Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2024-45339 (GCVE-0-2024-45339)
Vulnerability from cvelistv5 – Published: 2025-01-28 01:03 – Updated: 2026-04-30 03:56
VLAI
EPSS
VEX
Title
Vulnerability when creating log files in github.com/golang/glog
Summary
When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process's log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix that, glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists.
Severity
7.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-04-29 00:00 UTC
CWE
- CWE-61 - UNIX Symbolic Link (Symlink) Following
Assigner
References
6 references
Impacted products
1 product
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| github.com/golang/glog | github.com/golang/glog |
Affected:
0 , < 1.2.4
(semver)
|
guessed |
Credits
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-45339",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-04-29T00:00:00+00:00",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-30T03:56:03.352Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2025-02-17T11:02:36.886Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"url": "https://lists.debian.org/debian-lts-announce/2025/02/msg00019.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://pkg.go.dev",
"defaultStatus": "unaffected",
"packageName": "github.com/golang/glog",
"product": "github.com/golang/glog",
"programRoutines": [
{
"name": "create"
},
{
"name": "Error"
},
{
"name": "ErrorContext"
},
{
"name": "ErrorContextDepth"
},
{
"name": "ErrorContextDepthf"
},
{
"name": "ErrorContextf"
},
{
"name": "ErrorDepth"
},
{
"name": "ErrorDepthf"
},
{
"name": "Errorf"
},
{
"name": "Errorln"
},
{
"name": "Exit"
},
{
"name": "ExitContext"
},
{
"name": "ExitContextDepth"
},
{
"name": "ExitContextDepthf"
},
{
"name": "ExitContextf"
},
{
"name": "ExitDepth"
},
{
"name": "ExitDepthf"
},
{
"name": "Exitf"
},
{
"name": "Exitln"
},
{
"name": "Fatal"
},
{
"name": "FatalContext"
},
{
"name": "FatalContextDepth"
},
{
"name": "FatalContextDepthf"
},
{
"name": "FatalContextf"
},
{
"name": "FatalDepth"
},
{
"name": "FatalDepthf"
},
{
"name": "Fatalf"
},
{
"name": "Fatalln"
},
{
"name": "Info"
},
{
"name": "InfoContext"
},
{
"name": "InfoContextDepth"
},
{
"name": "InfoContextDepthf"
},
{
"name": "InfoContextf"
},
{
"name": "InfoDepth"
},
{
"name": "InfoDepthf"
},
{
"name": "Infof"
},
{
"name": "Infoln"
},
{
"name": "Verbose.Info"
},
{
"name": "Verbose.InfoContext"
},
{
"name": "Verbose.InfoContextDepth"
},
{
"name": "Verbose.InfoContextDepthf"
},
{
"name": "Verbose.InfoContextf"
},
{
"name": "Verbose.InfoDepth"
},
{
"name": "Verbose.InfoDepthf"
},
{
"name": "Verbose.Infof"
},
{
"name": "Verbose.Infoln"
},
{
"name": "Warning"
},
{
"name": "WarningContext"
},
{
"name": "WarningContextDepth"
},
{
"name": "WarningContextDepthf"
},
{
"name": "WarningContextf"
},
{
"name": "WarningDepth"
},
{
"name": "WarningDepthf"
},
{
"name": "Warningf"
},
{
"name": "Warningln"
},
{
"name": "fileSink.Emit"
},
{
"name": "logBridge.Write"
},
{
"name": "syncBuffer.Write"
}
],
"vendor": "github.com/golang/glog",
"versions": [
{
"lessThan": "1.2.4",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Josh McSavaney"
},
{
"lang": "en",
"value": "G\u00fcnther Noack"
}
],
"descriptions": [
{
"lang": "en",
"value": "When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process\u0027s log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix that, glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-61: UNIX Symbolic Link (Symlink) Following",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-01-28T01:03:24.105Z",
"orgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"shortName": "Go"
},
"references": [
{
"url": "https://github.com/golang/glog/pull/74/commits/b8741656e406e66d6992bc2c9575e460ecaa0ec2"
},
{
"url": "https://github.com/golang/glog/pull/74"
},
{
"url": "https://groups.google.com/g/golang-announce/c/H-Q4ouHWyKs"
},
{
"url": "https://owasp.org/www-community/vulnerabilities/Insecure_Temporary_File"
},
{
"url": "https://pkg.go.dev/vuln/GO-2025-3372"
}
],
"title": "Vulnerability when creating log files in github.com/golang/glog"
}
},
"cveMetadata": {
"assignerOrgId": "1bb62c36-49e3-4200-9d77-64a1400537cc",
"assignerShortName": "Go",
"cveId": "CVE-2024-45339",
"datePublished": "2025-01-28T01:03:24.105Z",
"dateReserved": "2024-08-27T19:41:58.556Z",
"dateUpdated": "2026-04-30T03:56:03.352Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2024-45339",
"date": "2026-09-05",
"epss": "0.00318",
"percentile": "0.24246"
},
"microsoft_vex": {
"current_release_date": "2026-02-18T02:48:57.000Z",
"cve": "CVE-2024-45339",
"id": "msrc_CVE-2024-45339",
"initial_release_date": "2025-01-02T00:00:00.000Z",
"product_status:fixed": "8",
"product_status:known_affected": "8",
"product_status:known_not_affected": "7",
"source": "Microsoft CSAF VEX",
"status": "final",
"title": "Vulnerability when creating log files in github.com/golang/glog",
"url": "https://msrc.microsoft.com/csaf/vex/2025/msrc_cve-2024-45339.json",
"version": "4"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2024-45339\",\"sourceIdentifier\":\"security@golang.org\",\"published\":\"2025-01-28T02:15:28.927\",\"lastModified\":\"2026-06-17T07:54:03.643\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process\u0027s log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix that, glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists.\"},{\"lang\":\"es\",\"value\":\"Cuando los registros se escriben en un directorio de amplia escritura (el predeterminado), un atacante sin privilegios puede predecir la ruta del archivo de registro de un proceso privilegiado y crear previamente un enlace simb\u00f3lico a un archivo confidencial en su lugar. Cuando se ejecuta ese proceso privilegiado, seguir\u00e1 el enlace simb\u00f3lico plantado y sobrescribir\u00e1 ese archivo confidencial. Para solucionarlo, glog ahora hace que el programa salga (con el c\u00f3digo de estado 2) cuando descubre que el archivo de registro configurado ya existe.\"}],\"affected\":[{\"source\":\"security@golang.org\",\"affectedData\":[{\"vendor\":\"github.com/golang/glog\",\"product\":\"github.com/golang/glog\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://pkg.go.dev\",\"packageName\":\"github.com/golang/glog\",\"programRoutines\":[{\"name\":\"create\"},{\"name\":\"Error\"},{\"name\":\"ErrorContext\"},{\"name\":\"ErrorContextDepth\"},{\"name\":\"ErrorContextDepthf\"},{\"name\":\"ErrorContextf\"},{\"name\":\"ErrorDepth\"},{\"name\":\"ErrorDepthf\"},{\"name\":\"Errorf\"},{\"name\":\"Errorln\"},{\"name\":\"Exit\"},{\"name\":\"ExitContext\"},{\"name\":\"ExitContextDepth\"},{\"name\":\"ExitContextDepthf\"},{\"name\":\"ExitContextf\"},{\"name\":\"ExitDepth\"},{\"name\":\"ExitDepthf\"},{\"name\":\"Exitf\"},{\"name\":\"Exitln\"},{\"name\":\"Fatal\"},{\"name\":\"FatalContext\"},{\"name\":\"FatalContextDepth\"},{\"name\":\"FatalContextDepthf\"},{\"name\":\"FatalContextf\"},{\"name\":\"FatalDepth\"},{\"name\":\"FatalDepthf\"},{\"name\":\"Fatalf\"},{\"name\":\"Fatalln\"},{\"name\":\"Info\"},{\"name\":\"InfoContext\"},{\"name\":\"InfoContextDepth\"},{\"name\":\"InfoContextDepthf\"},{\"name\":\"InfoContextf\"},{\"name\":\"InfoDepth\"},{\"name\":\"InfoDepthf\"},{\"name\":\"Infof\"},{\"name\":\"Infoln\"},{\"name\":\"Verbose.Info\"},{\"name\":\"Verbose.InfoContext\"},{\"name\":\"Verbose.InfoContextDepth\"},{\"name\":\"Verbose.InfoContextDepthf\"},{\"name\":\"Verbose.InfoContextf\"},{\"name\":\"Verbose.InfoDepth\"},{\"name\":\"Verbose.InfoDepthf\"},{\"name\":\"Verbose.Infof\"},{\"name\":\"Verbose.Infoln\"},{\"name\":\"Warning\"},{\"name\":\"WarningContext\"},{\"name\":\"WarningContextDepth\"},{\"name\":\"WarningContextDepthf\"},{\"name\":\"WarningContextf\"},{\"name\":\"WarningDepth\"},{\"name\":\"WarningDepthf\"},{\"name\":\"Warningf\"},{\"name\":\"Warningln\"},{\"name\":\"fileSink.Emit\"},{\"name\":\"logBridge.Write\"},{\"name\":\"syncBuffer.Write\"}],\"versions\":[{\"version\":\"0\",\"lessThan\":\"1.2.4\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N\",\"baseScore\":7.1,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.8,\"impactScore\":5.2}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-04-29T00:00:00+00:00\",\"id\":\"CVE-2024-45339\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"total\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"references\":[{\"url\":\"https://github.com/golang/glog/pull/74\",\"source\":\"security@golang.org\"},{\"url\":\"https://github.com/golang/glog/pull/74/commits/b8741656e406e66d6992bc2c9575e460ecaa0ec2\",\"source\":\"security@golang.org\"},{\"url\":\"https://groups.google.com/g/golang-announce/c/H-Q4ouHWyKs\",\"source\":\"security@golang.org\"},{\"url\":\"https://owasp.org/www-community/vulnerabilities/Insecure_Temporary_File\",\"source\":\"security@golang.org\"},{\"url\":\"https://pkg.go.dev/vuln/GO-2025-3372\",\"source\":\"security@golang.org\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/02/msg00019.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
"redhat_vex": {
"aggregate_severity": "Important",
"current_release_date": "2026-09-05T13:00:11+00:00",
"cve": "CVE-2024-45339",
"id": "CVE-2024-45339",
"initial_release_date": "2024-01-01T00:00:00+00:00",
"product_status:fixed": "386",
"product_status:known_affected": "30",
"product_status:known_not_affected": "14340",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "github.com/golang/glog: Vulnerability when creating log files in github.com/golang/glog",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-45339.json",
"version": "3"
},
"suse_vex": {
"aggregate_severity": "important",
"current_release_date": "2026-09-03T00:21:48Z",
"cve": "CVE-2024-45339",
"id": "CVE-2024-45339",
"initial_release_date": "2025-01-29T04:06:00Z",
"product_status:known_affected": "433",
"product_status:known_not_affected": "187",
"product_status:recommended": "84",
"source": "SUSE CSAF VEX",
"status": "interim",
"title": "SUSE CVE CVE-2024-45339",
"url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2024-45339.json",
"version": "58"
},
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/02/msg00019.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-02-17T11:02:36.886Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.1, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-45339\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-01-28T14:57:36.887905Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-01-28T14:47:16.702Z\"}}], \"cna\": {\"title\": \"Vulnerability when creating log files in github.com/golang/glog\", \"credits\": [{\"lang\": \"en\", \"value\": \"Josh McSavaney\"}, {\"lang\": \"en\", \"value\": \"G\\u00fcnther Noack\"}], \"affected\": [{\"vendor\": \"github.com/golang/glog\", \"product\": \"github.com/golang/glog\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"1.2.4\", \"versionType\": \"semver\"}], \"packageName\": \"github.com/golang/glog\", \"collectionURL\": \"https://pkg.go.dev\", \"defaultStatus\": \"unaffected\", \"programRoutines\": [{\"name\": \"create\"}, {\"name\": \"Error\"}, {\"name\": \"ErrorContext\"}, {\"name\": \"ErrorContextDepth\"}, {\"name\": \"ErrorContextDepthf\"}, {\"name\": \"ErrorContextf\"}, {\"name\": \"ErrorDepth\"}, {\"name\": \"ErrorDepthf\"}, {\"name\": \"Errorf\"}, {\"name\": \"Errorln\"}, {\"name\": \"Exit\"}, {\"name\": \"ExitContext\"}, {\"name\": \"ExitContextDepth\"}, {\"name\": \"ExitContextDepthf\"}, {\"name\": \"ExitContextf\"}, {\"name\": \"ExitDepth\"}, {\"name\": \"ExitDepthf\"}, {\"name\": \"Exitf\"}, {\"name\": \"Exitln\"}, {\"name\": \"Fatal\"}, {\"name\": \"FatalContext\"}, {\"name\": \"FatalContextDepth\"}, {\"name\": \"FatalContextDepthf\"}, {\"name\": \"FatalContextf\"}, {\"name\": \"FatalDepth\"}, {\"name\": \"FatalDepthf\"}, {\"name\": \"Fatalf\"}, {\"name\": \"Fatalln\"}, {\"name\": \"Info\"}, {\"name\": \"InfoContext\"}, {\"name\": \"InfoContextDepth\"}, {\"name\": \"InfoContextDepthf\"}, {\"name\": \"InfoContextf\"}, {\"name\": \"InfoDepth\"}, {\"name\": \"InfoDepthf\"}, {\"name\": \"Infof\"}, {\"name\": \"Infoln\"}, {\"name\": \"Verbose.Info\"}, {\"name\": \"Verbose.InfoContext\"}, {\"name\": \"Verbose.InfoContextDepth\"}, {\"name\": \"Verbose.InfoContextDepthf\"}, {\"name\": \"Verbose.InfoContextf\"}, {\"name\": \"Verbose.InfoDepth\"}, {\"name\": \"Verbose.InfoDepthf\"}, {\"name\": \"Verbose.Infof\"}, {\"name\": \"Verbose.Infoln\"}, {\"name\": \"Warning\"}, {\"name\": \"WarningContext\"}, {\"name\": \"WarningContextDepth\"}, {\"name\": \"WarningContextDepthf\"}, {\"name\": \"WarningContextf\"}, {\"name\": \"WarningDepth\"}, {\"name\": \"WarningDepthf\"}, {\"name\": \"Warningf\"}, {\"name\": \"Warningln\"}, {\"name\": \"fileSink.Emit\"}, {\"name\": \"logBridge.Write\"}, {\"name\": \"syncBuffer.Write\"}]}], \"references\": [{\"url\": \"https://github.com/golang/glog/pull/74/commits/b8741656e406e66d6992bc2c9575e460ecaa0ec2\"}, {\"url\": \"https://github.com/golang/glog/pull/74\"}, {\"url\": \"https://groups.google.com/g/golang-announce/c/H-Q4ouHWyKs\"}, {\"url\": \"https://owasp.org/www-community/vulnerabilities/Insecure_Temporary_File\"}, {\"url\": \"https://pkg.go.dev/vuln/GO-2025-3372\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process\u0027s log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix that, glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"description\": \"CWE-61: UNIX Symbolic Link (Symlink) Following\"}]}], \"providerMetadata\": {\"orgId\": \"1bb62c36-49e3-4200-9d77-64a1400537cc\", \"shortName\": \"Go\", \"dateUpdated\": \"2025-01-28T01:03:24.105Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2024-45339\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-04-30T03:56:03.352Z\", \"dateReserved\": \"2024-08-27T19:41:58.556Z\", \"assignerOrgId\": \"1bb62c36-49e3-4200-9d77-64a1400537cc\", \"datePublished\": \"2025-01-28T01:03:24.105Z\", \"assignerShortName\": \"Go\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
SUSE-SU-2025:0297-1
Vulnerability from csaf_suse - Published: 2025-01-30 14:03 - Updated: 2025-01-30 14:03Summary
Security update for govulncheck-vulndb
Severity
Moderate
Notes
Title of the patch: Security update for govulncheck-vulndb
Description of the patch: This update for govulncheck-vulndb fixes the following issues:
- Update to version 0.0.20250128T150132 2025-01-28T15:01:32Z.
Refs jsc#PED-11136
Go CVE Numbering Authority IDs added or updated with aliases:
* GO-2025-3409 CVE-2025-23208 GHSA-c9p4-xwr9-rfhx
* GO-2025-3410 CVE-2025-24337 GHSA-3qc3-mx6x-267h
* GO-2025-3413 CVE-2025-0377 GHSA-wpfp-cm49-9m9q
* GO-2025-3414 CVE-2024-11218 GHSA-5vpc-35f4-r8w6
* GO-2025-3415 CVE-2025-23028 GHSA-9m5p-c77c-f9j7
* GO-2025-3416 CVE-2025-23047 GHSA-h78m-j95m-5356
* GO-2025-3418 CVE-2025-24030 GHSA-j777-63hf-hx76
* GO-2025-3419 CVE-2025-24355 GHSA-v34r-vj4r-38j6
* GO-2025-3422 CVE-2025-24354
- Update to version 0.0.20250128T004730 2025-01-28T00:47:30Z.
Refs jsc#PED-11136
Go CVE Numbering Authority IDs added or updated with aliases:
* GO-2025-3372 CVE-2024-45339
* GO-2025-3373 CVE-2024-45341
* GO-2025-3383 CVE-2024-45340
* GO-2025-3420 CVE-2024-45336
* GO-2025-3421 CVE-2025-22865
- Update to version 0.0.20250117T214834 2025-01-17T21:48:34Z.
Refs jsc#PED-11136
Go CVE Numbering Authority IDs added or updated with aliases:
* GO-2025-3392 CVE-2025-20086 GHSA-5m7j-6gc4-ff5g
* GO-2025-3393 CVE-2025-21088 GHSA-8j3q-gc9x-7972
* GO-2025-3394 CVE-2025-20088 GHSA-45v9-w9fh-33j6
* GO-2025-3396 CVE-2024-52594
* GO-2025-3397 CVE-2024-36402 GHSA-8vmr-h7h5-cqhg
* GO-2025-3398 CVE-2024-52791 GHSA-gp86-q8hg-fpxj
* GO-2025-3399 CVE-2024-52602 GHSA-r6jg-jfv6-2fjv
* GO-2025-3400 CVE-2024-56515 GHSA-rcxc-wjgw-579r
* GO-2025-3401 CVE-2024-36403 GHSA-vc2m-hw89-qjxf
* GO-2025-3407 CVE-2025-20621 GHSA-w6xh-c82w-h997
- Update to version 0.0.20250115T172141 2025-01-15T17:21:41Z.
Refs jsc#PED-11136
Go CVE Numbering Authority IDs added or updated with aliases:
* GO-2025-3381 CVE-2024-56138 GHSA-45v3-38pc-874v
* GO-2025-3382 CVE-2024-51491 GHSA-qjh3-4j3h-vmwp
* GO-2025-3384 CVE-2024-56323 GHSA-32q6-rr98-cjqv
* GO-2025-3390 CVE-2024-53263 GHSA-q6r2-x2cc-vrp7
* GO-2025-3391 CVE-2024-52281 GHSA-2v2w-8v8c-wcm9
- Update to version 0.0.20250109T194159 2025-01-09T19:41:59Z.
