<div class="container">
<h1>Security update for amazon-ssm-agent</h1>
<table class="table table-striped table-bordered">
<tbody>
<tr>
<th>Announcement ID:</th>
<td>SUSE-SU-2026:22157-1</td>
</tr>
<tr>
<th>Release Date:</th>
<td>2026-06-17T16:32:56Z</td>
</tr>
<tr>
<th>Rating:</th>
<td>important</td>
</tr>
<tr>
<th>References:</th>
<td>
<ul>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1238702">bsc#1238702</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1239342">bsc#1239342</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1253611">bsc#1253611</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1258095">bsc#1258095</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1264952">bsc#1264952</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1265474">bsc#1265474</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1266200">bsc#1266200</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1266781">bsc#1266781</a>
</li>
<li style="display: inline;">
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1267332">bsc#1267332</a>
</li>
<li style="display: inline;">
<a href="https://jira.suse.com/browse/PED-14843">jsc#PED-14843</a>
</li>
</ul>
</td>
</tr>
<tr>
<th>
Cross-References:
</th>
<td>
<ul>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2025-22869.html">CVE-2025-22869</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2025-22870.html">CVE-2025-22870</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2025-47913.html">CVE-2025-47913</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-1229.html">CVE-2026-1229</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-25934.html">CVE-2026-25934</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-39821.html">CVE-2026-39821</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-39827.html">CVE-2026-39827</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-39828.html">CVE-2026-39828</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-39829.html">CVE-2026-39829</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-39830.html">CVE-2026-39830</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-39831.html">CVE-2026-39831</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-39832.html">CVE-2026-39832</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-39833.html">CVE-2026-39833</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-39834.html">CVE-2026-39834</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-39835.html">CVE-2026-39835</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-41506.html">CVE-2026-41506</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-42508.html">CVE-2026-42508</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-44740.html">CVE-2026-44740</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-46595.html">CVE-2026-46595</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-46597.html">CVE-2026-46597</a>
</li>
<li style="display: inline;">
<a href="https://www.suse.com/security/cve/CVE-2026-46598.html">CVE-2026-46598</a>
</li>
</ul>
</td>
</tr>
<tr>
<th>CVSS scores:</th>
<td>
<ul class="list-group">
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-22869</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">8.2</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-22869</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-22869</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-22870</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">4.8</span>
<span class="cvss-vector">CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-22870</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">4.4</span>
<span class="cvss-vector">CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-22870</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">4.4</span>
<span class="cvss-vector">CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-47913</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">8.7</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-47913</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2025-47913</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-1229</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">8.3</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-1229</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">7.0</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-1229</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">2.9</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:X/V:X/RE:X/U:Amber</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-1229</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">9.8</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-25934</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">5.3</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-25934</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">4.3</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-25934</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">4.3</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-25934</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">4.3</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-39821</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">9.1</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-39821</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">7.4</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-39821</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">9.6</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-39827</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">7.1</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-39827</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">6.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-39827</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">6.