attachment.htm>
More information about the sle-security-updates
mailing list