Refs jsc#PED-11136
Go CVE Numbering Authority IDs added or updated with aliases:
* GO-2025-3376 CVE-2025-22149 GHSA-675f-rq2r-jw82
* GO-2025-3377 CVE-2025-22449 GHSA-q8fg-cp3q-5jwm
* GO-2025-3379 CVE-2025-20033 GHSA-2549-xh72-qrpm
* GO-2025-3380 CVE-2025-22445 GHSA-7rgp-4j56-fm79
Patchnames: SUSE-2025-297,SUSE-SLE-Module-Packagehub-Subpackages-15-SP6-2025-297,openSUSE-SLE-15.6-2025-297
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
7.7 (High)
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch | — |
Vendor Fix
|
Threats
Impact
important
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch | — |
Vendor Fix
|
Threats
Impact
moderate
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch | — |
Vendor Fix
|
Threats
Impact
moderate
5.9 (Medium)
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch | — |
Vendor Fix
|
Threats
Impact
moderate
7.1 (High)
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch | — |
Vendor Fix
|
Threats
Impact
important
7.7 (High)
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch | — |
Vendor Fix
|
Threats
Impact
important
4.2 (Medium)
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch | — |
Vendor Fix
|
Threats
Impact
moderate
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch | — |
Vendor Fix
|
Threats
Impact
low
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch | — |
Vendor Fix
|
Threats
Impact
important
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch | — |
Vendor Fix
|
Threats
Impact
moderate
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch | — |
Vendor Fix
|
Threats
Impact
moderate
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch | — |
Vendor Fix
|
Threats
Impact
moderate
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch | — |
Vendor Fix
|
Threats
Impact
important
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch | — |
Vendor Fix
|
Threats
Impact
low
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch | — |
Vendor Fix
|
Threats
Impact
moderate
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch | — |
Vendor Fix
|
Threats
Impact
moderate
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch | — |
Vendor Fix
|
Threats
Impact
important
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch | — |
Vendor Fix
|
Threats
Impact
moderate
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch | — |
Vendor Fix
|
Threats
Impact
moderate
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch | — |
Vendor Fix
|
Threats
Impact
moderate
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch | — |
Vendor Fix
|
Threats
Impact
moderate
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch | — |
Vendor Fix
|
Threats
Impact
moderate
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch | — |
Vendor Fix
|
Threats
Impact
low
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch | — |
Vendor Fix
|
Threats
Impact
low
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch | — |
Vendor Fix
|
Threats
Impact
low
7.5 (High)
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch | — |
Vendor Fix
|
Threats
Impact
important
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch | — |
Vendor Fix
|
Threats
Impact
moderate
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch | — |
Vendor Fix
|
Threats
Impact
moderate
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch | — |
Vendor Fix
|
Threats
Impact
important
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch | — |
Vendor Fix
|
Threats
Impact
important
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch | — |
Vendor Fix
|
Threats
Impact
important
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch | — |
Vendor Fix
|
Threats
Impact
moderate
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch | — |
Vendor Fix
|
Threats
Impact
important
References
81 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for govulncheck-vulndb",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for govulncheck-vulndb fixes the following issues:\n\n- Update to version 0.0.20250128T150132 2025-01-28T15:01:32Z.\n Refs jsc#PED-11136\n Go CVE Numbering Authority IDs added or updated with aliases:\n * GO-2025-3409 CVE-2025-23208 GHSA-c9p4-xwr9-rfhx\n * GO-2025-3410 CVE-2025-24337 GHSA-3qc3-mx6x-267h\n * GO-2025-3413 CVE-2025-0377 GHSA-wpfp-cm49-9m9q\n * GO-2025-3414 CVE-2024-11218 GHSA-5vpc-35f4-r8w6\n * GO-2025-3415 CVE-2025-23028 GHSA-9m5p-c77c-f9j7\n * GO-2025-3416 CVE-2025-23047 GHSA-h78m-j95m-5356\n * GO-2025-3418 CVE-2025-24030 GHSA-j777-63hf-hx76\n * GO-2025-3419 CVE-2025-24355 GHSA-v34r-vj4r-38j6\n * GO-2025-3422 CVE-2025-24354\n\n- Update to version 0.0.20250128T004730 2025-01-28T00:47:30Z.\n Refs jsc#PED-11136\n Go CVE Numbering Authority IDs added or updated with aliases:\n * GO-2025-3372 CVE-2024-45339\n * GO-2025-3373 CVE-2024-45341\n * GO-2025-3383 CVE-2024-45340\n * GO-2025-3420 CVE-2024-45336\n * GO-2025-3421 CVE-2025-22865\n\n- Update to version 0.0.20250117T214834 2025-01-17T21:48:34Z.\n Refs jsc#PED-11136\n Go CVE Numbering Authority IDs added or updated with aliases:\n * GO-2025-3392 CVE-2025-20086 GHSA-5m7j-6gc4-ff5g\n * GO-2025-3393 CVE-2025-21088 GHSA-8j3q-gc9x-7972\n * GO-2025-3394 CVE-2025-20088 GHSA-45v9-w9fh-33j6\n * GO-2025-3396 CVE-2024-52594\n * GO-2025-3397 CVE-2024-36402 GHSA-8vmr-h7h5-cqhg\n * GO-2025-3398 CVE-2024-52791 GHSA-gp86-q8hg-fpxj\n * GO-2025-3399 CVE-2024-52602 GHSA-r6jg-jfv6-2fjv\n * GO-2025-3400 CVE-2024-56515 GHSA-rcxc-wjgw-579r\n * GO-2025-3401 CVE-2024-36403 GHSA-vc2m-hw89-qjxf\n * GO-2025-3407 CVE-2025-20621 GHSA-w6xh-c82w-h997\n\n- Update to version 0.0.20250115T172141 2025-01-15T17:21:41Z.\n Refs jsc#PED-11136\n Go CVE Numbering Authority IDs added or updated with aliases:\n * GO-2025-3381 CVE-2024-56138 GHSA-45v3-38pc-874v\n * GO-2025-3382 CVE-2024-51491 GHSA-qjh3-4j3h-vmwp\n * GO-2025-3384 CVE-2024-56323 GHSA-32q6-rr98-cjqv\n * GO-2025-3390 CVE-2024-53263 GHSA-q6r2-x2cc-vrp7\n * GO-2025-3391 CVE-2024-52281 GHSA-2v2w-8v8c-wcm9\n\n- Update to version 0.0.20250109T194159 2025-01-09T19:41:59Z.\n Refs jsc#PED-11136\n Go CVE Numbering Authority IDs added or updated with aliases:\n * GO-2025-3376 CVE-2025-22149 GHSA-675f-rq2r-jw82\n * GO-2025-3377 CVE-2025-22449 GHSA-q8fg-cp3q-5jwm\n * GO-2025-3379 CVE-2025-20033 GHSA-2549-xh72-qrpm\n * GO-2025-3380 CVE-2025-22445 GHSA-7rgp-4j56-fm79\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-2025-297,SUSE-SLE-Module-Packagehub-Subpackages-15-SP6-2025-297,openSUSE-SLE-15.6-2025-297",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2025_0297-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2025:0297-1",
"url": "https://www.suse.com/support/update/announcement/2025/suse-su-20250297-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2025:0297-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2025-January/020248.html"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-11218 page",
"url": "https://www.suse.com/security/cve/CVE-2024-11218/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-36402 page",
"url": "https://www.suse.com/security/cve/CVE-2024-36402/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-36403 page",
"url": "https://www.suse.com/security/cve/CVE-2024-36403/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-45336 page",
"url": "https://www.suse.com/security/cve/CVE-2024-45336/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-45339 page",
"url": "https://www.suse.com/security/cve/CVE-2024-45339/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-45340 page",
"url": "https://www.suse.com/security/cve/CVE-2024-45340/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-45341 page",
"url": "https://www.suse.com/security/cve/CVE-2024-45341/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-51491 page",
"url": "https://www.suse.com/security/cve/CVE-2024-51491/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-52281 page",
"url": "https://www.suse.com/security/cve/CVE-2024-52281/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-52594 page",
"url": "https://www.suse.com/security/cve/CVE-2024-52594/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-52602 page",
"url": "https://www.suse.com/security/cve/CVE-2024-52602/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-52791 page",
"url": "https://www.suse.com/security/cve/CVE-2024-52791/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-53263 page",
"url": "https://www.suse.com/security/cve/CVE-2024-53263/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-56138 page",
"url": "https://www.suse.com/security/cve/CVE-2024-56138/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-56323 page",
"url": "https://www.suse.com/security/cve/CVE-2024-56323/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-56515 page",
"url": "https://www.suse.com/security/cve/CVE-2024-56515/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-0377 page",
"url": "https://www.suse.com/security/cve/CVE-2025-0377/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-20033 page",
"url": "https://www.suse.com/security/cve/CVE-2025-20033/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-20086 page",
"url": "https://www.suse.com/security/cve/CVE-2025-20086/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-20088 page",
"url": "https://www.suse.com/security/cve/CVE-2025-20088/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-20621 page",
"url": "https://www.suse.com/security/cve/CVE-2025-20621/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-21088 page",
"url": "https://www.suse.com/security/cve/CVE-2025-21088/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-22149 page",
"url": "https://www.suse.com/security/cve/CVE-2025-22149/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-22445 page",
"url": "https://www.suse.com/security/cve/CVE-2025-22445/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-22449 page",
"url": "https://www.suse.com/security/cve/CVE-2025-22449/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-22865 page",
"url": "https://www.suse.com/security/cve/CVE-2025-22865/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-23028 page",
"url": "https://www.suse.com/security/cve/CVE-2025-23028/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-23047 page",
"url": "https://www.suse.com/security/cve/CVE-2025-23047/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-23208 page",
"url": "https://www.suse.com/security/cve/CVE-2025-23208/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-24030 page",
"url": "https://www.suse.com/security/cve/CVE-2025-24030/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-24337 page",
"url": "https://www.suse.com/security/cve/CVE-2025-24337/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-24354 page",
"url": "https://www.suse.com/security/cve/CVE-2025-24354/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-24355 page",
"url": "https://www.suse.com/security/cve/CVE-2025-24355/"
}
],
"title": "Security update for govulncheck-vulndb",
"tracking": {
"current_release_date": "2025-01-30T14:03:37Z",
"generator": {
"date": "2025-01-30T14:03:37Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2025:0297-1",
"initial_release_date": "2025-01-30T14:03:37Z",
"revision_history": [
{
"date": "2025-01-30T14:03:37Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
"product": {
"name": "govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
"product_id": "govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch"
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Module for Package Hub 15 SP6",
"product": {
"name": "SUSE Linux Enterprise Module for Package Hub 15 SP6",
"product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP6",
"product_identification_helper": {
"cpe": "cpe:/o:suse:packagehub:15:sp6"
}
}
},
{
"category": "product_name",
"name": "openSUSE Leap 15.6",
"product": {
"name": "openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:leap:15.6"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch as component of SUSE Linux Enterprise Module for Package Hub 15 SP6",
"product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch"
},
"product_reference": "govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch"
},
"product_reference": "govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
"relates_to_product_reference": "openSUSE Leap 15.6"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-11218",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-11218"
}
],
"notes": [
{
"category": "general",
"text": "A vulnerability was found in `podman build` and `buildah.` This issue occurs in a container breakout by using --jobs=2 and a race condition when building a malicious Containerfile. SELinux might mitigate it, but even with SELinux on, it still allows the enumeration of files and directories on the host.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-11218",
"url": "https://www.suse.com/security/cve/CVE-2024-11218"
},
{
"category": "external",
"summary": "SUSE Bug 1236269 for CVE-2024-11218",
"url": "https://bugzilla.suse.com/1236269"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-01-30T14:03:37Z",
"details": "important"
}
],
"title": "CVE-2024-11218"
},
{
"cve": "CVE-2024-36402",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-36402"
}
],
"notes": [
{
"category": "general",
"text": "Matrix Media Repo (MMR) is a highly configurable multi-homeserver media repository for Matrix. MMR before version 1.3.5 allows, by design, unauthenticated remote participants to trigger a download and caching of remote media from a remote homeserver to the local media repository. Such content then also becomes available for download from the local homeserver in an unauthenticated way. The implication is that unauthenticated remote adversaries can use this functionality to plant problematic content into the media repository. MMR 1.3.5 introduces a partial mitigation in the form of new endpoints which require authentication for media downloads. The unauthenticated endpoints will be frozen in a future release, closing the attack vector. Though extremely limited, server operators can use more strict rate limits based on IP address as a partial workaround.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-36402",
"url": "https://www.suse.com/security/cve/CVE-2024-36402"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-01-30T14:03:37Z",
"details": "moderate"
}
],
"title": "CVE-2024-36402"
},
{
"cve": "CVE-2024-36403",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-36403"
}
],
"notes": [
{
"category": "general",
"text": "Matrix Media Repo (MMR) is a highly configurable multi-homeserver media repository for Matrix. MMR before version 1.3.5 is vulnerable to unbounded disk consumption, where an unauthenticated adversary can induce it to download and cache large amounts of remote media files. MMR\u0027s typical operating environment uses S3-like storage as a backend, with file-backed store as an alternative option. Instances using a file-backed store or those which self-host an S3 storage system are therefore vulnerable to a disk fill attack. Once the disk is full, authenticated users will be unable to upload new media, resulting in denial of service. For instances configured to use a cloud-based S3 storage option, this could result in high service fees instead of a denial of service. MMR 1.3.5 introduces a new default-on \"leaky bucket\" rate limit to reduce the amount of data a user can request at a time. This does not fully address the issue, but does limit an unauthenticated user\u0027s ability to request large amounts of data. Operators should note that the leaky bucket implementation introduced in MMR 1.3.5 requires the IP address associated with the request to be forwarded, to avoid mistakenly applying the rate limit to the reverse proxy instead. To avoid this issue, the reverse proxy should populate the X-Forwarded-For header when sending the request to MMR. Operators who cannot update may wish to lower the maximum file size they allow and implement harsh rate limits, though this can still lead to a large amount of data to be downloaded.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-36403",
"url": "https://www.suse.com/security/cve/CVE-2024-36403"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-01-30T14:03:37Z",
"details": "moderate"
}
],
"title": "CVE-2024-36403"
},
{
"cve": "CVE-2024-45336",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-45336"
}
],
"notes": [
{
"category": "general",
"text": "The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header which is redirected to b.com/ will not send that header to b.com. In the event that the client received a subsequent same-domain redirect, however, the sensitive headers would be restored. For example, a chain of redirects from a.com/, to b.com/1, and finally to b.com/2 would incorrectly send the Authorization header to b.com/2.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-45336",
"url": "https://www.suse.com/security/cve/CVE-2024-45336"
},
{
"category": "external",
"summary": "SUSE Bug 1236045 for CVE-2024-45336",
"url": "https://bugzilla.suse.com/1236045"
},
{
"category": "external",
"summary": "SUSE Bug 1236046 for CVE-2024-45336",
"url": "https://bugzilla.suse.com/1236046"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-01-30T14:03:37Z",
"details": "moderate"
}
],
"title": "CVE-2024-45336"
},
{
"cve": "CVE-2024-45339",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-45339"
}
],
"notes": [
{
"category": "general",
"text": "When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process\u0027s log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix that, glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-45339",
"url": "https://www.suse.com/security/cve/CVE-2024-45339"
},
{
"category": "external",
"summary": "SUSE Bug 1236541 for CVE-2024-45339",
"url": "https://bugzilla.suse.com/1236541"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-01-30T14:03:37Z",
"details": "important"
}
],
"title": "CVE-2024-45339"
},
{
"cve": "CVE-2024-45340",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-45340"
}
],
"notes": [
{
"category": "general",
"text": "Credentials provided via the new GOAUTH feature were not being properly segmented by domain, allowing a malicious server to request credentials they should not have access to. By default, unless otherwise set, this only affected credentials stored in the users .netrc file.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-45340",
"url": "https://www.suse.com/security/cve/CVE-2024-45340"
},
{
"category": "external",
"summary": "SUSE Bug 1236360 for CVE-2024-45340",
"url": "https://bugzilla.suse.com/1236360"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-01-30T14:03:37Z",
"details": "important"
}
],
"title": "CVE-2024-45340"
},
{
"cve": "CVE-2024-45341",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-45341"
}
],
"notes": [
{
"category": "general",
"text": "A certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain. Certificates containing URIs are not permitted in the web PKI, so this only affects users of private PKIs which make use of URIs.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-45341",
"url": "https://www.suse.com/security/cve/CVE-2024-45341"
},
{
"category": "external",
"summary": "SUSE Bug 1236045 for CVE-2024-45341",
"url": "https://bugzilla.suse.com/1236045"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.2,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-01-30T14:03:37Z",
"details": "moderate"
}
],
"title": "CVE-2024-45341"
},
{
"cve": "CVE-2024-51491",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-51491"
}
],
"notes": [
{
"category": "general",
"text": "notion-go is a collection of libraries for supporting sign and verify OCI artifacts. Based on Notary Project specifications. The issue was identified during Quarkslab\u0027s security audit on the Certificate Revocation List (CRL) based revocation check feature.\nAfter retrieving the CRL, notation-go attempts to update the CRL cache using the os.Rename method. However, this operation may fail due to operating system-specific limitations, particularly when the source and destination paths are on different mount points. This failure could lead to an unexpected program termination. In method `crl.(*FileCache).Set`, a temporary file is created in the OS dedicated area (like /tmp for, usually, Linux/Unix). The file is written and then it is tried to move it to the dedicated `notation` cache directory thanks `os.Rename`. As specified in Go documentation, OS specific restriction may apply. When used with Linux OS, it is relying on rename syscall from the libc and as per the documentation, moving a file to a different mountpoint raises an EXDEV error, interpreted as Cross device link not permitted error. Some Linux distribution, like RedHat use a dedicated filesystem (tmpfs), mounted on a specific mountpoint (usually /tmp) for temporary files. When using such OS, revocation check based on CRL will repeatedly crash notation. As a result the signature verification process is aborted as process crashes. This issue has been addressed in version 1.3.0-rc.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-51491",
"url": "https://www.suse.com/security/cve/CVE-2024-51491"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-01-30T14:03:37Z",
"details": "low"
}
],
"title": "CVE-2024-51491"
},
{
"cve": "CVE-2024-52281",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-52281"
}
],
"notes": [
{
"category": "general",
"text": "A: Improper Neutralization of Input During Web Page Generation vulnerability in SUSE rancher allows a malicious actor to perform a Stored XSS attack through the cluster description field.\nThis issue affects rancher: from 2.9.0 before 2.9.4.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-52281",
"url": "https://www.suse.com/security/cve/CVE-2024-52281"
},
{
"category": "external",
"summary": "SUSE Bug 1233339 for CVE-2024-52281",
"url": "https://bugzilla.suse.com/1233339"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-01-30T14:03:37Z",
"details": "important"
}
],
"title": "CVE-2024-52281"
},
{
"cve": "CVE-2024-52594",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-52594"
}
],
"notes": [
{
"category": "general",
"text": "Gomatrixserverlib is a Go library for matrix federation. Gomatrixserverlib is vulnerable to server-side request forgery, serving content from a private network it can access, under certain conditions. The commit `c4f1e01` fixes this issue. Users are advised to upgrade. Users unable to upgrade should use a local firewall to limit the network segments and hosts the service using gomatrixserverlib can access.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-52594",
"url": "https://www.suse.com/security/cve/CVE-2024-52594"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-01-30T14:03:37Z",
"details": "moderate"
}
],
"title": "CVE-2024-52594"
},
{
"cve": "CVE-2024-52602",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-52602"
}
],
"notes": [
{
"category": "general",