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-39828</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">8.6</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-39828</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">8.1</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-39828</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">6.3</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-39829</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">8.7</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-39829</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-39829</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-39830</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">7.1</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-39830</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">6.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-39830</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">9.1</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-39831</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">8.6</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-39831</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">8.1</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-39831</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">9.1</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-39832</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">6.2</span>
<span class="cvss-vector">CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-39832</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">8.4</span>
<span class="cvss-vector">CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-39832</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">9.1</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-39833</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">8.5</span>
<span class="cvss-vector">CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-39833</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">7.7</span>
<span class="cvss-vector">CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-39833</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">9.1</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-39834</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">8.7</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-39834</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-39834</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">9.1</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-39835</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">8.7</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-39835</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-39835</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">5.3</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-41506</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">7.1</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-41506</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">6.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-41506</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">4.7</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-41506</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">7.4</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-42508</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">8.6</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-42508</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">8.1</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-42508</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">9.1</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-44740</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">8.7</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-44740</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-44740</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">6.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-46595</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">8.6</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-46595</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">8.1</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-46595</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">10.0</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-46597</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">8.7</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-46597</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-46597</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-46598</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">8.7</span>
<span class="cvss-vector">CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-46598</span>
<span class="cvss-source">
(
SUSE
):
</span>
<span class="cvss-score">7.5</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</span>
</li>
<li class="list-group-item">
<span class="cvss-reference">CVE-2026-46598</span>
<span class="cvss-source">
(
NVD
):
</span>
<span class="cvss-score">5.3</span>
<span class="cvss-vector">CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L</span>
</li>
</ul>
</td>
</tr>
<tr>
<th>Affected Products:</th>
<td>
<ul class="list-group">
<li class="list-group-item">SUSE Linux Enterprise Server 16.0</li>
<li class="list-group-item">SUSE Linux Enterprise Server for SAP applications 16.0</li>
</ul>
</td>
</tr>
</tbody>
</table>
<p>An update that solves 21 vulnerabilities and contains one feature can now be installed.</p>
<h2>Description:</h2>
<p>This update for amazon-ssm-agent fixes the following issues</p>
<p>Update to version 3.3.4624.0:</p>
<ul>
<li>CVE-2025-22869: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh
(bsc#1239342).</li>
<li>CVE-2025-22870: golang.org/x/net/proxy: proxy bypass using IPv6 zone IDs (bsc#1238702).</li>
<li>CVE-2025-47913: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type in
response to a key listing or signing request (bsc#1253611).</li>
