<div class="container">
<h1>Security update for apache-ivy</h1>
<table class="table table-striped table-bordered">
<tbody>
<tr>
<th>Announcement ID:</th>
<td>SUSE-SU-2026:22858-1</td>
</tr>
<tr>
<th>Release Date:</th>
<td>2026-07-22T17:49:04Z</td>
</tr>
<tr>
<th>Rating:</th>
<td>moderate</td>
</tr>
<tr>
<th>References:</th>
<td>
<ul>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1271727">bsc#1271727</a>
</li>
</ul>
</td>
</tr>
<tr>
<th>
Cross-References:
</th>
<td>
<ul>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-26032.html">CVE-2026-26032</a>
</li>
</ul>
</td>
</tr>
<tr>
<th>CVSS scores:</th>
<td>
<ul class="list-group">
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-26032</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">5.9</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-26032</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">5.3</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-26032</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">5.4</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N</span>
</li>
</ul>
</td>
</tr>
<tr>
<th>Affected Products:</th>
<td>
<ul class="list-group">
<li class="list-group-item">SUSE Linux Enterprise Server 16.0</li>
<li class="list-group-item">SUSE Linux Enterprise Server for SAP applications 16.0</li>
</ul>
</td>
</tr>
</tbody>
</table>
<p>An update that solves one vulnerability can now be installed.</p>
<h2>Description:</h2>
<p>This update for apache-ivy fixes the following issue:</p>
<ul>
<li>CVE-2026-26032: directory traversal sequences in module coordinates can allow overwriting arbitrary files outside
the configured "buildRoot" directory (bsc#1271727).</li>
</ul>
<p>Changes for apache-ivy:</p>
<ul>
<li>
<p>Upgrade to 2.6.0:</p>
</li>
<li>
<p>the ivy:retrieve task failed when the retrieve pattern
contained some text in parentheses before the first token, for
instance: /jobs/lib (JDK 17)/[artifact].[ext] (IVY-1660)</p>
</li>
<li>when the ivy:deliver task is configured to replace dynamic
revisions, it now replaces these revisions to the resolved
revision before any conflict resolution was done, which was
the original behavior before Ivy 2.3.0. This way, the
delivered ivy.xml can be used to have reproducible dependency
resolution, especially when multiple configurations are used.
It also fixes issues where the dynamic revisions were replaced
by versions from other configurations. (IVY-1485, IVY-1661)</li>
<li>the ivy:deliver task didn't replace dynamic revision from
inherited dependencies. (IVY-1410)</li>
<li>the ivy:install task didn't take the from resolver into
account when resolving Maven parent modules or
source/javadoc artifacts.</li>
<li>the ivy:checkdepsupdate task could suggest a lesser version as
update. (IVY-1665)</li>
<li>the ivy:makepom task no longer adds a dependency to the
dependencyManagement section. (IVY-1667)</li>
<li>the ivy:deliver task didn't include XML namespaces from a
parent ivy module when merging the descriptors. (IVY-1658)</li>
<li>the ivy:checkdepsupdate task no longer shows evicted versions.
(IVY-1662)</li>
<li>Improvements</li>
<li>use Apache Commons Compress for pack200 handling to avoid
issues on Java 14 and later. If pack200 is needed, make sure
to add Apache Commons Compress to your classpath. (IVY-1652)</li>
<li>ivy:retrieve and the 'post resolve tasks' now support the
override child element. (IVY-1664)</li>
<li>ivy:makepom will now add override elements of the ivy.xml to
the dependencyManagement section of the generated pom.
(IVY-1663)</li>
<li>ivy:deliver and ivy:publish now writes inherited dependencies
first to preserve resolve order (IVY-1656)</li>
<li>ModuleRevisionId.encodeToString now returns a deterministic
string that doesn't rely on a implmentation of HashMap</li>
<li>New feature</li>
<li>added a new nearest conflict manager, which handles conflicts
in the same way that Maven does. (IVY-813)</li>
</ul>
<h2>Patch Instructions:</h2>
<p>
To install this SUSE update use the SUSE recommended
installation methods like YaST online_update or "zypper patch".<br/>
Alternatively you can run the command listed for your product:
</p>
<ul class="list-group">
<li class="list-group-item">
SUSE Linux Enterprise Server 16.0
<br/>
<code>zypper in -t patch SUSE-SLES-16.0-1335=1</code>
</li>
<li class="list-group-item">
SUSE Linux Enterprise Server for SAP applications 16.0
<br/>
<code>zypper in -t patch SUSE-SLES-16.0-1335=1</code>
</li>
</ul>
<h2>Package List:</h2>
<ul>
<li>
SUSE Linux Enterprise Server 16.0 (noarch)
<ul>
<li>apache-ivy-2.6.0-160000.1.1</li>
<li>apache-ivy-javadoc-2.6.0-160000.1.1</li>
</ul>
</li>
<li>
SUSE Linux Enterprise Server for SAP applications 16.0 (noarch)
<ul>
<li>apache-ivy-2.6.0-160000.1.1</li>
<li>apache-ivy-javadoc-2.6.0-160000.1.1</li>
</ul>
</li>
</ul>
<h2>References:</h2>
<ul>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-26032.html">https://www.suse.com/security/cve/CVE-2026-26032.html</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1271727">https://bugzilla.suse.com/show_bug.cgi?id=1271727</a>
</li>
</ul>
</div>