"text": "Matrix Media Repo (MMR) is a highly configurable multi-homeserver media repository for Matrix. Matrix Media Repo (MMR) is vulnerable to server-side request forgery, serving content from a private network it can access, under certain conditions. This is fixed in MMR v1.3.8. Users are advised to upgrade. Restricting which hosts MMR is allowed to contact via (local) firewall rules or a transparent proxy and may provide a workaround for users unable to upgrade.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-52602",
"url": "https://www.suse.com/security/cve/CVE-2024-52602"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-01-30T14:03:37Z",
"details": "moderate"
}
],
"title": "CVE-2024-52602"
},
{
"cve": "CVE-2024-52791",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-52791"
}
],
"notes": [
{
"category": "general",
"text": "Matrix Media Repo (MMR) is a highly configurable multi-homeserver media repository for Matrix. MMR makes requests to other servers as part of normal operation, and these resource owners can return large amounts of JSON back to MMR for parsing. In parsing, MMR can consume large amounts of memory and exhaust available memory. This is fixed in MMR v1.3.8. Users are advised to upgrade. For users unable to upgrade; forward proxies can be configured to block requests to unsafe hosts. Alternatively, MMR processes can be configured with memory limits and auto-restart. Running multiple MMR processes concurrently can help ensure a restart does not overly impact users.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-52791",
"url": "https://www.suse.com/security/cve/CVE-2024-52791"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-01-30T14:03:37Z",
"details": "moderate"
}
],
"title": "CVE-2024-52791"
},
{
"cve": "CVE-2024-53263",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-53263"
}
],
"notes": [
{
"category": "general",
"text": "Git LFS is a Git extension for versioning large files. When Git LFS requests credentials from Git for a remote host, it passes portions of the host\u0027s URL to the `git-credential(1)` command without checking for embedded line-ending control characters, and then sends any credentials it receives back from the Git credential helper to the remote host. By inserting URL-encoded control characters such as line feed (LF) or carriage return (CR) characters into the URL, an attacker may be able to retrieve a user\u0027s Git credentials. This problem exists in all previous versions and is patched in v3.6.1. All users should upgrade to v3.6.1. There are no workarounds known at this time.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-53263",
"url": "https://www.suse.com/security/cve/CVE-2024-53263"
},
{
"category": "external",
"summary": "SUSE Bug 1235876 for CVE-2024-53263",
"url": "https://bugzilla.suse.com/1235876"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-01-30T14:03:37Z",
"details": "important"
}
],
"title": "CVE-2024-53263"
},
{
"cve": "CVE-2024-56138",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-56138"
}
],
"notes": [
{
"category": "general",
"text": "notion-go is a collection of libraries for supporting sign and verify OCI artifacts. Based on Notary Project specifications. This issue was identified during Quarkslab\u0027s audit of the timestamp feature. During the timestamp signature generation, the revocation status of the certificate(s) used to generate the timestamp signature was not verified. During timestamp signature generation, notation-go did not check the revocation status of the certificate chain used by the TSA. This oversight creates a vulnerability that could be exploited through a Man-in-The-Middle attack. An attacker could potentially use a compromised, intermediate, or revoked leaf certificate to generate a malicious countersignature, which would then be accepted and stored by `notation`. This could lead to denial of service scenarios, particularly in CI/CD environments during signature verification processes because timestamp signature would fail due to the presence of a revoked certificate(s) potentially disrupting operations. This issue has been addressed in release version 1.3.0-rc.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-56138",
"url": "https://www.suse.com/security/cve/CVE-2024-56138"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-01-30T14:03:37Z",
"details": "low"
}
],
"title": "CVE-2024-56138"
},
{
"cve": "CVE-2024-56323",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-56323"
}
],
"notes": [
{
"category": "general",
"text": "OpenFGA is an authorization/permission engine. IN OpenFGA v1.3.8 to v1.8.2 (Helm chart openfga-0.1.38 to openfga-0.2.19, docker v1.3.8 to v.1.8.2) are vulnerable to authorization bypass under the following conditions: 1. calling Check API or ListObjects with a model that uses [conditions](https://openfga.dev/docs/modeling/conditions), and 2. calling Check API or ListObjects API with [contextual tuples](https://openfga.dev/docs/concepts#what-are-contextual-tuples) that include conditions and 3. OpenFGA is configured with caching enabled (`OPENFGA_CHECK_QUERY_CACHE_ENABLED`). Users are advised to upgrade to v1.8.3. There are no known workarounds for this vulnerability.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-56323",
"url": "https://www.suse.com/security/cve/CVE-2024-56323"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-01-30T14:03:37Z",
"details": "moderate"
}
],
"title": "CVE-2024-56323"
},
{
"cve": "CVE-2024-56515",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-56515"
}
],
"notes": [
{
"category": "general",
"text": "Matrix Media Repo (MMR) is a highly configurable multi-homeserver media repository for Matrix. If SVG or JPEGXL thumbnailers are enabled (they are disabled by default), a user may upload a file which claims to be either of these types and request a thumbnail to invoke a different decoder in ImageMagick. In some ImageMagick installations, this includes the capability to run Ghostscript to decode the image/file. If MP4 thumbnailers are enabled (also disabled by default), the same issue as above may occur with the ffmpeg installation instead. MMR uses a number of other decoders for all other file types when preparing thumbnails. Theoretical issues are possible with these decoders, however in testing they were not possible to exploit. This is fixed in MMR v1.3.8. MMR now inspects the mimetype of media prior to thumbnailing, and picks a thumbnailer based on those results instead of relying on user-supplied values. This may lead to fewer thumbnails when obscure file shapes are used. This also helps narrow scope of theoretical issues with all decoders MMR uses for thumbnails. Users are advised to upgrade. Users unable to upgrade may disable the SVG, JPEGXL, and MP4 thumbnail types in the MMR config which prevents the decoders from being invoked. Further disabling uncommon file types on the server is recommended to limit risk surface. Containers and other similar technologies may also be used to limit the impact of vulnerabilities in external decoders, like ImageMagick and ffmpeg. Some installations of ImageMagick may disable \"unsafe\" file types, like PDFs, already. This option can be replicated to other environments as needed. ffmpeg may be compiled with limited decoders/codecs. The Docker image for MMR disables PDFs and similar formats by default.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-56515",
"url": "https://www.suse.com/security/cve/CVE-2024-56515"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-01-30T14:03:37Z",
"details": "moderate"
}
],
"title": "CVE-2024-56515"
},
{
"cve": "CVE-2025-0377",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-0377"
}
],
"notes": [
{
"category": "general",
"text": "HashiCorp\u0027s go-slug library is vulnerable to a zip-slip style attack when a non-existing user-provided path is extracted from the tar entry.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-0377",
"url": "https://www.suse.com/security/cve/CVE-2025-0377"
},
{
"category": "external",
"summary": "SUSE Bug 1236209 for CVE-2025-0377",
"url": "https://bugzilla.suse.com/1236209"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-01-30T14:03:37Z",
"details": "important"
}
],
"title": "CVE-2025-0377"
},
{
"cve": "CVE-2025-20033",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-20033"
}
],
"notes": [
{
"category": "general",
"text": "Mattermost versions 10.2.0, 9.11.x \u003c= 9.11.5, 10.0.x \u003c= 10.0.3, 10.1.x \u003c= 10.1.3 fail to properly validate post types, which allows attackers to deny service to users with the sysconsole_read_plugins permission via creating a post with the custom_pl_notification type and specific props.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-20033",
"url": "https://www.suse.com/security/cve/CVE-2025-20033"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-01-30T14:03:37Z",
"details": "moderate"
}
],
"title": "CVE-2025-20033"
},
{
"cve": "CVE-2025-20086",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-20086"
}
],
"notes": [
{
"category": "general",
"text": "Mattermost versions 10.2.x \u003c= 10.2.0, 9.11.x \u003c= 9.11.5, 10.0.x \u003c= 10.0.3, 10.1.x \u003c= 10.1.3 fail to properly validate post props which allows a malicious authenticated user to cause a crash via a malicious post.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-20086",
"url": "https://www.suse.com/security/cve/CVE-2025-20086"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-01-30T14:03:37Z",
"details": "moderate"
}
],
"title": "CVE-2025-20086"
},
{
"cve": "CVE-2025-20088",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-20088"
}
],
"notes": [
{
"category": "general",
"text": "Mattermost versions 10.2.x \u003c= 10.2.0, 9.11.x \u003c= 9.11.5, 10.0.x \u003c= 10.0.3, 10.1.x \u003c= 10.1.3 fail to properly validate post props which allows a malicious authenticated user to cause a crash via a malicious post.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-20088",
"url": "https://www.suse.com/security/cve/CVE-2025-20088"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-01-30T14:03:37Z",
"details": "moderate"
}
],
"title": "CVE-2025-20088"
},
{
"cve": "CVE-2025-20621",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-20621"
}
],
"notes": [
{
"category": "general",
"text": "Mattermost versions 10.2.x \u003c= 10.2.0, 9.11.x \u003c= 9.11.5, 10.0.x \u003c= 10.0.3, 10.1.x \u003c= 10.1.3 fail to properly handle posts with attachments containing fields that cannot be cast to a String, which allows an attacker to cause the webapp to crash via creating and sending such a post to a channel.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-20621",
"url": "https://www.suse.com/security/cve/CVE-2025-20621"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-01-30T14:03:37Z",
"details": "moderate"
}
],
"title": "CVE-2025-20621"
},
{
"cve": "CVE-2025-21088",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-21088"
}
],
"notes": [
{
"category": "general",
"text": "Mattermost versions 10.2.x \u003c= 10.2.0, 9.11.x \u003c= 9.11.5, 10.0.x \u003c= 10.0.3, 10.1.x \u003c= 10.1.3 fail to properly validate the style of proto supplied to an action\u0027s style in post.props.attachments, which allows an attacker to crash the frontend via crafted malicious input.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-21088",
"url": "https://www.suse.com/security/cve/CVE-2025-21088"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-01-30T14:03:37Z",
"details": "moderate"
}
],
"title": "CVE-2025-21088"
},
{
"cve": "CVE-2025-22149",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-22149"
}
],
"notes": [
{
"category": "general",
"text": "JWK Set (JSON Web Key Set) is a JWK and JWK Set Go implementation. Prior to 0.6.0, the project\u0027s provided HTTP client\u0027s local JWK Set cache should do a full replacement when the goroutine refreshes the remote JWK Set. The current behavior is to overwrite or append. This is a security issue for use cases that utilize the provided auto-caching HTTP client and where key removal from a JWK Set is equivalent to revocation. The affected auto-caching HTTP client was added in version v0.5.0 and fixed in v0.6.0. The only workaround would be to remove the provided auto-caching HTTP client and replace it with a custom implementation. This involves setting the HTTPClientStorageOptions.RefreshInterval to zero (or not specifying the value).",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-22149",
"url": "https://www.suse.com/security/cve/CVE-2025-22149"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-01-30T14:03:37Z",
"details": "low"
}
],
"title": "CVE-2025-22149"
},
{
"cve": "CVE-2025-22445",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-22445"
}
],
"notes": [
{
"category": "general",
"text": "Mattermost versions 10.x \u003c= 10.2 fail to accurately reflect missing settings, which allows confusion for admins regarding a Calls security-sensitive configuration via incorrect UI reporting.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-22445",
"url": "https://www.suse.com/security/cve/CVE-2025-22445"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-01-30T14:03:37Z",
"details": "low"
}
],
"title": "CVE-2025-22445"
},
{
"cve": "CVE-2025-22449",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-22449"
}
],
"notes": [
{
"category": "general",
"text": "Mattermost versions 9.11.x \u003c= 9.11.5 fail to enforce invite permissions, which allows team admins, with no permission to invite users to their team, to invite users by updating the \"allow_open_invite\" field via making their team public.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-22449",
"url": "https://www.suse.com/security/cve/CVE-2025-22449"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-01-30T14:03:37Z",
"details": "low"
}
],
"title": "CVE-2025-22449"
},
{
"cve": "CVE-2025-22865",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-22865"
}
],
"notes": [
{
"category": "general",
"text": "Using ParsePKCS1PrivateKey to parse a RSA key that is missing the CRT values would panic when verifying that the key is well formed.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-22865",
"url": "https://www.suse.com/security/cve/CVE-2025-22865"
},
{
"category": "external",
"summary": "SUSE Bug 1236361 for CVE-2025-22865",
"url": "https://bugzilla.suse.com/1236361"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-01-30T14:03:37Z",
"details": "important"
}
],
"title": "CVE-2025-22865"
},
{
"cve": "CVE-2025-23028",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-23028"
}
],
"notes": [
{
"category": "general",
"text": "Cilium is a networking, observability, and security solution with an eBPF-based dataplane. A denial of service vulnerability affects versions 1.14.0 through 1.14.7, 1.15.0 through 1.15.11, and 1.16.0 through 1.16.4. In a Kubernetes cluster where Cilium is configured to proxy DNS traffic, an attacker can crash Cilium agents by sending a crafted DNS response to workloads from outside the cluster. For traffic that is allowed but without using DNS-based policy, the dataplane will continue to pass traffic as configured at the time of the DoS. For workloads that have DNS-based policy configured, existing connections may continue to operate, and new connections made without relying on DNS resolution may continue to be established, but new connections which rely on DNS resolution may be disrupted. Any configuration changes that affect the impacted agent may not be applied until the agent is able to restart. This issue is fixed in Cilium v1.14.18, v1.15.12, and v1.16.5. No known workarounds are available.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-23028",
"url": "https://www.suse.com/security/cve/CVE-2025-23028"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-01-30T14:03:37Z",
"details": "moderate"
}
],
"title": "CVE-2025-23028"
},
{
"cve": "CVE-2025-23047",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-23047"
}
],
"notes": [
{
"category": "general",
"text": "Cilium is a networking, observability, and security solution with an eBPF-based dataplane. An insecure default `Access-Control-Allow-Origin` header value could lead to sensitive data exposure for users of Cilium versions 1.14.0 through 1.14.7, 1.15.0 through 1.15.11, and 1.16.0 through 1.16.4 who deploy Hubble UI using either Cilium CLI or via the Cilium Helm chart. A user with access to a Hubble UI instance affected by this issue could leak configuration details about the Kubernetes cluster which Hubble UI is monitoring, including node names, IP addresses, and other metadata about workloads and the cluster networking configuration. In order for this vulnerability to be exploited, a victim would have to first visit a malicious page. This issue is fixed in Cilium v1.14.18, v1.15.12, and v1.16.5. As a workaround, users who deploy Hubble UI using the Cilium Helm chart directly can remove the CORS headers from the Helm template as shown in the patch from commit a3489f190ba6e87b5336ee685fb6c80b1270d06d.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-23047",
"url": "https://www.suse.com/security/cve/CVE-2025-23047"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-01-30T14:03:37Z",
"details": "moderate"
}
],
"title": "CVE-2025-23047"
},
{
"cve": "CVE-2025-23208",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-23208"
}
],
"notes": [
{
"category": "general",
"text": "zot is a production-ready vendor-neutral OCI image registry. The group data stored for users in the boltdb database (meta.db) is an append-list so group revocations/removals are ignored in the API. SetUserGroups is alled on login, but instead of replacing the group memberships, they are appended. This may be due to some conflict with the group definitions in the config file, but that wasn\u0027t obvious to me if it were the case. Any Zot configuration that relies on group-based authorization will not respect group remove/revocation by an IdP. This issue has been addressed in version 2.1.2. All users are advised to upgrade. There are no known workarounds for this vulnerability.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-23208",
"url": "https://www.suse.com/security/cve/CVE-2025-23208"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-01-30T14:03:37Z",
"details": "important"
}
],
"title": "CVE-2025-23208"
},
{
"cve": "CVE-2025-24030",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-24030"
}
],
"notes": [
{
"category": "general",
"text": "Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. A user with access to the Kubernetes cluster can use a path traversal attack to execute Envoy Admin interface commands on proxies managed by any version of Envoy Gateway prior to 1.2.6. The admin interface can be used to terminate the Envoy process and extract the Envoy configuration (possibly containing confidential data). Version 1.2.6 fixes the issue. As a workaround, the `EnvoyProxy` API can be used to apply a bootstrap config patch that restricts access strictly to the prometheus stats endpoint. Find below an example of such a bootstrap patch.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-24030",
"url": "https://www.suse.com/security/cve/CVE-2025-24030"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-01-30T14:03:37Z",
"details": "important"
}
],
"title": "CVE-2025-24030"
},
{
"cve": "CVE-2025-24337",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-24337"
}
],
"notes": [
{
"category": "general",
"text": "WriteFreely through 0.15.1, when MySQL is used, allows local users to discover credentials by reading config.ini.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-24337",
"url": "https://www.suse.com/security/cve/CVE-2025-24337"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-01-30T14:03:37Z",
"details": "important"
}
],
"title": "CVE-2025-24337"
},
{
"cve": "CVE-2025-24354",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-24354"
}
],
"notes": [
{
"category": "general",
"text": "imgproxy is server for resizing, processing, and converting images. Imgproxy does not block the 0.0.0.0 address, even with IMGPROXY_ALLOW_LOOPBACK_SOURCE_ADDRESSES set to false. This can expose services on the local host. This vulnerability is fixed in 3.27.2.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-24354",
"url": "https://www.suse.com/security/cve/CVE-2025-24354"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-01-30T14:03:37Z",
"details": "moderate"
}
],
"title": "CVE-2025-24354"
},
{
"cve": "CVE-2025-24355",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-24355"
}
],
"notes": [
{
"category": "general",
"text": "Updatecli is a tool used to apply file update strategies. Prior to version 0.93.0, private maven repository credentials may be leaked in application logs in case of unsuccessful retrieval operation. During the execution of an updatecli pipeline which contains a `maven` source configured with basic auth credentials, the credentials are being leaked in the application execution logs in case of failure. Credentials are properly sanitized when the operation is successful but not when for whatever reason there is a failure in the maven repository, e.g. wrong coordinates provided, not existing artifact or version. Version 0.93.0 contains a patch for the issue.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-24355",
"url": "https://www.suse.com/security/cve/CVE-2025-24355"
},
{
"category": "external",
"summary": "SUSE Bug 1236404 for CVE-2025-24355",
"url": "https://bugzilla.suse.com/1236404"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-01-30T14:03:37Z",
"details": "important"
}
],
"title": "CVE-2025-24355"
}
]
}
SUSE-SU-2025:0429-1
Vulnerability from csaf_suse - Published: 2025-02-11 14:12 - Updated: 2025-02-11 14:12Summary
Security update for govulncheck-vulndb
Severity
Moderate
Notes
Title of the patch: Security update for govulncheck-vulndb
Description of the patch: This update for govulncheck-vulndb fixes the following issues:
- Update to version 0.0.20250207T224745 2025-02-07T22:47:45Z.
Refs jsc#PED-11136
Go CVE Numbering Authority IDs added or updated with aliases:
* GO-2025-3456 CVE-2025-24786 GHSA-9r4c-jwx3-3j76
* GO-2025-3457 CVE-2025-24787 GHSA-c7w4-9wv8-7x7c
* GO-2025-3458 CVE-2025-24366 GHSA-vj7w-3m8c-6vpx
- Update to version 0.0.20250206T175003 2025-02-06T17:50:03Z.
Refs jsc#PED-11136
Go CVE Numbering Authority IDs added or updated with aliases:
* GO-2023-1867 CVE-2022-47930 GHSA-c58h-qv6g-fw74
* GO-2024-3244 CVE-2024-50354 GHSA-cph5-3pgr-c82g
- Update to version 0.0.20250206T165438 2025-02-06T16:54:38Z.
Refs jsc#PED-11136
Go CVE Numbering Authority IDs added or updated with aliases:
* GO-2025-3428 CVE-2025-22867
* GO-2025-3447 CVE-2025-22866
- Update to version 0.0.20250205T232745 2025-02-05T23:27:45Z.
Refs jsc#PED-11136
Go CVE Numbering Authority IDs added or updated with aliases:
* GO-2025-3408
* GO-2025-3448 GHSA-23qp-3c2m-xx6w
* GO-2025-3449 GHSA-mx2j-7cmv-353c
* GO-2025-3450 GHSA-w7wm-2425-7p2h
* GO-2025-3454 GHSA-mj4v-hp69-27x5
* GO-2025-3455 GHSA-vqv5-385r-2hf8
- Update to version 0.0.20250205T003520 2025-02-05T00:35:20Z.
Refs jsc#PED-11136
Go CVE Numbering Authority IDs added or updated with aliases:
* GO-2025-3451
- Update to version 0.0.20250204T220613 2025-02-04T22:06:13Z.