<li>CVE-2026-1229: the CombinedMult function in the ecc/p384 package produces an incorrect value for specific inputs
(bsc#1265474).</li>
<li>CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for .pack and .idx files
can lead to the consumption of corrupted files (bsc#1258095).</li>
<li>CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation
bypass and privilege esca (bsc#1266781).</li>
<li>CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during
smart-HTTP clone and fetch operations (bsc#1264952).</li>
<li>CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to DoS via infinite
loops, panics or resource consumption (bsc#1267332).</li>
<li>CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266200).</li>
<li>CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266200).</li>
<li>CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266200).</li>
<li>CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh
(bsc#1266200).</li>
<li>CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh
(bsc#1266200).</li>
<li>CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent
(bsc#1266200).</li>
<li>CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266200).</li>
<li>CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266200).</li>
<li>CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266200).</li>
<li>CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts
(bsc#1266200).</li>
<li>CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh
(bsc#1266200).</li>
<li>CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266200).</li>
<li>CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266200).</li>
</ul>
<p>Changes:</p>
<ul>
<li>Bump golang.org/x/crypto from v0.51.0 to v0.52.0</li>
<li>Bump golang.org/x/net from v0.54.0 to v0.55.0</li>
<li>Enforce directory boundary in BuildSafePath</li>
<li>Fix visibility issue with Bottlerocket OS in document output</li>
<li>Update go-git from v5.17.1 to v5.19.1 (bsc#1264952, CVE-2026-41506), this
also updates go-billy from v5.8.0 to v5.9.0 (bsc#1267332, CVE-2026-44740)</li>
<li>Bump golang.org/x/net from v0.48.0 to v0.53.0 (bsc#1266781, CVE-2026-39821)</li>
<li>Quit if sysprep failed and log its current state</li>
<li>Remove attached legacy cloudwatch plugin packages</li>
<li>Upgrade Go version to 1.25.10</li>
<li>Use BuildSafePath wherever it is applicable</li>
<li>Add OOM killer protection to systemd service files</li>
<li>Apply more sanitation to file and registry inventory gatherers</li>
<li>Bump go-git to v5.17.1</li>
<li>Deprecate legacy cloudwatch plugin</li>
<li>Preserve network error details in credential refresher SSM API failures</li>
<li>Upgrade Go version to 1.25.9</li>
<li>Add SSM Distributor support for Bottlerocket OS</li>
<li>Implement flush credentials command in ssm-cli</li>
<li>Log ec2messages access denied as debug instead of error to reduce log noise</li>
<li>Make credential refresher refresh cache quickly in case of credential flush</li>
<li>Make Greengrass component registration resilient with retry</li>
<li>Add EnforceWorkspaceRootOwnership configuration to support disable
hardening of agent workspace</li>
<li>Add reboot comment to Windows shutdown command for SSM Agent traceability</li>
<li>Update privilege access check to verify ownership and permissions
of document state files</li>
<li>Add read-only version check prior to install and uninstall
in case of occupied package manager locks</li>
<li>Add ANSI processing for CloudWatch and S3 log</li>
<li>Upgrade go-git to v5.17.0 and cloudflare/circl to v1.6.3
to fix CVE-2026-1229</li>
<li>Switch to systemd-tmpfiles to store runtime data (jsc#PED-14843)</li>
<li>Disable Go 1.25 container-aware GOMAXPROCS to prevent holding
cgroup file descriptors open</li>
<li>Upgrade Go version to 1.25.8</li>
<li>Document CommandWorkerBufferLimit config</li>
<li>Include package update in Dockerfile</li>
<li>Reduce CloudWatch event message length threshold</li>
<li>Upgrade Go version to 1.25.7</li>
<li>Update github.com/go-git/go-git/v5 to 5.16.5 (bsc#1258095, CVE-2026-25934)</li>
<li>Update greengrass version</li>
<li>Update Golang version to 1.24.12</li>
<li>Updating golang.org/x/crypto from v0.37.0 to v0.47.0, golang.org/x/net
from v0.39.0 to v0.48.0 and golang.org/x/sys from v0.32.0 to v0.40.0
(bsc#1253611, CVE-2025-47913)</li>
<li>Categorize integration tests by adding new tags to split fast and slow ones</li>
<li>Fix bug where IP field being empty string and causing UII API failure</li>
<li>Allow Patch execution to persist across reboots not registered to SSM Agent</li>
<li>Fix ENV_VAR interpolation to work correctly with parameter store value</li>
<li>Implement immediate retries for failed reply messages to MGS for RunCommand documents</li>
<li>Improve ssm-cli get-diagnostics command log output</li>
<li>Support DomainJoin endpoint for EU sovereign cloud</li>
<li>Support dualstack S3 endpoint for distributor packages</li>
<li>Upgrade Go version to 1.24.11</li>
<li>Add initial IPv6 support with UseDualStackEndpoint configuration option</li>
<li>Fix CPU utilization issue for instances with thousands of network interfaces</li>
<li>Add IMDS retry count to account for EC2 droplet refresh</li>
<li>Fix duplicate uid error logging in MDS module</li>
<li>Update aws:Domainjoin plugin logging from Log4Net to NLog</li>
<li>Upgrade Go version to 1.24.7</li>
<li>Update github.com/go-git/go-git/v5 to 5.15.0</li>
<li>Update golang.org/x/crypto to v0.37.0 (bsc#1238702, CVE-2025-22870)</li>
<li>Update golang.org/x/net to v0.39.0</li>
<li>Update golang.org/x/sys to v0.32.0</li>
<li>Add EU sovereign cloud S3 endpoint for DownloadContent plugin</li>
<li>Add configurable credential rotation max backoff interval</li>
<li>Migrate from twinj/uuid to google/uuid library</li>
<li>Allow newer agent versions to be installed when deploying on Greengrass</li>
<li>Harden function to remove non-admin run command documents in execution path</li>