Refs jsc#PED-11136
Go CVE Numbering Authority IDs added or updated with aliases:
* GO-2025-3431 CVE-2025-24884 GHSA-hcr5-wv4p-h2g2
* GO-2025-3433 CVE-2025-23216 GHSA-47g2-qmh2-749v
* GO-2025-3434 CVE-2025-24376 GHSA-fc89-jghx-8pvg
* GO-2025-3435 CVE-2025-24784 GHSA-756x-m4mj-q96c
* GO-2025-3436 CVE-2025-24883 GHSA-q26p-9cq4-7fc2
* GO-2025-3437 GHSA-274v-mgcv-cm8j
* GO-2025-3438 CVE-2024-11741 GHSA-wxcc-2f3q-4h58
* GO-2025-3442 CVE-2025-24371 GHSA-22qq-3xwm-r5x4
* GO-2025-3443 GHSA-r3r4-g7hq-pq4f
* GO-2025-3444 CVE-2024-35177
* GO-2025-3445 CVE-2024-47770
- Use standard RPM macros to unpack the source and populate a
working directory. Fixes build with RPM 4.20.
- Update to version 0.0.20250130T185858 2025-01-30T18:58:58Z.
Refs jsc#PED-11136
Go CVE Numbering Authority IDs added or updated with aliases:
* GO-2024-2842 CVE-2024-3727 GHSA-6wvf-f2vw-3425
* GO-2024-3181 CVE-2024-9313 GHSA-x5q3-c8rm-w787
* GO-2024-3188 CVE-2024-9312 GHSA-4gfw-wf7c-w6g2
* GO-2025-3372 CVE-2024-45339 GHSA-6wxm-mpqj-6jpf
* GO-2025-3373 CVE-2024-45341
* GO-2025-3383 CVE-2024-45340
* GO-2025-3408
* GO-2025-3412 CVE-2024-10846 GHSA-36gq-35j3-p9r9
* GO-2025-3420 CVE-2024-45336
* GO-2025-3421 CVE-2025-22865
* GO-2025-3424 CVE-2025-24369
* GO-2025-3426 CVE-2025-0750 GHSA-hp5j-2585-qx6g
* GO-2025-3427 CVE-2024-13484 GHSA-58fx-7v9q-3g56
Patchnames: SUSE-2025-429,SUSE-SLE-Module-Packagehub-Subpackages-15-SP6-2025-429,openSUSE-SLE-15.6-2025-429
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
6.8 (Medium)
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch | — |
Vendor Fix
|
Threats
Impact
moderate
6.5 (Medium)
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch | — |
Vendor Fix
|
Threats
Impact
moderate
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch | — |
Vendor Fix
|
Threats
Impact
low
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch | — |
Vendor Fix
|
Threats
Impact
important
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch | — |
Vendor Fix
|
Threats
Impact
important
8.3 (High)
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch | — |
Vendor Fix
|
Threats
Impact
important
5.9 (Medium)
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch | — |
Vendor Fix
|
Threats
Impact
moderate
7.1 (High)
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch | — |
Vendor Fix
|
Threats
Impact
important
7.7 (High)
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch | — |
Vendor Fix
|
Threats
Impact
important
4.2 (Medium)
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch | — |
Vendor Fix
|
Threats
Impact
moderate
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch | — |
Vendor Fix
|
Threats
Impact
moderate
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch | — |
Vendor Fix
|
Threats
Impact
moderate
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch | — |
Vendor Fix
|
Threats
Impact
important
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch | — |
Vendor Fix
|
Threats
Impact
important
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch | — |
Vendor Fix
|
Threats
Impact
moderate
7.5 (High)
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch | — |
Vendor Fix
|
Threats
Impact
important
5.3 (Medium)
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch | — |
Vendor Fix
|
Threats
Impact
moderate
6.8 (Medium)
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch | — |
Vendor Fix
|
Threats
Impact
moderate
6.8 (Medium)
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch | — |
Vendor Fix
|
Threats
Impact
moderate
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch | — |
Vendor Fix
|
Threats
Impact
important
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch | — |
Vendor Fix
|
Threats
Impact
low
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch | — |
Vendor Fix
|
Threats
Impact
important
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch | — |
Vendor Fix
|
Threats
Impact
moderate
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch | — |
Vendor Fix
|
Threats
Impact
moderate
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch | — |
Vendor Fix
|
Threats
Impact
critical
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch | — |
Vendor Fix
|
Threats
Impact
important
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch | — |
Vendor Fix
|
Threats
Impact
important
Affected products
Recommended
2 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch | — |
Vendor Fix
|
Threats
Impact
moderate
References
72 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for govulncheck-vulndb",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for govulncheck-vulndb fixes the following issues:\n\n- Update to version 0.0.20250207T224745 2025-02-07T22:47:45Z.\n Refs jsc#PED-11136\n Go CVE Numbering Authority IDs added or updated with aliases:\n * GO-2025-3456 CVE-2025-24786 GHSA-9r4c-jwx3-3j76\n * GO-2025-3457 CVE-2025-24787 GHSA-c7w4-9wv8-7x7c\n * GO-2025-3458 CVE-2025-24366 GHSA-vj7w-3m8c-6vpx\n\n- Update to version 0.0.20250206T175003 2025-02-06T17:50:03Z.\n Refs jsc#PED-11136\n Go CVE Numbering Authority IDs added or updated with aliases:\n * GO-2023-1867 CVE-2022-47930 GHSA-c58h-qv6g-fw74\n * GO-2024-3244 CVE-2024-50354 GHSA-cph5-3pgr-c82g\n\n- Update to version 0.0.20250206T165438 2025-02-06T16:54:38Z.\n Refs jsc#PED-11136\n Go CVE Numbering Authority IDs added or updated with aliases:\n * GO-2025-3428 CVE-2025-22867\n * GO-2025-3447 CVE-2025-22866\n\n- Update to version 0.0.20250205T232745 2025-02-05T23:27:45Z.\n Refs jsc#PED-11136\n Go CVE Numbering Authority IDs added or updated with aliases:\n * GO-2025-3408\n * GO-2025-3448 GHSA-23qp-3c2m-xx6w\n * GO-2025-3449 GHSA-mx2j-7cmv-353c\n * GO-2025-3450 GHSA-w7wm-2425-7p2h\n * GO-2025-3454 GHSA-mj4v-hp69-27x5\n * GO-2025-3455 GHSA-vqv5-385r-2hf8\n\n- Update to version 0.0.20250205T003520 2025-02-05T00:35:20Z.\n Refs jsc#PED-11136\n Go CVE Numbering Authority IDs added or updated with aliases:\n * GO-2025-3451\n\n- Update to version 0.0.20250204T220613 2025-02-04T22:06:13Z.\n Refs jsc#PED-11136\n Go CVE Numbering Authority IDs added or updated with aliases:\n * GO-2025-3431 CVE-2025-24884 GHSA-hcr5-wv4p-h2g2\n * GO-2025-3433 CVE-2025-23216 GHSA-47g2-qmh2-749v\n * GO-2025-3434 CVE-2025-24376 GHSA-fc89-jghx-8pvg\n * GO-2025-3435 CVE-2025-24784 GHSA-756x-m4mj-q96c\n * GO-2025-3436 CVE-2025-24883 GHSA-q26p-9cq4-7fc2\n * GO-2025-3437 GHSA-274v-mgcv-cm8j\n * GO-2025-3438 CVE-2024-11741 GHSA-wxcc-2f3q-4h58\n * GO-2025-3442 CVE-2025-24371 GHSA-22qq-3xwm-r5x4\n * GO-2025-3443 GHSA-r3r4-g7hq-pq4f\n * GO-2025-3444 CVE-2024-35177\n * GO-2025-3445 CVE-2024-47770\n\n- Use standard RPM macros to unpack the source and populate a\n working directory. Fixes build with RPM 4.20.\n\n- Update to version 0.0.20250130T185858 2025-01-30T18:58:58Z.\n Refs jsc#PED-11136\n Go CVE Numbering Authority IDs added or updated with aliases:\n * GO-2024-2842 CVE-2024-3727 GHSA-6wvf-f2vw-3425\n * GO-2024-3181 CVE-2024-9313 GHSA-x5q3-c8rm-w787\n * GO-2024-3188 CVE-2024-9312 GHSA-4gfw-wf7c-w6g2\n * GO-2025-3372 CVE-2024-45339 GHSA-6wxm-mpqj-6jpf\n * GO-2025-3373 CVE-2024-45341\n * GO-2025-3383 CVE-2024-45340\n * GO-2025-3408\n * GO-2025-3412 CVE-2024-10846 GHSA-36gq-35j3-p9r9\n * GO-2025-3420 CVE-2024-45336\n * GO-2025-3421 CVE-2025-22865\n * GO-2025-3424 CVE-2025-24369\n * GO-2025-3426 CVE-2025-0750 GHSA-hp5j-2585-qx6g\n * GO-2025-3427 CVE-2024-13484 GHSA-58fx-7v9q-3g56\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-2025-429,SUSE-SLE-Module-Packagehub-Subpackages-15-SP6-2025-429,openSUSE-SLE-15.6-2025-429",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2025_0429-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2025:0429-1",
"url": "https://www.suse.com/support/update/announcement/2025/suse-su-20250429-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2025:0429-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2025-February/020315.html"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2022-47930 page",
"url": "https://www.suse.com/security/cve/CVE-2022-47930/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-10846 page",
"url": "https://www.suse.com/security/cve/CVE-2024-10846/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-11741 page",
"url": "https://www.suse.com/security/cve/CVE-2024-11741/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-13484 page",
"url": "https://www.suse.com/security/cve/CVE-2024-13484/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-35177 page",
"url": "https://www.suse.com/security/cve/CVE-2024-35177/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-3727 page",
"url": "https://www.suse.com/security/cve/CVE-2024-3727/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-45336 page",
"url": "https://www.suse.com/security/cve/CVE-2024-45336/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-45339 page",
"url": "https://www.suse.com/security/cve/CVE-2024-45339/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-45340 page",
"url": "https://www.suse.com/security/cve/CVE-2024-45340/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-45341 page",
"url": "https://www.suse.com/security/cve/CVE-2024-45341/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-47770 page",
"url": "https://www.suse.com/security/cve/CVE-2024-47770/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-50354 page",
"url": "https://www.suse.com/security/cve/CVE-2024-50354/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-9312 page",
"url": "https://www.suse.com/security/cve/CVE-2024-9312/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-9313 page",
"url": "https://www.suse.com/security/cve/CVE-2024-9313/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-0750 page",
"url": "https://www.suse.com/security/cve/CVE-2025-0750/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-22865 page",
"url": "https://www.suse.com/security/cve/CVE-2025-22865/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-22866 page",
"url": "https://www.suse.com/security/cve/CVE-2025-22866/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-22867 page",
"url": "https://www.suse.com/security/cve/CVE-2025-22867/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-23216 page",
"url": "https://www.suse.com/security/cve/CVE-2025-23216/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-24366 page",
"url": "https://www.suse.com/security/cve/CVE-2025-24366/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-24369 page",
"url": "https://www.suse.com/security/cve/CVE-2025-24369/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-24371 page",
"url": "https://www.suse.com/security/cve/CVE-2025-24371/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-24376 page",
"url": "https://www.suse.com/security/cve/CVE-2025-24376/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-24784 page",
"url": "https://www.suse.com/security/cve/CVE-2025-24784/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-24786 page",
"url": "https://www.suse.com/security/cve/CVE-2025-24786/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-24787 page",
"url": "https://www.suse.com/security/cve/CVE-2025-24787/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-24883 page",
"url": "https://www.suse.com/security/cve/CVE-2025-24883/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-24884 page",
"url": "https://www.suse.com/security/cve/CVE-2025-24884/"
}
],
"title": "Security update for govulncheck-vulndb",
"tracking": {
"current_release_date": "2025-02-11T14:12:30Z",
"generator": {
"date": "2025-02-11T14:12:30Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2025:0429-1",
"initial_release_date": "2025-02-11T14:12:30Z",
"revision_history": [
{
"date": "2025-02-11T14:12:30Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch",
"product": {
"name": "govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch",
"product_id": "govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch"
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Module for Package Hub 15 SP6",
"product": {
"name": "SUSE Linux Enterprise Module for Package Hub 15 SP6",
"product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP6",
"product_identification_helper": {
"cpe": "cpe:/o:suse:packagehub:15:sp6"
}
}
},
{
"category": "product_name",
"name": "openSUSE Leap 15.6",
"product": {
"name": "openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:leap:15.6"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch as component of SUSE Linux Enterprise Module for Package Hub 15 SP6",
"product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch"
},
"product_reference": "govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch"
},
"product_reference": "govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch",
"relates_to_product_reference": "openSUSE Leap 15.6"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2022-47930",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2022-47930"
}
],
"notes": [
{
"category": "general",
"text": "An issue was discovered in IO FinNet tss-lib before 2.0.0. The parameter ssid for defining a session id is not used through the MPC implementation, which makes replaying and spoofing of messages easier. In particular, the Schnorr proof of knowledge implemented in sch.go does not utilize a session id, context, or random nonce in the generation of the challenge. This could allow a malicious user or an eavesdropper to replay a valid proof sent in the past.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2022-47930",
"url": "https://www.suse.com/security/cve/CVE-2022-47930"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-02-11T14:12:30Z",
"details": "moderate"
}
],
"title": "CVE-2022-47930"
},
{
"cve": "CVE-2024-10846",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-10846"
}
],
"notes": [
{
"category": "general",
"text": "The compose-go library component in versions v2.10-v2.4.0 allows an authorized user who sends malicious YAML payloads to cause the compose-go to consume excessive amount of Memory and CPU cycles while parsing YAML, such as used by Docker Compose from versions v2.27.0 to v2.29.7 included",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-10846",
"url": "https://www.suse.com/security/cve/CVE-2024-10846"
},
{
"category": "external",
"summary": "SUSE Bug 1236335 for CVE-2024-10846",
"url": "https://bugzilla.suse.com/1236335"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-02-11T14:12:30Z",
"details": "moderate"
}
],
"title": "CVE-2024-10846"
},
{
"cve": "CVE-2024-11741",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-11741"
}
],
"notes": [
{
"category": "general",
"text": "Grafana is an open-source platform for monitoring and observability. \nThe Grafana Alerting VictorOps integration was not properly protected and could be exposed to users with Viewer permission. \nFixed in versions 11.5.0, 11.4.1, 11.3.3, 11.2.6, 11.1.11, 11.0.11 and 10.4.15",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-11741",
"url": "https://www.suse.com/security/cve/CVE-2024-11741"
},
{
"category": "external",
"summary": "SUSE Bug 1236734 for CVE-2024-11741",
"url": "https://bugzilla.suse.com/1236734"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-02-11T14:12:30Z",
"details": "low"
}
],
"title": "CVE-2024-11741"
},
{
"cve": "CVE-2024-13484",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-13484"
}
],
"notes": [
{
"category": "general",
"text": "A flaw was found in openshift-gitops-operator-container. The openshift.io/cluster-monitoring label is applied to all namespaces that deploy an ArgoCD CR instance, allowing the namespace to create a rogue PrometheusRule. This issue can have adverse effects on the platform monitoring stack, as the rule is rolled out cluster-wide when the label is applied.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-13484",
"url": "https://www.suse.com/security/cve/CVE-2024-13484"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-02-11T14:12:30Z",
"details": "important"
}
],
"title": "CVE-2024-13484"
},
{
"cve": "CVE-2024-35177",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-35177"
}
],
"notes": [
{
"category": "general",
"text": "Wazuh is a free and open source platform used for threat prevention, detection, and response. It is capable of protecting workloads across on-premises, virtualized, containerized, and cloud-based environments. The wazuh-agent for Windows is vulnerable to a Local Privilege Escalation vulnerability due to improper ACL of the non-default installation directory. A local malicious user could potentially exploit this vulnerability by placing one of the many DLL that are loaded and not present on the system in the installation folder of the agent OR by replacing the service executable binary itself with a malicious one. The root cause is an improper ACL applied on the installation folder when a non-default installation path is specified (e.g,: C:\\wazuh). Many DLLs are loaded from the installation folder and by creating a malicious DLLs that exports the functions of a legit one (and that is not found on the system where the agent is installed, such as rsync.dll) it is possible to escalate privileges from a low-privileged user and obtain code execution under the context of NT AUTHORITY\\SYSTEM. This issue has been addressed in version 4.9.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-35177",
"url": "https://www.suse.com/security/cve/CVE-2024-35177"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-02-11T14:12:30Z",
"details": "important"
}
],
"title": "CVE-2024-35177"
},
{
"cve": "CVE-2024-3727",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-3727"
}
],
"notes": [
{
"category": "general",
"text": "A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-3727",
"url": "https://www.suse.com/security/cve/CVE-2024-3727"
},
{
"category": "external",
"summary": "SUSE Bug 1224112 for CVE-2024-3727",
"url": "https://bugzilla.suse.com/1224112"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-02-11T14:12:30Z",
"details": "important"
}
],
"title": "CVE-2024-3727"
},
{
"cve": "CVE-2024-45336",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-45336"
}
],
"notes": [
{
"category": "general",
"text": "The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header which is redirected to b.com/ will not send that header to b.com. In the event that the client received a subsequent same-domain redirect, however, the sensitive headers would be restored. For example, a chain of redirects from a.com/, to b.com/1, and finally to b.com/2 would incorrectly send the Authorization header to b.com/2.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-45336",
"url": "https://www.suse.com/security/cve/CVE-2024-45336"
},
{
"category": "external",
"summary": "SUSE Bug 1236045 for CVE-2024-45336",
"url": "https://bugzilla.suse.com/1236045"
},
{
"category": "external",
"summary": "SUSE Bug 1236046 for CVE-2024-45336",
"url": "https://bugzilla.suse.com/1236046"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-02-11T14:12:30Z",
"details": "moderate"
}
],
"title": "CVE-2024-45336"
},
{
"cve": "CVE-2024-45339",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-45339"
}
],
"notes": [
{
"category": "general",
"text": "When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process\u0027s log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix that, glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-45339",
"url": "https://www.suse.com/security/cve/CVE-2024-45339"
},
{
"category": "external",
"summary": "SUSE Bug 1236541 for CVE-2024-45339",
"url": "https://bugzilla.suse.com/1236541"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-02-11T14:12:30Z",
"details": "important"
}
],
"title": "CVE-2024-45339"
},
{
"cve": "CVE-2024-45340",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-45340"
}
],
"notes": [
{
"category": "general",
"text": "Credentials provided via the new GOAUTH feature were not being properly segmented by domain, allowing a malicious server to request credentials they should not have access to. By default, unless otherwise set, this only affected credentials stored in the users .netrc file.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-45340",
"url": "https://www.suse.com/security/cve/CVE-2024-45340"
},
{
"category": "external",
"summary": "SUSE Bug 1236360 for CVE-2024-45340",
"url": "https://bugzilla.suse.com/1236360"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-02-11T14:12:30Z",
"details": "important"
}
],
"title": "CVE-2024-45340"
},
{
"cve": "CVE-2024-45341",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-45341"
}
],
"notes": [
{
"category": "general",
"text": "A certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain. Certificates containing URIs are not permitted in the web PKI, so this only affects users of private PKIs which make use of URIs.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-45341",
"url": "https://www.suse.com/security/cve/CVE-2024-45341"
},
{
"category": "external",
"summary": "SUSE Bug 1236045 for CVE-2024-45341",
"url": "https://bugzilla.suse.com/1236045"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.2,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-02-11T14:12:30Z",
"details": "moderate"
}
],
"title": "CVE-2024-45341"
},
{
"cve": "CVE-2024-47770",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-47770"
}
],
"notes": [
{
"category": "general",
"text": "Wazuh is a free and open source platform used for threat prevention, detection, and response. It is capable of protecting workloads across on-premises, virtualized, containerized, and cloud-based environments. This vulnerability occurs when the system has weak privilege access, that allows an attacker to do privilege escalation. In this case the attacker is able to view agent list on Wazuh dashboard with no privilege access. This issue has been addressed in release version 4.9.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-47770",
"url": "https://www.suse.com/security/cve/CVE-2024-47770"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-02-11T14:12:30Z",
"details": "moderate"
}
],
"title": "CVE-2024-47770"
},
{
"cve": "CVE-2024-50354",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-50354"
}
],
"notes": [
{
"category": "general",
"text": "gnark is a fast zk-SNARK library that offers a high-level API to design circuits. In gnark 0.11.0 and earlier, deserialization of Groth16 verification keys allocate excessive memory, consuming a lot of resources and triggering a crash with the error fatal error: runtime: out of memory.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-50354",
"url": "https://www.suse.com/security/cve/CVE-2024-50354"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-02-11T14:12:30Z",
"details": "moderate"
}
],
"title": "CVE-2024-50354"
},
{
"cve": "CVE-2024-9312",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-9312"
}
],
"notes": [
{
"category": "general",
"text": "Authd, through version 0.3.6, did not sufficiently randomize user IDs to prevent collisions. A local attacker who can register user names could spoof another user\u0027s ID and gain their privileges.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-9312",
"url": "https://www.suse.com/security/cve/CVE-2024-9312"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-02-11T14:12:30Z",
"details": "important"
}
],
"title": "CVE-2024-9312"
},
{
"cve": "CVE-2024-9313",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-9313"
}
],
"notes": [
{
"category": "general",
"text": "Authd PAM module before version 0.3.5 can allow broker-managed users to impersonate any other user managed by the same broker and perform any PAM operation with it, including authenticating as them.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-9313",
"url": "https://www.suse.com/security/cve/CVE-2024-9313"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-02-11T14:12:30Z",
"details": "important"
}
],
"title": "CVE-2024-9313"
},
{
"cve": "CVE-2025-0750",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-0750"
}
],
"notes": [
{
"category": "general",
"text": "A vulnerability was found in CRI-O. A path traversal issue in the log management functions (UnMountPodLogs and LinkContainerLogs) may allow an attacker with permissions to create and delete Pods to unmount arbitrary host paths, leading to node-level denial of service by unmounting critical system directories.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-0750",
"url": "https://www.suse.com/security/cve/CVE-2025-0750"
},
{
"category": "external",
"summary": "SUSE Bug 1236479 for CVE-2025-0750",
"url": "https://bugzilla.suse.com/1236479"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-02-11T14:12:30Z",
"details": "moderate"
}
],
"title": "CVE-2025-0750"
},
{
"cve": "CVE-2025-22865",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-22865"
}
],
"notes": [
{
"category": "general",
"text": "Using ParsePKCS1PrivateKey to parse a RSA key that is missing the CRT values would panic when verifying that the key is well formed.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-22865",
"url": "https://www.suse.com/security/cve/CVE-2025-22865"
},
{
"category": "external",
"summary": "SUSE Bug 1236361 for CVE-2025-22865",
"url": "https://bugzilla.suse.com/1236361"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-02-11T14:12:30Z",
"details": "important"
}
],
"title": "CVE-2025-22865"
},
{
"cve": "CVE-2025-22866",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-22866"
}
],
"notes": [
{
"category": "general",
"text": "Due to the usage of a variable time instruction in the assembly implementation of an internal function, a small number of bits of secret scalars are leaked on the ppc64le architecture. Due to the way this function is used, we do not believe this leakage is enough to allow recovery of the private key when P-256 is used in any well known protocols.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-22866",
"url": "https://www.suse.com/security/cve/CVE-2025-22866"
},
{
"category": "external",
"summary": "SUSE Bug 1236801 for CVE-2025-22866",
"url": "https://bugzilla.suse.com/1236801"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-02-11T14:12:30Z",
"details": "moderate"
}
],
"title": "CVE-2025-22866"
},
{
"cve": "CVE-2025-22867",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-22867"
}
],
"notes": [
{
"category": "general",
"text": "On Darwin, building a Go module which contains CGO can trigger arbitrary code execution when using the Apple version of ld, due to usage of the @executable_path, @loader_path, or @rpath special values in a \"#cgo LDFLAGS\" directive. This issue only affected go1.24rc2.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-22867",
"url": "https://www.suse.com/security/cve/CVE-2025-22867"
},
{
"category": "external",
"summary": "SUSE Bug 1236839 for CVE-2025-22867",
"url": "https://bugzilla.suse.com/1236839"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-02-11T14:12:30Z",
"details": "moderate"
}
],
"title": "CVE-2025-22867"
},
{
"cve": "CVE-2025-23216",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-23216"
}
],
"notes": [
{
"category": "general",
"text": "Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. A vulnerability was discovered in Argo CD that exposed secret values in error messages and the diff view when an invalid Kubernetes Secret resource was synced from a repository. The vulnerability assumes the user has write access to the repository and can exploit it, either intentionally or unintentionally, by committing an invalid Secret to repository and triggering a Sync. Once exploited, any user with read access to Argo CD can view the exposed secret data. The vulnerability is fixed in v2.13.4, v2.12.10, and v2.11.13.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-23216",
"url": "https://www.suse.com/security/cve/CVE-2025-23216"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-02-11T14:12:30Z",
"details": "moderate"
}
],
"title": "CVE-2025-23216"
},
{
"cve": "CVE-2025-24366",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-24366"
}
],
"notes": [
{
"category": "general",
"text": "SFTPGo is an open source, event-driven file transfer solution. SFTPGo supports execution of a defined set of commands via SSH. Besides a set of default commands some optional commands can be activated, one of them being `rsync`. It is disabled in the default configuration and it is limited to the local filesystem, it does not work with cloud/remote storage backends. Due to missing sanitization of the client provided `rsync` command, an authenticated remote user can use some options of the rsync command to read or write files with the permissions of the SFTPGo server process. This issue was fixed in version v2.6.5 by checking the client provided arguments. Users are advised to upgrade. There are no known workarounds for this vulnerability.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-24366",
"url": "https://www.suse.com/security/cve/CVE-2025-24366"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-02-11T14:12:30Z",
"details": "important"
}
],
"title": "CVE-2025-24366"
},
{
"cve": "CVE-2025-24369",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-24369"
}
],
"notes": [
{
"category": "general",
"text": "Anubis is a tool that allows administrators to protect bots against AI scrapers through bot-checking heuristics and a proof-of-work challenge to discourage scraping from multiple IP addresses. Anubis allows attackers to bypass the bot protection by requesting a challenge, formulates any nonce (such as 42069), and then passes the challenge with difficulty zero. Commit e09d0226a628f04b1d80fd83bee777894a45cd02 fixes this behavior by not using a client-specified difficulty value.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-24369",
"url": "https://www.suse.com/security/cve/CVE-2025-24369"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-02-11T14:12:30Z",
"details": "low"
}
],
"title": "CVE-2025-24369"
},
{
"cve": "CVE-2025-24371",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-24371"
}
],
"notes": [
{
"category": "general",
"text": "CometBFT is a distributed, Byzantine fault-tolerant, deterministic state machine replication engine. In the `blocksync` protocol peers send their `base` and `latest` heights when they connect to a new node (`A`), which is syncing to the tip of a network. `base` acts as a lower ground and informs `A` that the peer only has blocks starting from height `base`. `latest` height informs `A` about the latest block in a network. Normally, nodes would only report increasing heights. If `B` fails to provide the latest block, `B` is removed and the `latest` height (target height) is recalculated based on other nodes `latest` heights. The existing code however doesn\u0027t check for the case where `B` first reports `latest` height `X` and immediately after height `Y`, where `X \u003e Y`. `A` will be trying to catch up to 2000 indefinitely. This condition requires the introduction of malicious code in the full node first reporting some non-existing `latest` height, then reporting lower `latest` height and nodes which are syncing using `blocksync` protocol. This issue has been patched in versions 1.0.1 and 0.38.17 and all users are advised to upgrade. Operators may attempt to ban malicious peers from the network as a workaround.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-24371",
"url": "https://www.suse.com/security/cve/CVE-2025-24371"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-02-11T14:12:30Z",
"details": "important"
}
],
"title": "CVE-2025-24371"
},
{
"cve": "CVE-2025-24376",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-24376"
}
],
"notes": [
{
"category": "general",
"text": "kubewarden-controller is a Kubernetes controller that allows you to dynamically register Kubewarden admission policies. By design, AdmissionPolicy and AdmissionPolicyGroup can evaluate only namespaced resources. The resources to be evaluated are determined by the rules provided by the user when defining the policy. There might be Kubernetes namespaced resources that should not be validated by AdmissionPolicy and by the AdmissionPolicyGroup policies because of their sensitive nature. For example, PolicyReport are namespaced resources that contain the list of non compliant objects found inside of a namespace. An attacker can use either an AdmissionPolicy or an AdmissionPolicyGroup to prevent the creation and update of PolicyReport objects to hide non-compliant resources. Moreover, the same attacker might use a mutating AdmissionPolicy to alter the contents of the PolicyReport created inside of the namespace. Starting from the 1.21.0 release, the validation rules applied to AdmissionPolicy and AdmissionPolicyGroup have been tightened to prevent them from validating sensitive types of namespaced resources.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-24376",
"url": "https://www.suse.com/security/cve/CVE-2025-24376"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-02-11T14:12:30Z",
"details": "moderate"
}
],
"title": "CVE-2025-24376"
},
{
"cve": "CVE-2025-24784",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-24784"
}
],
"notes": [
{
"category": "general",
"text": "kubewarden-controller is a Kubernetes controller that allows you to dynamically register Kubewarden admission policies. The policy group feature, added to by the 1.17.0 release. By being namespaced, the AdmissionPolicyGroup has a well constrained impact on cluster resources. Hence, it\u0027s considered safe to allow non-admin users to create and manage these resources in the namespaces they own. Kubewarden policies can be allowed to query the Kubernetes API at evaluation time; these types of policies are called \"context aware\". Context aware policies can perform list and get operations against a Kubernetes cluster. The queries are done using the ServiceAccount of the Policy Server instance that hosts the policy. That means that access to the cluster is determined by the RBAC rules that apply to that ServiceAccount. The AdmissionPolicyGroup CRD allowed the deployment of context aware policies. This could allow an attacker to obtain information about resources that are out of their reach, by leveraging a higher access to the cluster granted to the ServiceAccount token used to run the policy. The impact of this vulnerability depends on the privileges that have been granted to the ServiceAccount used to run the Policy Server and assumes that users are using the recommended best practices of keeping the Policy Server\u0027s ServiceAccount least privileged. By default, the Kubewarden helm chart grants access to the following resources (cluster wide) only: Namespace, Pod, Deployment and Ingress. This vulnerability is fixed in 1.21.0.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-24784",
"url": "https://www.suse.com/security/cve/CVE-2025-24784"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-02-11T14:12:30Z",
"details": "moderate"
}
],
"title": "CVE-2025-24784"
},
{
"cve": "CVE-2025-24786",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-24786"
}
],
"notes": [
{
"category": "general",
"text": "WhoDB is an open source database management tool. While the application only displays Sqlite3 databases present in the directory `/db`, there is no path traversal prevention in place. This allows an unauthenticated attacker to open any Sqlite3 database present on the host machine that the application is running on. Affected versions of WhoDB allow users to connect to Sqlite3 databases. By default, the databases must be present in `/db/` (or alternatively `./tmp/` if development mode is enabled). If no databases are present in the default directory, the UI indicates that the user is unable to open any databases. The database file is an user-controlled value. This value is used in `.Join()` with the default directory, in order to get the full path of the database file to open. No checks are performed whether the database file that is eventually opened actually resides in the default directory `/db`. This allows an attacker to use path traversal (`../../`) in order to open any Sqlite3 database present on the system. This issue has been addressed in version 0.45.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-24786",
"url": "https://www.suse.com/security/cve/CVE-2025-24786"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-02-11T14:12:30Z",
"details": "critical"
}
],
"title": "CVE-2025-24786"
},
{
"cve": "CVE-2025-24787",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-24787"
}
],
"notes": [
{
"category": "general",
"text": "WhoDB is an open source database management tool. In affected versions the application is vulnerable to parameter injection in database connection strings, which allows an attacker to read local files on the machine the application is running on. The application uses string concatenation to build database connection URIs which are then passed to corresponding libraries responsible for setting up the database connections. This string concatenation is done unsafely and without escaping or encoding the user input. This allows an user, in many cases, to inject arbitrary parameters into the URI string. These parameters can be potentially dangerous depending on the libraries used. One of these dangerous parameters is `allowAllFiles` in the library `github.com/go-sql-driver/mysql`. Should this be set to `true`, the library enables running the `LOAD DATA LOCAL INFILE` query on any file on the host machine (in this case, the machine that WhoDB is running on). By injecting `\u0026allowAllFiles=true` into the connection URI and connecting to any MySQL server (such as an attacker-controlled one), the attacker is able to read local files. This issue has been addressed in version 0.45.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-24787",
"url": "https://www.suse.com/security/cve/CVE-2025-24787"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-02-11T14:12:30Z",
"details": "important"
}
],
"title": "CVE-2025-24787"
},
{
"cve": "CVE-2025-24883",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-24883"
}
],
"notes": [
{
"category": "general",
"text": "go-ethereum (geth) is a golang execution layer implementation of the Ethereum protocol. A vulnerable node can be forced to shutdown/crash using a specially crafted message. This vulnerability is fixed in 1.14.13.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-24883",
"url": "https://www.suse.com/security/cve/CVE-2025-24883"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-02-11T14:12:30Z",
"details": "important"
}
],
"title": "CVE-2025-24883"
},
{
"cve": "CVE-2025-24884",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-24884"
}
],
"notes": [
{
"category": "general",
"text": "kube-audit-rest is a simple logger of mutation/creation requests to the k8s api. If the \"full-elastic-stack\" example vector configuration was used for a real cluster, the previous values of kubernetes secrets would have been disclosed in the audit messages. This vulnerability is fixed in 1.0.16.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-24884",
"url": "https://www.suse.com/security/cve/CVE-2025-24884"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch",
"openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250207T224745-150000.1.32.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-02-11T14:12:30Z",
"details": "moderate"
}
],
"title": "CVE-2025-24884"
}
]
}
SUSE-SU-2025:0580-1
Vulnerability from csaf_suse - Published: 2025-02-18 14:52 - Updated: 2025-02-18 14:52Summary
Security update for google-osconfig-agent
Severity
Important
Notes
Title of the patch: Security update for google-osconfig-agent
Description of the patch: This update for google-osconfig-agent fixes the following issues:
- CVE-2024-45339: github.com/golang/glog: a privileged process' log file path can be easily predicted and used to
overwrite other sensitive files in a system. (bsc#1236560)
Patchnames: SUSE-2025-580,SUSE-SLE-Module-Public-Cloud-12-2025-580
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
7.1 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Public Cloud 12:google-osconfig-agent-20250115.01-1.35.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Public Cloud 12:google-osconfig-agent-20250115.01-1.35.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Public Cloud 12:google-osconfig-agent-20250115.01-1.35.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Public Cloud 12:google-osconfig-agent-20250115.01-1.35.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
References
8 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for google-osconfig-agent",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for google-osconfig-agent fixes the following issues:\n\n- CVE-2024-45339: github.com/golang/glog: a privileged process\u0027 log file path can be easily predicted and used to\n overwrite other sensitive files in a system. (bsc#1236560)\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-2025-580,SUSE-SLE-Module-Public-Cloud-12-2025-580",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2025_0580-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2025:0580-1",
"url": "https://www.suse.com/support/update/announcement/2025/suse-su-20250580-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2025:0580-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2025-February/020367.html"
},
{
"category": "self",
"summary": "SUSE Bug 1236560",
"url": "https://bugzilla.suse.com/1236560"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-45339 page",
"url": "https://www.suse.com/security/cve/CVE-2024-45339/"
}
],
"title": "Security update for google-osconfig-agent",
"tracking": {
"current_release_date": "2025-02-18T14:52:43Z",
"generator": {
"date": "2025-02-18T14:52:43Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2025:0580-1",
"initial_release_date": "2025-02-18T14:52:43Z",
"revision_history": [
{
"date": "2025-02-18T14:52:43Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "google-osconfig-agent-20250115.01-1.35.1.aarch64",
"product": {
"name": "google-osconfig-agent-20250115.01-1.35.1.aarch64",
"product_id": "google-osconfig-agent-20250115.01-1.35.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "google-osconfig-agent-20250115.01-1.35.1.i586",
"product": {
"name": "google-osconfig-agent-20250115.01-1.35.1.i586",
"product_id": "google-osconfig-agent-20250115.01-1.35.1.i586"
}
}
],
"category": "architecture",
"name": "i586"
},
{
"branches": [
{
"category": "product_version",
"name": "google-osconfig-agent-20250115.01-1.35.1.ppc64le",
"product": {
"name": "google-osconfig-agent-20250115.01-1.35.1.ppc64le",
"product_id": "google-osconfig-agent-20250115.01-1.35.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "google-osconfig-agent-20250115.01-1.35.1.s390x",
"product": {
"name": "google-osconfig-agent-20250115.01-1.35.1.s390x",
"product_id": "google-osconfig-agent-20250115.01-1.35.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "google-osconfig-agent-20250115.01-1.35.1.x86_64",
"product": {
"name": "google-osconfig-agent-20250115.01-1.35.1.x86_64",
"product_id": "google-osconfig-agent-20250115.01-1.35.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Module for Public Cloud 12",
"product": {
"name": "SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Module for Public Cloud 12",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle-module-public-cloud:12"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "google-osconfig-agent-20250115.01-1.35.1.aarch64 as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Module for Public Cloud 12:google-osconfig-agent-20250115.01-1.35.1.aarch64"
},