<li>Fix macOS credential refresher test issue due to missing Debugf from serialport skip file</li>
<li>Enhance testability of custom certificate usage in debug SSM Agent builds</li>
<li>Decouple serial port from startup and add credential refresher serialport logging</li>
<li>Add GlobalEnhancedTelemetryEnabled config to README</li>
<li>Add cloudwatch logs endpoint configuration to optional config for agent</li>
<li>Update Greengrass component version</li>
<li>Add file privilege check before processing document state file</li>
<li>Storing AWS document interpolation ENV_VAR types as environment variables</li>
<li>Throw explicit error when running local cli as non-priviledged user</li>
<li>Harden telemetry dynamic config folder permissions</li>
<li>Add configuration option for HandshakeTimeout</li>
<li>Improve unit tests</li>
<li>Add setup for emitting telemetry logs and metrics</li>
<li>Add initial selection of error logs to emit to telemetry</li>
<li>Simplify checkstyle and import organization in build scripts</li>
<li>Update golang.org/x/net from v0.37.0 to v0.38.0</li>
<li>Agent hibernation reason is logged to EC2 system logs</li>
<li>Add metrics for the EC2Detector and IMDS EC2 status findings</li>
<li>Change Linux DomainJoin plugin parameter KeepHostName to accept
both boolean and string</li>
<li>Upgrade GoLang to version 1.23.8</li>
<li>Update golang.org/x/crypto from v0.32.0 to v0.36.0 (bsc#1239342, CVE-2025-22869)</li>
</ul>
<h2>Patch Instructions:</h2>
<p>
To install this SUSE update use the SUSE recommended
installation methods like YaST online_update or "zypper patch".<br/>
Alternatively you can run the command listed for your product:
</p>
<ul class="list-group">
<li class="list-group-item">
SUSE Linux Enterprise Server 16.0
<br/>
<code>zypper in -t patch SUSE-SLES-16.0-943=1</code>
</li>
<li class="list-group-item">
SUSE Linux Enterprise Server for SAP applications 16.0
<br/>
<code>zypper in -t patch SUSE-SLES-16.0-943=1</code>
</li>
</ul>
<h2>Package List:</h2>
<ul>
<li>
SUSE Linux Enterprise Server for SAP applications 16.0 (x86_64)
<ul>
<li>amazon-ssm-agent-3.3.4624.0-160000.1.1</li>
</ul>
</li>
<li>
SUSE Linux Enterprise Server 16.0 (aarch64 x86_64)
<ul>
<li>amazon-ssm-agent-3.3.4624.0-160000.1.1</li>
</ul>
</li>
</ul>
<h2>References:</h2>
<ul>
<li>
<a href="https://www.suse.com/security/cve/CVE-2025-22869.html">https://www.suse.com/security/cve/CVE-2025-22869.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2025-22870.html">https://www.suse.com/security/cve/CVE-2025-22870.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2025-47913.html">https://www.suse.com/security/cve/CVE-2025-47913.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-1229.html">https://www.suse.com/security/cve/CVE-2026-1229.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-25934.html">https://www.suse.com/security/cve/CVE-2026-25934.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-39821.html">https://www.suse.com/security/cve/CVE-2026-39821.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-39827.html">https://www.suse.com/security/cve/CVE-2026-39827.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-39828.html">https://www.suse.com/security/cve/CVE-2026-39828.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-39829.html">https://www.suse.com/security/cve/CVE-2026-39829.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-39830.html">https://www.suse.com/security/cve/CVE-2026-39830.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-39831.html">https://www.suse.com/security/cve/CVE-2026-39831.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-39832.html">https://www.suse.com/security/cve/CVE-2026-39832.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-39833.html">https://www.suse.com/security/cve/CVE-2026-39833.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-39834.html">https://www.suse.com/security/cve/CVE-2026-39834.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-39835.html">https://www.suse.com/security/cve/CVE-2026-39835.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-41506.html">https://www.suse.com/security/cve/CVE-2026-41506.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-42508.html">https://www.suse.com/security/cve/CVE-2026-42508.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-44740.html">https://www.suse.com/security/cve/CVE-2026-44740.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-46595.html">https://www.suse.com/security/cve/CVE-2026-46595.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-46597.html">https://www.suse.com/security/cve/CVE-2026-46597.html</a>
</li>
<li>
<a href="https://www.suse.com/security/cve/CVE-2026-46598.html">https://www.suse.com/security/cve/CVE-2026-46598.html</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1238702">https://bugzilla.suse.com/show_bug.cgi?id=1238702</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1239342">https://bugzilla.suse.com/show_bug.cgi?id=1239342</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1253611">https://bugzilla.suse.com/show_bug.cgi?id=1253611</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1258095">https://bugzilla.suse.com/show_bug.cgi?id=1258095</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1264952">https://bugzilla.suse.com/show_bug.cgi?id=1264952</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1265474">https://bugzilla.suse.com/show_bug.cgi?id=1265474</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1266200">https://bugzilla.suse.com/show_bug.cgi?id=1266200</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1266781">https://bugzilla.suse.com/show_bug.cgi?id=1266781</a>
</li>
<li>
<a href="https://bugzilla.suse.com/show_bug.cgi?id=1267332">https://bugzilla.suse.com/show_bug.cgi?id=1267332</a>
</li>
<li>
<a href="https://jira.suse.com/browse/PED-14843">https://jira.suse.com/browse/PED-14843</a>
</li>
</ul>
</div>