"product_reference": "google-osconfig-agent-20250115.01-1.35.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Public Cloud 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-osconfig-agent-20250115.01-1.35.1.ppc64le as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Module for Public Cloud 12:google-osconfig-agent-20250115.01-1.35.1.ppc64le"
},
"product_reference": "google-osconfig-agent-20250115.01-1.35.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Public Cloud 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-osconfig-agent-20250115.01-1.35.1.s390x as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Module for Public Cloud 12:google-osconfig-agent-20250115.01-1.35.1.s390x"
},
"product_reference": "google-osconfig-agent-20250115.01-1.35.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Public Cloud 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-osconfig-agent-20250115.01-1.35.1.x86_64 as component of SUSE Linux Enterprise Module for Public Cloud 12",
"product_id": "SUSE Linux Enterprise Module for Public Cloud 12:google-osconfig-agent-20250115.01-1.35.1.x86_64"
},
"product_reference": "google-osconfig-agent-20250115.01-1.35.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Public Cloud 12"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-45339",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-45339"
}
],
"notes": [
{
"category": "general",
"text": "When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process\u0027s log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix that, glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Public Cloud 12:google-osconfig-agent-20250115.01-1.35.1.aarch64",
"SUSE Linux Enterprise Module for Public Cloud 12:google-osconfig-agent-20250115.01-1.35.1.ppc64le",
"SUSE Linux Enterprise Module for Public Cloud 12:google-osconfig-agent-20250115.01-1.35.1.s390x",
"SUSE Linux Enterprise Module for Public Cloud 12:google-osconfig-agent-20250115.01-1.35.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-45339",
"url": "https://www.suse.com/security/cve/CVE-2024-45339"
},
{
"category": "external",
"summary": "SUSE Bug 1236541 for CVE-2024-45339",
"url": "https://bugzilla.suse.com/1236541"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Public Cloud 12:google-osconfig-agent-20250115.01-1.35.1.aarch64",
"SUSE Linux Enterprise Module for Public Cloud 12:google-osconfig-agent-20250115.01-1.35.1.ppc64le",
"SUSE Linux Enterprise Module for Public Cloud 12:google-osconfig-agent-20250115.01-1.35.1.s390x",
"SUSE Linux Enterprise Module for Public Cloud 12:google-osconfig-agent-20250115.01-1.35.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Public Cloud 12:google-osconfig-agent-20250115.01-1.35.1.aarch64",
"SUSE Linux Enterprise Module for Public Cloud 12:google-osconfig-agent-20250115.01-1.35.1.ppc64le",
"SUSE Linux Enterprise Module for Public Cloud 12:google-osconfig-agent-20250115.01-1.35.1.s390x",
"SUSE Linux Enterprise Module for Public Cloud 12:google-osconfig-agent-20250115.01-1.35.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-02-18T14:52:43Z",
"details": "important"
}
],
"title": "CVE-2024-45339"
}
]
}
SUSE-SU-2025:0611-1
Vulnerability from csaf_suse - Published: 2025-02-21 10:37 - Updated: 2025-02-21 10:37Summary
Security update for google-osconfig-agent
Severity
Important
Notes
Title of the patch: Security update for google-osconfig-agent
Description of the patch: This update for google-osconfig-agent fixes the following issues:
- CVE-2024-45339: github.com/golang/glog: a privileged process' log file path can be easily predicted and used to
overwrite other sensitive files in a system. (bsc#1236560)
Patchnames: SUSE-2025-611,SUSE-SLE-Micro-5.5-2025-611,SUSE-SLE-Module-Public-Cloud-15-SP3-2025-611,SUSE-SLE-Module-Public-Cloud-15-SP4-2025-611,SUSE-SLE-Module-Public-Cloud-15-SP5-2025-611,SUSE-SLE-Module-Public-Cloud-15-SP6-2025-611,openSUSE-SLE-15.6-2025-611
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
7.1 (High)
Affected products
Recommended
24 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Micro 5.5:google-osconfig-agent-20250115.01-150000.1.44.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.5:google-osconfig-agent-20250115.01-150000.1.44.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.5:google-osconfig-agent-20250115.01-150000.1.44.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Micro 5.5:google-osconfig-agent-20250115.01-150000.1.44.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Public Cloud 15 SP3:google-osconfig-agent-20250115.01-150000.1.44.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Public Cloud 15 SP3:google-osconfig-agent-20250115.01-150000.1.44.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Public Cloud 15 SP3:google-osconfig-agent-20250115.01-150000.1.44.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Public Cloud 15 SP3:google-osconfig-agent-20250115.01-150000.1.44.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Public Cloud 15 SP4:google-osconfig-agent-20250115.01-150000.1.44.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Public Cloud 15 SP4:google-osconfig-agent-20250115.01-150000.1.44.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Public Cloud 15 SP4:google-osconfig-agent-20250115.01-150000.1.44.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Public Cloud 15 SP4:google-osconfig-agent-20250115.01-150000.1.44.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Public Cloud 15 SP5:google-osconfig-agent-20250115.01-150000.1.44.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Public Cloud 15 SP5:google-osconfig-agent-20250115.01-150000.1.44.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Public Cloud 15 SP5:google-osconfig-agent-20250115.01-150000.1.44.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Public Cloud 15 SP5:google-osconfig-agent-20250115.01-150000.1.44.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Public Cloud 15 SP6:google-osconfig-agent-20250115.01-150000.1.44.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Public Cloud 15 SP6:google-osconfig-agent-20250115.01-150000.1.44.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Public Cloud 15 SP6:google-osconfig-agent-20250115.01-150000.1.44.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Public Cloud 15 SP6:google-osconfig-agent-20250115.01-150000.1.44.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:google-osconfig-agent-20250115.01-150000.1.44.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:google-osconfig-agent-20250115.01-150000.1.44.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:google-osconfig-agent-20250115.01-150000.1.44.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:google-osconfig-agent-20250115.01-150000.1.44.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
References
8 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for google-osconfig-agent",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for google-osconfig-agent fixes the following issues:\n\n- CVE-2024-45339: github.com/golang/glog: a privileged process\u0027 log file path can be easily predicted and used to\n overwrite other sensitive files in a system. (bsc#1236560)\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-2025-611,SUSE-SLE-Micro-5.5-2025-611,SUSE-SLE-Module-Public-Cloud-15-SP3-2025-611,SUSE-SLE-Module-Public-Cloud-15-SP4-2025-611,SUSE-SLE-Module-Public-Cloud-15-SP5-2025-611,SUSE-SLE-Module-Public-Cloud-15-SP6-2025-611,openSUSE-SLE-15.6-2025-611",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2025_0611-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2025:0611-1",
"url": "https://www.suse.com/support/update/announcement/2025/suse-su-20250611-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2025:0611-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2025-February/020396.html"
},
{
"category": "self",
"summary": "SUSE Bug 1236560",
"url": "https://bugzilla.suse.com/1236560"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-45339 page",
"url": "https://www.suse.com/security/cve/CVE-2024-45339/"
}
],
"title": "Security update for google-osconfig-agent",
"tracking": {
"current_release_date": "2025-02-21T10:37:12Z",
"generator": {
"date": "2025-02-21T10:37:12Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2025:0611-1",
"initial_release_date": "2025-02-21T10:37:12Z",
"revision_history": [
{
"date": "2025-02-21T10:37:12Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "google-osconfig-agent-20250115.01-150000.1.44.1.aarch64",
"product": {
"name": "google-osconfig-agent-20250115.01-150000.1.44.1.aarch64",
"product_id": "google-osconfig-agent-20250115.01-150000.1.44.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "google-osconfig-agent-20250115.01-150000.1.44.1.i586",
"product": {
"name": "google-osconfig-agent-20250115.01-150000.1.44.1.i586",
"product_id": "google-osconfig-agent-20250115.01-150000.1.44.1.i586"
}
}
],
"category": "architecture",
"name": "i586"
},
{
"branches": [
{
"category": "product_version",
"name": "google-osconfig-agent-20250115.01-150000.1.44.1.ppc64le",
"product": {
"name": "google-osconfig-agent-20250115.01-150000.1.44.1.ppc64le",
"product_id": "google-osconfig-agent-20250115.01-150000.1.44.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "google-osconfig-agent-20250115.01-150000.1.44.1.s390x",
"product": {
"name": "google-osconfig-agent-20250115.01-150000.1.44.1.s390x",
"product_id": "google-osconfig-agent-20250115.01-150000.1.44.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "google-osconfig-agent-20250115.01-150000.1.44.1.x86_64",
"product": {
"name": "google-osconfig-agent-20250115.01-150000.1.44.1.x86_64",
"product_id": "google-osconfig-agent-20250115.01-150000.1.44.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Micro 5.5",
"product": {
"name": "SUSE Linux Enterprise Micro 5.5",
"product_id": "SUSE Linux Enterprise Micro 5.5",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle-micro:5.5"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Module for Public Cloud 15 SP3",
"product": {
"name": "SUSE Linux Enterprise Module for Public Cloud 15 SP3",
"product_id": "SUSE Linux Enterprise Module for Public Cloud 15 SP3",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle-module-public-cloud:15:sp3"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Module for Public Cloud 15 SP4",
"product": {
"name": "SUSE Linux Enterprise Module for Public Cloud 15 SP4",
"product_id": "SUSE Linux Enterprise Module for Public Cloud 15 SP4",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle-module-public-cloud:15:sp4"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Module for Public Cloud 15 SP5",
"product": {
"name": "SUSE Linux Enterprise Module for Public Cloud 15 SP5",
"product_id": "SUSE Linux Enterprise Module for Public Cloud 15 SP5",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle-module-public-cloud:15:sp5"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Module for Public Cloud 15 SP6",
"product": {
"name": "SUSE Linux Enterprise Module for Public Cloud 15 SP6",
"product_id": "SUSE Linux Enterprise Module for Public Cloud 15 SP6",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle-module-public-cloud:15:sp6"
}
}
},
{
"category": "product_name",
"name": "openSUSE Leap 15.6",
"product": {
"name": "openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:leap:15.6"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "google-osconfig-agent-20250115.01-150000.1.44.1.aarch64 as component of SUSE Linux Enterprise Micro 5.5",
"product_id": "SUSE Linux Enterprise Micro 5.5:google-osconfig-agent-20250115.01-150000.1.44.1.aarch64"
},
"product_reference": "google-osconfig-agent-20250115.01-150000.1.44.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-osconfig-agent-20250115.01-150000.1.44.1.ppc64le as component of SUSE Linux Enterprise Micro 5.5",
"product_id": "SUSE Linux Enterprise Micro 5.5:google-osconfig-agent-20250115.01-150000.1.44.1.ppc64le"
},
"product_reference": "google-osconfig-agent-20250115.01-150000.1.44.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-osconfig-agent-20250115.01-150000.1.44.1.s390x as component of SUSE Linux Enterprise Micro 5.5",
"product_id": "SUSE Linux Enterprise Micro 5.5:google-osconfig-agent-20250115.01-150000.1.44.1.s390x"
},
"product_reference": "google-osconfig-agent-20250115.01-150000.1.44.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-osconfig-agent-20250115.01-150000.1.44.1.x86_64 as component of SUSE Linux Enterprise Micro 5.5",
"product_id": "SUSE Linux Enterprise Micro 5.5:google-osconfig-agent-20250115.01-150000.1.44.1.x86_64"
},
"product_reference": "google-osconfig-agent-20250115.01-150000.1.44.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Micro 5.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-osconfig-agent-20250115.01-150000.1.44.1.aarch64 as component of SUSE Linux Enterprise Module for Public Cloud 15 SP3",
"product_id": "SUSE Linux Enterprise Module for Public Cloud 15 SP3:google-osconfig-agent-20250115.01-150000.1.44.1.aarch64"
},
"product_reference": "google-osconfig-agent-20250115.01-150000.1.44.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Public Cloud 15 SP3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-osconfig-agent-20250115.01-150000.1.44.1.ppc64le as component of SUSE Linux Enterprise Module for Public Cloud 15 SP3",
"product_id": "SUSE Linux Enterprise Module for Public Cloud 15 SP3:google-osconfig-agent-20250115.01-150000.1.44.1.ppc64le"
},
"product_reference": "google-osconfig-agent-20250115.01-150000.1.44.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Public Cloud 15 SP3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-osconfig-agent-20250115.01-150000.1.44.1.s390x as component of SUSE Linux Enterprise Module for Public Cloud 15 SP3",
"product_id": "SUSE Linux Enterprise Module for Public Cloud 15 SP3:google-osconfig-agent-20250115.01-150000.1.44.1.s390x"
},
"product_reference": "google-osconfig-agent-20250115.01-150000.1.44.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Public Cloud 15 SP3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-osconfig-agent-20250115.01-150000.1.44.1.x86_64 as component of SUSE Linux Enterprise Module for Public Cloud 15 SP3",
"product_id": "SUSE Linux Enterprise Module for Public Cloud 15 SP3:google-osconfig-agent-20250115.01-150000.1.44.1.x86_64"
},
"product_reference": "google-osconfig-agent-20250115.01-150000.1.44.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Public Cloud 15 SP3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-osconfig-agent-20250115.01-150000.1.44.1.aarch64 as component of SUSE Linux Enterprise Module for Public Cloud 15 SP4",
"product_id": "SUSE Linux Enterprise Module for Public Cloud 15 SP4:google-osconfig-agent-20250115.01-150000.1.44.1.aarch64"
},
"product_reference": "google-osconfig-agent-20250115.01-150000.1.44.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Public Cloud 15 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-osconfig-agent-20250115.01-150000.1.44.1.ppc64le as component of SUSE Linux Enterprise Module for Public Cloud 15 SP4",
"product_id": "SUSE Linux Enterprise Module for Public Cloud 15 SP4:google-osconfig-agent-20250115.01-150000.1.44.1.ppc64le"
},
"product_reference": "google-osconfig-agent-20250115.01-150000.1.44.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Public Cloud 15 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-osconfig-agent-20250115.01-150000.1.44.1.s390x as component of SUSE Linux Enterprise Module for Public Cloud 15 SP4",
"product_id": "SUSE Linux Enterprise Module for Public Cloud 15 SP4:google-osconfig-agent-20250115.01-150000.1.44.1.s390x"
},
"product_reference": "google-osconfig-agent-20250115.01-150000.1.44.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Public Cloud 15 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-osconfig-agent-20250115.01-150000.1.44.1.x86_64 as component of SUSE Linux Enterprise Module for Public Cloud 15 SP4",
"product_id": "SUSE Linux Enterprise Module for Public Cloud 15 SP4:google-osconfig-agent-20250115.01-150000.1.44.1.x86_64"
},
"product_reference": "google-osconfig-agent-20250115.01-150000.1.44.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Public Cloud 15 SP4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-osconfig-agent-20250115.01-150000.1.44.1.aarch64 as component of SUSE Linux Enterprise Module for Public Cloud 15 SP5",
"product_id": "SUSE Linux Enterprise Module for Public Cloud 15 SP5:google-osconfig-agent-20250115.01-150000.1.44.1.aarch64"
},
"product_reference": "google-osconfig-agent-20250115.01-150000.1.44.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Public Cloud 15 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-osconfig-agent-20250115.01-150000.1.44.1.ppc64le as component of SUSE Linux Enterprise Module for Public Cloud 15 SP5",
"product_id": "SUSE Linux Enterprise Module for Public Cloud 15 SP5:google-osconfig-agent-20250115.01-150000.1.44.1.ppc64le"
},
"product_reference": "google-osconfig-agent-20250115.01-150000.1.44.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Public Cloud 15 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-osconfig-agent-20250115.01-150000.1.44.1.s390x as component of SUSE Linux Enterprise Module for Public Cloud 15 SP5",
"product_id": "SUSE Linux Enterprise Module for Public Cloud 15 SP5:google-osconfig-agent-20250115.01-150000.1.44.1.s390x"
},
"product_reference": "google-osconfig-agent-20250115.01-150000.1.44.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Public Cloud 15 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-osconfig-agent-20250115.01-150000.1.44.1.x86_64 as component of SUSE Linux Enterprise Module for Public Cloud 15 SP5",
"product_id": "SUSE Linux Enterprise Module for Public Cloud 15 SP5:google-osconfig-agent-20250115.01-150000.1.44.1.x86_64"
},
"product_reference": "google-osconfig-agent-20250115.01-150000.1.44.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Public Cloud 15 SP5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-osconfig-agent-20250115.01-150000.1.44.1.aarch64 as component of SUSE Linux Enterprise Module for Public Cloud 15 SP6",
"product_id": "SUSE Linux Enterprise Module for Public Cloud 15 SP6:google-osconfig-agent-20250115.01-150000.1.44.1.aarch64"
},
"product_reference": "google-osconfig-agent-20250115.01-150000.1.44.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Public Cloud 15 SP6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-osconfig-agent-20250115.01-150000.1.44.1.ppc64le as component of SUSE Linux Enterprise Module for Public Cloud 15 SP6",
"product_id": "SUSE Linux Enterprise Module for Public Cloud 15 SP6:google-osconfig-agent-20250115.01-150000.1.44.1.ppc64le"
},
"product_reference": "google-osconfig-agent-20250115.01-150000.1.44.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Public Cloud 15 SP6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-osconfig-agent-20250115.01-150000.1.44.1.s390x as component of SUSE Linux Enterprise Module for Public Cloud 15 SP6",
"product_id": "SUSE Linux Enterprise Module for Public Cloud 15 SP6:google-osconfig-agent-20250115.01-150000.1.44.1.s390x"
},
"product_reference": "google-osconfig-agent-20250115.01-150000.1.44.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Public Cloud 15 SP6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-osconfig-agent-20250115.01-150000.1.44.1.x86_64 as component of SUSE Linux Enterprise Module for Public Cloud 15 SP6",
"product_id": "SUSE Linux Enterprise Module for Public Cloud 15 SP6:google-osconfig-agent-20250115.01-150000.1.44.1.x86_64"
},
"product_reference": "google-osconfig-agent-20250115.01-150000.1.44.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Public Cloud 15 SP6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-osconfig-agent-20250115.01-150000.1.44.1.aarch64 as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:google-osconfig-agent-20250115.01-150000.1.44.1.aarch64"
},
"product_reference": "google-osconfig-agent-20250115.01-150000.1.44.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 15.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-osconfig-agent-20250115.01-150000.1.44.1.ppc64le as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:google-osconfig-agent-20250115.01-150000.1.44.1.ppc64le"
},
"product_reference": "google-osconfig-agent-20250115.01-150000.1.44.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 15.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-osconfig-agent-20250115.01-150000.1.44.1.s390x as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:google-osconfig-agent-20250115.01-150000.1.44.1.s390x"
},
"product_reference": "google-osconfig-agent-20250115.01-150000.1.44.1.s390x",
"relates_to_product_reference": "openSUSE Leap 15.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-osconfig-agent-20250115.01-150000.1.44.1.x86_64 as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:google-osconfig-agent-20250115.01-150000.1.44.1.x86_64"
},
"product_reference": "google-osconfig-agent-20250115.01-150000.1.44.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.6"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-45339",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-45339"
}
],
"notes": [
{
"category": "general",
"text": "When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process\u0027s log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix that, glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Micro 5.5:google-osconfig-agent-20250115.01-150000.1.44.1.aarch64",
"SUSE Linux Enterprise Micro 5.5:google-osconfig-agent-20250115.01-150000.1.44.1.ppc64le",
"SUSE Linux Enterprise Micro 5.5:google-osconfig-agent-20250115.01-150000.1.44.1.s390x",
"SUSE Linux Enterprise Micro 5.5:google-osconfig-agent-20250115.01-150000.1.44.1.x86_64",
"SUSE Linux Enterprise Module for Public Cloud 15 SP3:google-osconfig-agent-20250115.01-150000.1.44.1.aarch64",
"SUSE Linux Enterprise Module for Public Cloud 15 SP3:google-osconfig-agent-20250115.01-150000.1.44.1.ppc64le",
"SUSE Linux Enterprise Module for Public Cloud 15 SP3:google-osconfig-agent-20250115.01-150000.1.44.1.s390x",
"SUSE Linux Enterprise Module for Public Cloud 15 SP3:google-osconfig-agent-20250115.01-150000.1.44.1.x86_64",
"SUSE Linux Enterprise Module for Public Cloud 15 SP4:google-osconfig-agent-20250115.01-150000.1.44.1.aarch64",
"SUSE Linux Enterprise Module for Public Cloud 15 SP4:google-osconfig-agent-20250115.01-150000.1.44.1.ppc64le",
"SUSE Linux Enterprise Module for Public Cloud 15 SP4:google-osconfig-agent-20250115.01-150000.1.44.1.s390x",
"SUSE Linux Enterprise Module for Public Cloud 15 SP4:google-osconfig-agent-20250115.01-150000.1.44.1.x86_64",
"SUSE Linux Enterprise Module for Public Cloud 15 SP5:google-osconfig-agent-20250115.01-150000.1.44.1.aarch64",
"SUSE Linux Enterprise Module for Public Cloud 15 SP5:google-osconfig-agent-20250115.01-150000.1.44.1.ppc64le",
"SUSE Linux Enterprise Module for Public Cloud 15 SP5:google-osconfig-agent-20250115.01-150000.1.44.1.s390x",
"SUSE Linux Enterprise Module for Public Cloud 15 SP5:google-osconfig-agent-20250115.01-150000.1.44.1.x86_64",
"SUSE Linux Enterprise Module for Public Cloud 15 SP6:google-osconfig-agent-20250115.01-150000.1.44.1.aarch64",
"SUSE Linux Enterprise Module for Public Cloud 15 SP6:google-osconfig-agent-20250115.01-150000.1.44.1.ppc64le",
"SUSE Linux Enterprise Module for Public Cloud 15 SP6:google-osconfig-agent-20250115.01-150000.1.44.1.s390x",
"SUSE Linux Enterprise Module for Public Cloud 15 SP6:google-osconfig-agent-20250115.01-150000.1.44.1.x86_64",
"openSUSE Leap 15.6:google-osconfig-agent-20250115.01-150000.1.44.1.aarch64",
"openSUSE Leap 15.6:google-osconfig-agent-20250115.01-150000.1.44.1.ppc64le",
"openSUSE Leap 15.6:google-osconfig-agent-20250115.01-150000.1.44.1.s390x",
"openSUSE Leap 15.6:google-osconfig-agent-20250115.01-150000.1.44.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-45339",
"url": "https://www.suse.com/security/cve/CVE-2024-45339"
},
{
"category": "external",
"summary": "SUSE Bug 1236541 for CVE-2024-45339",
"url": "https://bugzilla.suse.com/1236541"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Micro 5.5:google-osconfig-agent-20250115.01-150000.1.44.1.aarch64",
"SUSE Linux Enterprise Micro 5.5:google-osconfig-agent-20250115.01-150000.1.44.1.ppc64le",
"SUSE Linux Enterprise Micro 5.5:google-osconfig-agent-20250115.01-150000.1.44.1.s390x",
"SUSE Linux Enterprise Micro 5.5:google-osconfig-agent-20250115.01-150000.1.44.1.x86_64",
"SUSE Linux Enterprise Module for Public Cloud 15 SP3:google-osconfig-agent-20250115.01-150000.1.44.1.aarch64",
"SUSE Linux Enterprise Module for Public Cloud 15 SP3:google-osconfig-agent-20250115.01-150000.1.44.1.ppc64le",
"SUSE Linux Enterprise Module for Public Cloud 15 SP3:google-osconfig-agent-20250115.01-150000.1.44.1.s390x",
"SUSE Linux Enterprise Module for Public Cloud 15 SP3:google-osconfig-agent-20250115.01-150000.1.44.1.x86_64",
"SUSE Linux Enterprise Module for Public Cloud 15 SP4:google-osconfig-agent-20250115.01-150000.1.44.1.aarch64",
"SUSE Linux Enterprise Module for Public Cloud 15 SP4:google-osconfig-agent-20250115.01-150000.1.44.1.ppc64le",
"SUSE Linux Enterprise Module for Public Cloud 15 SP4:google-osconfig-agent-20250115.01-150000.1.44.1.s390x",
"SUSE Linux Enterprise Module for Public Cloud 15 SP4:google-osconfig-agent-20250115.01-150000.1.44.1.x86_64",
"SUSE Linux Enterprise Module for Public Cloud 15 SP5:google-osconfig-agent-20250115.01-150000.1.44.1.aarch64",
"SUSE Linux Enterprise Module for Public Cloud 15 SP5:google-osconfig-agent-20250115.01-150000.1.44.1.ppc64le",
"SUSE Linux Enterprise Module for Public Cloud 15 SP5:google-osconfig-agent-20250115.01-150000.1.44.1.s390x",
"SUSE Linux Enterprise Module for Public Cloud 15 SP5:google-osconfig-agent-20250115.01-150000.1.44.1.x86_64",
"SUSE Linux Enterprise Module for Public Cloud 15 SP6:google-osconfig-agent-20250115.01-150000.1.44.1.aarch64",
"SUSE Linux Enterprise Module for Public Cloud 15 SP6:google-osconfig-agent-20250115.01-150000.1.44.1.ppc64le",
"SUSE Linux Enterprise Module for Public Cloud 15 SP6:google-osconfig-agent-20250115.01-150000.1.44.1.s390x",
"SUSE Linux Enterprise Module for Public Cloud 15 SP6:google-osconfig-agent-20250115.01-150000.1.44.1.x86_64",
"openSUSE Leap 15.6:google-osconfig-agent-20250115.01-150000.1.44.1.aarch64",
"openSUSE Leap 15.6:google-osconfig-agent-20250115.01-150000.1.44.1.ppc64le",
"openSUSE Leap 15.6:google-osconfig-agent-20250115.01-150000.1.44.1.s390x",
"openSUSE Leap 15.6:google-osconfig-agent-20250115.01-150000.1.44.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Micro 5.5:google-osconfig-agent-20250115.01-150000.1.44.1.aarch64",
"SUSE Linux Enterprise Micro 5.5:google-osconfig-agent-20250115.01-150000.1.44.1.ppc64le",
"SUSE Linux Enterprise Micro 5.5:google-osconfig-agent-20250115.01-150000.1.44.1.s390x",
"SUSE Linux Enterprise Micro 5.5:google-osconfig-agent-20250115.01-150000.1.44.1.x86_64",
"SUSE Linux Enterprise Module for Public Cloud 15 SP3:google-osconfig-agent-20250115.01-150000.1.44.1.aarch64",
"SUSE Linux Enterprise Module for Public Cloud 15 SP3:google-osconfig-agent-20250115.01-150000.1.44.1.ppc64le",
"SUSE Linux Enterprise Module for Public Cloud 15 SP3:google-osconfig-agent-20250115.01-150000.1.44.1.s390x",
"SUSE Linux Enterprise Module for Public Cloud 15 SP3:google-osconfig-agent-20250115.01-150000.1.44.1.x86_64",
"SUSE Linux Enterprise Module for Public Cloud 15 SP4:google-osconfig-agent-20250115.01-150000.1.44.1.aarch64",
"SUSE Linux Enterprise Module for Public Cloud 15 SP4:google-osconfig-agent-20250115.01-150000.1.44.1.ppc64le",
"SUSE Linux Enterprise Module for Public Cloud 15 SP4:google-osconfig-agent-20250115.01-150000.1.44.1.s390x",
"SUSE Linux Enterprise Module for Public Cloud 15 SP4:google-osconfig-agent-20250115.01-150000.1.44.1.x86_64",
"SUSE Linux Enterprise Module for Public Cloud 15 SP5:google-osconfig-agent-20250115.01-150000.1.44.1.aarch64",
"SUSE Linux Enterprise Module for Public Cloud 15 SP5:google-osconfig-agent-20250115.01-150000.1.44.1.ppc64le",
"SUSE Linux Enterprise Module for Public Cloud 15 SP5:google-osconfig-agent-20250115.01-150000.1.44.1.s390x",
"SUSE Linux Enterprise Module for Public Cloud 15 SP5:google-osconfig-agent-20250115.01-150000.1.44.1.x86_64",
"SUSE Linux Enterprise Module for Public Cloud 15 SP6:google-osconfig-agent-20250115.01-150000.1.44.1.aarch64",
"SUSE Linux Enterprise Module for Public Cloud 15 SP6:google-osconfig-agent-20250115.01-150000.1.44.1.ppc64le",
"SUSE Linux Enterprise Module for Public Cloud 15 SP6:google-osconfig-agent-20250115.01-150000.1.44.1.s390x",
"SUSE Linux Enterprise Module for Public Cloud 15 SP6:google-osconfig-agent-20250115.01-150000.1.44.1.x86_64",
"openSUSE Leap 15.6:google-osconfig-agent-20250115.01-150000.1.44.1.aarch64",
"openSUSE Leap 15.6:google-osconfig-agent-20250115.01-150000.1.44.1.ppc64le",
"openSUSE Leap 15.6:google-osconfig-agent-20250115.01-150000.1.44.1.s390x",
"openSUSE Leap 15.6:google-osconfig-agent-20250115.01-150000.1.44.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-02-21T10:37:12Z",
"details": "important"
}
],
"title": "CVE-2024-45339"
}
]
}
SUSE-SU-2025:0622-1
Vulnerability from csaf_suse - Published: 2025-02-21 10:59 - Updated: 2025-02-21 10:59Summary
Security update for grafana
Severity
Important
Notes
Title of the patch: Security update for grafana
Description of the patch: This update for grafana fixes the following issues:
grafana was updated from version 10.4.13 to 10.4.15:
- Security issues fixed:
* CVE-2024-45339: Fixed vulnerability when creating log files (bsc#1236559)
* CVE-2024-11741: Fixed the Grafana Alerting VictorOps integration (bsc#1236734)
* CVE-2025-21613: Removed vulnerable library github.com/go-git/go-git/v5 (bsc#1235574)
* CVE-2024-28180: Fixed improper handling of highly compressed data (bsc#1235206)
- Other bugs fixed and changes:
* Alerting: Do not fetch Orgs if the user is authenticated by apikey/sa or render key
* Added provisioning directories
* Use /bin/bash in wrapper scripts
Patchnames: SUSE-2025-622,SUSE-SLE-Manager-Tools-12-2025-622
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Manager Client Tools 12:grafana-10.4.15-1.71.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Manager Client Tools 12:grafana-10.4.15-1.71.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Manager Client Tools 12:grafana-10.4.15-1.71.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Manager Client Tools 12:grafana-10.4.15-1.71.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
4.3 (Medium)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Manager Client Tools 12:grafana-10.4.15-1.71.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Manager Client Tools 12:grafana-10.4.15-1.71.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Manager Client Tools 12:grafana-10.4.15-1.71.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Manager Client Tools 12:grafana-10.4.15-1.71.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
7.1 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Manager Client Tools 12:grafana-10.4.15-1.71.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Manager Client Tools 12:grafana-10.4.15-1.71.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Manager Client Tools 12:grafana-10.4.15-1.71.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Manager Client Tools 12:grafana-10.4.15-1.71.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.1 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Manager Client Tools 12:grafana-10.4.15-1.71.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Manager Client Tools 12:grafana-10.4.15-1.71.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Manager Client Tools 12:grafana-10.4.15-1.71.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Manager Client Tools 12:grafana-10.4.15-1.71.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
References
20 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for grafana",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for grafana fixes the following issues:\n\ngrafana was updated from version 10.4.13 to 10.4.15:\n\n- Security issues fixed:\n * CVE-2024-45339: Fixed vulnerability when creating log files (bsc#1236559)\n * CVE-2024-11741: Fixed the Grafana Alerting VictorOps integration (bsc#1236734)\n * CVE-2025-21613: Removed vulnerable library github.com/go-git/go-git/v5 (bsc#1235574)\n * CVE-2024-28180: Fixed improper handling of highly compressed data (bsc#1235206)\n- Other bugs fixed and changes:\n * Alerting: Do not fetch Orgs if the user is authenticated by apikey/sa or render key\n * Added provisioning directories\n * Use /bin/bash in wrapper scripts\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-2025-622,SUSE-SLE-Manager-Tools-12-2025-622",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2025_0622-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2025:0622-1",
"url": "https://www.suse.com/support/update/announcement/2025/suse-su-20250622-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2025:0622-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2025-February/020389.html"
},
{
"category": "self",
"summary": "SUSE Bug 1235206",
"url": "https://bugzilla.suse.com/1235206"
},
{
"category": "self",
"summary": "SUSE Bug 1235574",
"url": "https://bugzilla.suse.com/1235574"
},
{
"category": "self",
"summary": "SUSE Bug 1236559",
"url": "https://bugzilla.suse.com/1236559"
},
{
"category": "self",
"summary": "SUSE Bug 1236734",
"url": "https://bugzilla.suse.com/1236734"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-11741 page",
"url": "https://www.suse.com/security/cve/CVE-2024-11741/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-28180 page",
"url": "https://www.suse.com/security/cve/CVE-2024-28180/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-45339 page",
"url": "https://www.suse.com/security/cve/CVE-2024-45339/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-21613 page",
"url": "https://www.suse.com/security/cve/CVE-2025-21613/"
}
],
"title": "Security update for grafana",
"tracking": {
"current_release_date": "2025-02-21T10:59:56Z",
"generator": {
"date": "2025-02-21T10:59:56Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2025:0622-1",
"initial_release_date": "2025-02-21T10:59:56Z",
"revision_history": [
{
"date": "2025-02-21T10:59:56Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "grafana-10.4.15-1.71.1.aarch64",
"product": {
"name": "grafana-10.4.15-1.71.1.aarch64",
"product_id": "grafana-10.4.15-1.71.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "grafana-10.4.15-1.71.1.i586",
"product": {
"name": "grafana-10.4.15-1.71.1.i586",
"product_id": "grafana-10.4.15-1.71.1.i586"
}
}
],
"category": "architecture",
"name": "i586"
},
{
"branches": [
{
"category": "product_version",
"name": "grafana-10.4.15-1.71.1.ppc64le",
"product": {
"name": "grafana-10.4.15-1.71.1.ppc64le",
"product_id": "grafana-10.4.15-1.71.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "grafana-10.4.15-1.71.1.s390x",
"product": {
"name": "grafana-10.4.15-1.71.1.s390x",
"product_id": "grafana-10.4.15-1.71.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "grafana-10.4.15-1.71.1.x86_64",
"product": {
"name": "grafana-10.4.15-1.71.1.x86_64",
"product_id": "grafana-10.4.15-1.71.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Manager Client Tools 12",
"product": {
"name": "SUSE Manager Client Tools 12",
"product_id": "SUSE Manager Client Tools 12"
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-10.4.15-1.71.1.aarch64 as component of SUSE Manager Client Tools 12",
"product_id": "SUSE Manager Client Tools 12:grafana-10.4.15-1.71.1.aarch64"
},
"product_reference": "grafana-10.4.15-1.71.1.aarch64",
"relates_to_product_reference": "SUSE Manager Client Tools 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-10.4.15-1.71.1.ppc64le as component of SUSE Manager Client Tools 12",
"product_id": "SUSE Manager Client Tools 12:grafana-10.4.15-1.71.1.ppc64le"
},
"product_reference": "grafana-10.4.15-1.71.1.ppc64le",
"relates_to_product_reference": "SUSE Manager Client Tools 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-10.4.15-1.71.1.s390x as component of SUSE Manager Client Tools 12",
"product_id": "SUSE Manager Client Tools 12:grafana-10.4.15-1.71.1.s390x"
},
"product_reference": "grafana-10.4.15-1.71.1.s390x",
"relates_to_product_reference": "SUSE Manager Client Tools 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-10.4.15-1.71.1.x86_64 as component of SUSE Manager Client Tools 12",
"product_id": "SUSE Manager Client Tools 12:grafana-10.4.15-1.71.1.x86_64"
},
"product_reference": "grafana-10.4.15-1.71.1.x86_64",
"relates_to_product_reference": "SUSE Manager Client Tools 12"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-11741",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-11741"
}
],
"notes": [
{
"category": "general",
"text": "Grafana is an open-source platform for monitoring and observability. \nThe Grafana Alerting VictorOps integration was not properly protected and could be exposed to users with Viewer permission. \nFixed in versions 11.5.0, 11.4.1, 11.3.3, 11.2.6, 11.1.11, 11.0.11 and 10.4.15",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Manager Client Tools 12:grafana-10.4.15-1.71.1.aarch64",
"SUSE Manager Client Tools 12:grafana-10.4.15-1.71.1.ppc64le",
"SUSE Manager Client Tools 12:grafana-10.4.15-1.71.1.s390x",
"SUSE Manager Client Tools 12:grafana-10.4.15-1.71.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-11741",
"url": "https://www.suse.com/security/cve/CVE-2024-11741"
},
{
"category": "external",
"summary": "SUSE Bug 1236734 for CVE-2024-11741",
"url": "https://bugzilla.suse.com/1236734"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Manager Client Tools 12:grafana-10.4.15-1.71.1.aarch64",
"SUSE Manager Client Tools 12:grafana-10.4.15-1.71.1.ppc64le",
"SUSE Manager Client Tools 12:grafana-10.4.15-1.71.1.s390x",
"SUSE Manager Client Tools 12:grafana-10.4.15-1.71.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Manager Client Tools 12:grafana-10.4.15-1.71.1.aarch64",
"SUSE Manager Client Tools 12:grafana-10.4.15-1.71.1.ppc64le",
"SUSE Manager Client Tools 12:grafana-10.4.15-1.71.1.s390x",
"SUSE Manager Client Tools 12:grafana-10.4.15-1.71.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-02-21T10:59:56Z",
"details": "moderate"
}
],
"title": "CVE-2024-11741"
},
{
"cve": "CVE-2024-28180",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-28180"
}
],
"notes": [
{
"category": "general",
"text": "Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Manager Client Tools 12:grafana-10.4.15-1.71.1.aarch64",
"SUSE Manager Client Tools 12:grafana-10.4.15-1.71.1.ppc64le",
"SUSE Manager Client Tools 12:grafana-10.4.15-1.71.1.s390x",
"SUSE Manager Client Tools 12:grafana-10.4.15-1.71.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-28180",
"url": "https://www.suse.com/security/cve/CVE-2024-28180"
},
{
"category": "external",
"summary": "SUSE Bug 1234984 for CVE-2024-28180",
"url": "https://bugzilla.suse.com/1234984"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Manager Client Tools 12:grafana-10.4.15-1.71.1.aarch64",
"SUSE Manager Client Tools 12:grafana-10.4.15-1.71.1.ppc64le",
"SUSE Manager Client Tools 12:grafana-10.4.15-1.71.1.s390x",
"SUSE Manager Client Tools 12:grafana-10.4.15-1.71.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"SUSE Manager Client Tools 12:grafana-10.4.15-1.71.1.aarch64",
"SUSE Manager Client Tools 12:grafana-10.4.15-1.71.1.ppc64le",
"SUSE Manager Client Tools 12:grafana-10.4.15-1.71.1.s390x",
"SUSE Manager Client Tools 12:grafana-10.4.15-1.71.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-02-21T10:59:56Z",
"details": "moderate"
}
],
"title": "CVE-2024-28180"
},
{
"cve": "CVE-2024-45339",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-45339"
}
],
"notes": [
{
"category": "general",
"text": "When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process\u0027s log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix that, glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Manager Client Tools 12:grafana-10.4.15-1.71.1.aarch64",
"SUSE Manager Client Tools 12:grafana-10.4.15-1.71.1.ppc64le",
"SUSE Manager Client Tools 12:grafana-10.4.15-1.71.1.s390x",
"SUSE Manager Client Tools 12:grafana-10.4.15-1.71.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-45339",
"url": "https://www.suse.com/security/cve/CVE-2024-45339"
},
{
"category": "external",
"summary": "SUSE Bug 1236541 for CVE-2024-45339",
"url": "https://bugzilla.suse.com/1236541"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Manager Client Tools 12:grafana-10.4.15-1.71.1.aarch64",
"SUSE Manager Client Tools 12:grafana-10.4.15-1.71.1.ppc64le",
"SUSE Manager Client Tools 12:grafana-10.4.15-1.71.1.s390x",
"SUSE Manager Client Tools 12:grafana-10.4.15-1.71.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Manager Client Tools 12:grafana-10.4.15-1.71.1.aarch64",
"SUSE Manager Client Tools 12:grafana-10.4.15-1.71.1.ppc64le",
"SUSE Manager Client Tools 12:grafana-10.4.15-1.71.1.s390x",
"SUSE Manager Client Tools 12:grafana-10.4.15-1.71.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-02-21T10:59:56Z",
"details": "important"
}
],
"title": "CVE-2024-45339"
},
{
"cve": "CVE-2025-21613",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-21613"
}
],
"notes": [
{
"category": "general",
"text": "go-git is a highly extensible git implementation library written in pure Go. An argument injection vulnerability was discovered in go-git versions prior to v5.13. Successful exploitation of this vulnerability could allow an attacker to set arbitrary values to git-upload-pack flags. This only happens when the file transport protocol is being used, as that is the only protocol that shells out to git binaries. This vulnerability is fixed in 5.13.0.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Manager Client Tools 12:grafana-10.4.15-1.71.1.aarch64",
"SUSE Manager Client Tools 12:grafana-10.4.15-1.71.1.ppc64le",
"SUSE Manager Client Tools 12:grafana-10.4.15-1.71.1.s390x",
"SUSE Manager Client Tools 12:grafana-10.4.15-1.71.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-21613",
"url": "https://www.suse.com/security/cve/CVE-2025-21613"
},
{
"category": "external",
"summary": "SUSE Bug 1235572 for CVE-2025-21613",
"url": "https://bugzilla.suse.com/1235572"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Manager Client Tools 12:grafana-10.4.15-1.71.1.aarch64",
"SUSE Manager Client Tools 12:grafana-10.4.15-1.71.1.ppc64le",
"SUSE Manager Client Tools 12:grafana-10.4.15-1.71.1.s390x",
"SUSE Manager Client Tools 12:grafana-10.4.15-1.71.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Manager Client Tools 12:grafana-10.4.15-1.71.1.aarch64",
"SUSE Manager Client Tools 12:grafana-10.4.15-1.71.1.ppc64le",
"SUSE Manager Client Tools 12:grafana-10.4.15-1.71.1.s390x",
"SUSE Manager Client Tools 12:grafana-10.4.15-1.71.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-02-21T10:59:56Z",
"details": "important"
}
],
"title": "CVE-2025-21613"
}
]
}
SUSE-SU-2025:0623-1
Vulnerability from csaf_suse - Published: 2025-02-21 11:00 - Updated: 2025-02-21 11:00Summary
Security update for grafana
Severity
Important
Notes
Title of the patch: Security update for grafana
Description of the patch: This update for grafana fixes the following issues:
grafana was updated from version 10.4.13 to 10.4.15:
- Security issues fixed:
* CVE-2024-45339: Fixed vulnerability when creating log files (bsc#1236559)
* CVE-2024-11741: Fixed the Grafana Alerting VictorOps integration (bsc#1236734)
* CVE-2025-21613: Removed vulnerable library github.com/go-git/go-git/v5 (bsc#1235574)
* CVE-2024-28180: Fixed improper handling of highly compressed data (bsc#1235206)
- Other bugs fixed and changes:
* Alerting: Do not fetch Orgs if the user is authenticated by apikey/sa or render key
* Added provisioning directories
* Use /bin/bash in wrapper scripts
Patchnames: SUSE-2025-623,SUSE-SLE-Module-Packagehub-Subpackages-15-SP6-2025-623,openSUSE-SLE-15.6-2025-623
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-10.4.15-150200.3.64.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-10.4.15-150200.3.64.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-10.4.15-150200.3.64.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-10.4.15-150200.3.64.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:grafana-10.4.15-150200.3.64.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:grafana-10.4.15-150200.3.64.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:grafana-10.4.15-150200.3.64.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:grafana-10.4.15-150200.3.64.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
4.3 (Medium)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-10.4.15-150200.3.64.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-10.4.15-150200.3.64.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-10.4.15-150200.3.64.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-10.4.15-150200.3.64.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:grafana-10.4.15-150200.3.64.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:grafana-10.4.15-150200.3.64.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:grafana-10.4.15-150200.3.64.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:grafana-10.4.15-150200.3.64.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
7.1 (High)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-10.4.15-150200.3.64.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-10.4.15-150200.3.64.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-10.4.15-150200.3.64.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-10.4.15-150200.3.64.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:grafana-10.4.15-150200.3.64.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:grafana-10.4.15-150200.3.64.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:grafana-10.4.15-150200.3.64.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:grafana-10.4.15-150200.3.64.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.1 (High)
Affected products
Recommended
8 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-10.4.15-150200.3.64.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-10.4.15-150200.3.64.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-10.4.15-150200.3.64.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-10.4.15-150200.3.64.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:grafana-10.4.15-150200.3.64.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:grafana-10.4.15-150200.3.64.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:grafana-10.4.15-150200.3.64.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Leap 15.6:grafana-10.4.15-150200.3.64.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
References
20 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for grafana",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for grafana fixes the following issues:\n\ngrafana was updated from version 10.4.13 to 10.4.15:\n\n- Security issues fixed:\n * CVE-2024-45339: Fixed vulnerability when creating log files (bsc#1236559)\n * CVE-2024-11741: Fixed the Grafana Alerting VictorOps integration (bsc#1236734)\n * CVE-2025-21613: Removed vulnerable library github.com/go-git/go-git/v5 (bsc#1235574)\n * CVE-2024-28180: Fixed improper handling of highly compressed data (bsc#1235206)\n- Other bugs fixed and changes:\n * Alerting: Do not fetch Orgs if the user is authenticated by apikey/sa or render key\n * Added provisioning directories\n * Use /bin/bash in wrapper scripts\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-2025-623,SUSE-SLE-Module-Packagehub-Subpackages-15-SP6-2025-623,openSUSE-SLE-15.6-2025-623",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2025_0623-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2025:0623-1",
"url": "https://www.suse.com/support/update/announcement/2025/suse-su-20250623-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2025:0623-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2025-February/020388.html"
},
{
"category": "self",
"summary": "SUSE Bug 1235206",
"url": "https://bugzilla.suse.com/1235206"
},
{
"category": "self",
"summary": "SUSE Bug 1235574",
"url": "https://bugzilla.suse.com/1235574"
},
{
"category": "self",
"summary": "SUSE Bug 1236559",
"url": "https://bugzilla.suse.com/1236559"
},
{
"category": "self",
"summary": "SUSE Bug 1236734",
"url": "https://bugzilla.suse.com/1236734"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-11741 page",
"url": "https://www.suse.com/security/cve/CVE-2024-11741/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-28180 page",
"url": "https://www.suse.com/security/cve/CVE-2024-28180/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-45339 page",
"url": "https://www.suse.com/security/cve/CVE-2024-45339/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-21613 page",
"url": "https://www.suse.com/security/cve/CVE-2025-21613/"
}
],
"title": "Security update for grafana",
"tracking": {
"current_release_date": "2025-02-21T11:00:07Z",
"generator": {
"date": "2025-02-21T11:00:07Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2025:0623-1",
"initial_release_date": "2025-02-21T11:00:07Z",
"revision_history": [
{
"date": "2025-02-21T11:00:07Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "grafana-10.4.15-150200.3.64.1.aarch64",
"product": {
"name": "grafana-10.4.15-150200.3.64.1.aarch64",
"product_id": "grafana-10.4.15-150200.3.64.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "grafana-10.4.15-150200.3.64.1.i586",
"product": {
"name": "grafana-10.4.15-150200.3.64.1.i586",
"product_id": "grafana-10.4.15-150200.3.64.1.i586"
}
}
],
"category": "architecture",
"name": "i586"
},
{
"branches": [
{
"category": "product_version",
"name": "grafana-10.4.15-150200.3.64.1.ppc64le",
"product": {
"name": "grafana-10.4.15-150200.3.64.1.ppc64le",
"product_id": "grafana-10.4.15-150200.3.64.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "grafana-10.4.15-150200.3.64.1.s390x",
"product": {
"name": "grafana-10.4.15-150200.3.64.1.s390x",
"product_id": "grafana-10.4.15-150200.3.64.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "grafana-10.4.15-150200.3.64.1.x86_64",
"product": {
"name": "grafana-10.4.15-150200.3.64.1.x86_64",
"product_id": "grafana-10.4.15-150200.3.64.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Module for Package Hub 15 SP6",
"product": {
"name": "SUSE Linux Enterprise Module for Package Hub 15 SP6",
"product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP6",
"product_identification_helper": {
"cpe": "cpe:/o:suse:packagehub:15:sp6"
}
}
},
{
"category": "product_name",
"name": "openSUSE Leap 15.6",
"product": {
"name": "openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:leap:15.6"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-10.4.15-150200.3.64.1.aarch64 as component of SUSE Linux Enterprise Module for Package Hub 15 SP6",
"product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-10.4.15-150200.3.64.1.aarch64"
},
"product_reference": "grafana-10.4.15-150200.3.64.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-10.4.15-150200.3.64.1.ppc64le as component of SUSE Linux Enterprise Module for Package Hub 15 SP6",
"product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-10.4.15-150200.3.64.1.ppc64le"
},
"product_reference": "grafana-10.4.15-150200.3.64.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-10.4.15-150200.3.64.1.s390x as component of SUSE Linux Enterprise Module for Package Hub 15 SP6",
"product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-10.4.15-150200.3.64.1.s390x"
},
"product_reference": "grafana-10.4.15-150200.3.64.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-10.4.15-150200.3.64.1.x86_64 as component of SUSE Linux Enterprise Module for Package Hub 15 SP6",
"product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-10.4.15-150200.3.64.1.x86_64"
},
"product_reference": "grafana-10.4.15-150200.3.64.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-10.4.15-150200.3.64.1.aarch64 as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:grafana-10.4.15-150200.3.64.1.aarch64"
},
"product_reference": "grafana-10.4.15-150200.3.64.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 15.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-10.4.15-150200.3.64.1.ppc64le as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:grafana-10.4.15-150200.3.64.1.ppc64le"
},
"product_reference": "grafana-10.4.15-150200.3.64.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 15.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-10.4.15-150200.3.64.1.s390x as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:grafana-10.4.15-150200.3.64.1.s390x"
},
"product_reference": "grafana-10.4.15-150200.3.64.1.s390x",
"relates_to_product_reference": "openSUSE Leap 15.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-10.4.15-150200.3.64.1.x86_64 as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:grafana-10.4.15-150200.3.64.1.x86_64"
},
"product_reference": "grafana-10.4.15-150200.3.64.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.6"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-11741",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-11741"
}
],
"notes": [
{
"category": "general",
"text": "Grafana is an open-source platform for monitoring and observability. \nThe Grafana Alerting VictorOps integration was not properly protected and could be exposed to users with Viewer permission. \nFixed in versions 11.5.0, 11.4.1, 11.3.3, 11.2.6, 11.1.11, 11.0.11 and 10.4.15",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-10.4.15-150200.3.64.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-10.4.15-150200.3.64.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-10.4.15-150200.3.64.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-10.4.15-150200.3.64.1.x86_64",
"openSUSE Leap 15.6:grafana-10.4.15-150200.3.64.1.aarch64",
"openSUSE Leap 15.6:grafana-10.4.15-150200.3.64.1.ppc64le",
"openSUSE Leap 15.6:grafana-10.4.15-150200.3.64.1.s390x",
"openSUSE Leap 15.6:grafana-10.4.15-150200.3.64.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-11741",
"url": "https://www.suse.com/security/cve/CVE-2024-11741"
},
{
"category": "external",
"summary": "SUSE Bug 1236734 for CVE-2024-11741",
"url": "https://bugzilla.suse.com/1236734"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-10.4.15-150200.3.64.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-10.4.15-150200.3.64.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-10.4.15-150200.3.64.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-10.4.15-150200.3.64.1.x86_64",
"openSUSE Leap 15.6:grafana-10.4.15-150200.3.64.1.aarch64",
"openSUSE Leap 15.6:grafana-10.4.15-150200.3.64.1.ppc64le",
"openSUSE Leap 15.6:grafana-10.4.15-150200.3.64.1.s390x",
"openSUSE Leap 15.6:grafana-10.4.15-150200.3.64.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-10.4.15-150200.3.64.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-10.4.15-150200.3.64.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-10.4.15-150200.3.64.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-10.4.15-150200.3.64.1.x86_64",
"openSUSE Leap 15.6:grafana-10.4.15-150200.3.64.1.aarch64",
"openSUSE Leap 15.6:grafana-10.4.15-150200.3.64.1.ppc64le",
"openSUSE Leap 15.6:grafana-10.4.15-150200.3.64.1.s390x",
"openSUSE Leap 15.6:grafana-10.4.15-150200.3.64.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-02-21T11:00:07Z",
"details": "moderate"
}
],
"title": "CVE-2024-11741"
},
{
"cve": "CVE-2024-28180",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-28180"
}
],
"notes": [
{
"category": "general",
"text": "Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-10.4.15-150200.3.64.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-10.4.15-150200.3.64.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-10.4.15-150200.3.64.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-10.4.15-150200.3.64.1.x86_64",
"openSUSE Leap 15.6:grafana-10.4.15-150200.3.64.1.aarch64",
"openSUSE Leap 15.6:grafana-10.4.15-150200.3.64.1.ppc64le",
"openSUSE Leap 15.6:grafana-10.4.15-150200.3.64.1.s390x",
"openSUSE Leap 15.6:grafana-10.4.15-150200.3.64.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-28180",
"url": "https://www.suse.com/security/cve/CVE-2024-28180"
},
{
"category": "external",
"summary": "SUSE Bug 1234984 for CVE-2024-28180",
"url": "https://bugzilla.suse.com/1234984"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-10.4.15-150200.3.64.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-10.4.15-150200.3.64.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-10.4.15-150200.3.64.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-10.4.15-150200.3.64.1.x86_64",
"openSUSE Leap 15.6:grafana-10.4.15-150200.3.64.1.aarch64",
"openSUSE Leap 15.6:grafana-10.4.15-150200.3.64.1.ppc64le",
"openSUSE Leap 15.6:grafana-10.4.15-150200.3.64.1.s390x",
"openSUSE Leap 15.6:grafana-10.4.15-150200.3.64.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-10.4.15-150200.3.64.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-10.4.15-150200.3.64.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-10.4.15-150200.3.64.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-10.4.15-150200.3.64.1.x86_64",
"openSUSE Leap 15.6:grafana-10.4.15-150200.3.64.1.aarch64",
"openSUSE Leap 15.6:grafana-10.4.15-150200.3.64.1.ppc64le",
"openSUSE Leap 15.6:grafana-10.4.15-150200.3.64.1.s390x",
"openSUSE Leap 15.6:grafana-10.4.15-150200.3.64.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-02-21T11:00:07Z",
"details": "moderate"
}
],
"title": "CVE-2024-28180"
},
{
"cve": "CVE-2024-45339",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-45339"
}
],
"notes": [
{
"category": "general",
"text": "When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process\u0027s log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix that, glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-10.4.15-150200.3.64.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-10.4.15-150200.3.64.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-10.4.15-150200.3.64.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-10.4.15-150200.3.64.1.x86_64",
"openSUSE Leap 15.6:grafana-10.4.15-150200.3.64.1.aarch64",
"openSUSE Leap 15.6:grafana-10.4.15-150200.3.64.1.ppc64le",
"openSUSE Leap 15.6:grafana-10.4.15-150200.3.64.1.s390x",
"openSUSE Leap 15.6:grafana-10.4.15-150200.3.64.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-45339",
"url": "https://www.suse.com/security/cve/CVE-2024-45339"
},
{
"category": "external",
"summary": "SUSE Bug 1236541 for CVE-2024-45339",
"url": "https://bugzilla.suse.com/1236541"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-10.4.15-150200.3.64.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-10.4.15-150200.3.64.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-10.4.15-150200.3.64.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-10.4.15-150200.3.64.1.x86_64",
"openSUSE Leap 15.6:grafana-10.4.15-150200.3.64.1.aarch64",
"openSUSE Leap 15.6:grafana-10.4.15-150200.3.64.1.ppc64le",
"openSUSE Leap 15.6:grafana-10.4.15-150200.3.64.1.s390x",
"openSUSE Leap 15.6:grafana-10.4.15-150200.3.64.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-10.4.15-150200.3.64.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-10.4.15-150200.3.64.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-10.4.15-150200.3.64.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-10.4.15-150200.3.64.1.x86_64",
"openSUSE Leap 15.6:grafana-10.4.15-150200.3.64.1.aarch64",
"openSUSE Leap 15.6:grafana-10.4.15-150200.3.64.1.ppc64le",
"openSUSE Leap 15.6:grafana-10.4.15-150200.3.64.1.s390x",
"openSUSE Leap 15.6:grafana-10.4.15-150200.3.64.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-02-21T11:00:07Z",
"details": "important"
}
],
"title": "CVE-2024-45339"
},
{
"cve": "CVE-2025-21613",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-21613"
}
],
"notes": [
{
"category": "general",
"text": "go-git is a highly extensible git implementation library written in pure Go. An argument injection vulnerability was discovered in go-git versions prior to v5.13. Successful exploitation of this vulnerability could allow an attacker to set arbitrary values to git-upload-pack flags. This only happens when the file transport protocol is being used, as that is the only protocol that shells out to git binaries. This vulnerability is fixed in 5.13.0.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-10.4.15-150200.3.64.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-10.4.15-150200.3.64.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-10.4.15-150200.3.64.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-10.4.15-150200.3.64.1.x86_64",
"openSUSE Leap 15.6:grafana-10.4.15-150200.3.64.1.aarch64",
"openSUSE Leap 15.6:grafana-10.4.15-150200.3.64.1.ppc64le",
"openSUSE Leap 15.6:grafana-10.4.15-150200.3.64.1.s390x",
"openSUSE Leap 15.6:grafana-10.4.15-150200.3.64.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-21613",
"url": "https://www.suse.com/security/cve/CVE-2025-21613"
},
{
"category": "external",
"summary": "SUSE Bug 1235572 for CVE-2025-21613",
"url": "https://bugzilla.suse.com/1235572"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-10.4.15-150200.3.64.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-10.4.15-150200.3.64.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-10.4.15-150200.3.64.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-10.4.15-150200.3.64.1.x86_64",
"openSUSE Leap 15.6:grafana-10.4.15-150200.3.64.1.aarch64",
"openSUSE Leap 15.6:grafana-10.4.15-150200.3.64.1.ppc64le",
"openSUSE Leap 15.6:grafana-10.4.15-150200.3.64.1.s390x",
"openSUSE Leap 15.6:grafana-10.4.15-150200.3.64.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-10.4.15-150200.3.64.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-10.4.15-150200.3.64.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-10.4.15-150200.3.64.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-10.4.15-150200.3.64.1.x86_64",
"openSUSE Leap 15.6:grafana-10.4.15-150200.3.64.1.aarch64",
"openSUSE Leap 15.6:grafana-10.4.15-150200.3.64.1.ppc64le",
"openSUSE Leap 15.6:grafana-10.4.15-150200.3.64.1.s390x",
"openSUSE Leap 15.6:grafana-10.4.15-150200.3.64.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-02-21T11:00:07Z",
"details": "important"
}
],
"title": "CVE-2025-21613"
}
]
}
SUSE-SU-2025:0624-1
Vulnerability from csaf_suse - Published: 2025-02-21 11:00 - Updated: 2025-02-21 11:00Summary
Security update for grafana
Severity
Important
Notes
Title of the patch: Security update for grafana
Description of the patch: This update for grafana fixes the following issues:
grafana was updated from version 10.4.13 to 10.4.15:
- Security issues fixed:
* CVE-2024-45339: Fixed vulnerability when creating log files (bsc#1236559)
* CVE-2024-11741: Fixed the Grafana Alerting VictorOps integration (bsc#1236734)
* CVE-2025-21613: Removed vulnerable library github.com/go-git/go-git/v5 (bsc#1235574)
* CVE-2024-28180: Fixed improper handling of highly compressed data (bsc#1235206)
- Other bugs fixed and changes:
* Alerting: Do not fetch Orgs if the user is authenticated by apikey/sa or render key
* Added provisioning directories
* Use /bin/bash in wrapper scripts
Patchnames: SUSE-2025-624,SUSE-SLE-Manager-Tools-15-2025-624
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Manager Client Tools 15:grafana-10.4.15-150000.1.71.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Manager Client Tools 15:grafana-10.4.15-150000.1.71.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Manager Client Tools 15:grafana-10.4.15-150000.1.71.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Manager Client Tools 15:grafana-10.4.15-150000.1.71.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
4.3 (Medium)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Manager Client Tools 15:grafana-10.4.15-150000.1.71.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Manager Client Tools 15:grafana-10.4.15-150000.1.71.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Manager Client Tools 15:grafana-10.4.15-150000.1.71.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Manager Client Tools 15:grafana-10.4.15-150000.1.71.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
7.1 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Manager Client Tools 15:grafana-10.4.15-150000.1.71.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Manager Client Tools 15:grafana-10.4.15-150000.1.71.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Manager Client Tools 15:grafana-10.4.15-150000.1.71.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Manager Client Tools 15:grafana-10.4.15-150000.1.71.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.1 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Manager Client Tools 15:grafana-10.4.15-150000.1.71.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Manager Client Tools 15:grafana-10.4.15-150000.1.71.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Manager Client Tools 15:grafana-10.4.15-150000.1.71.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Manager Client Tools 15:grafana-10.4.15-150000.1.71.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
References
20 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for grafana",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for grafana fixes the following issues:\n\ngrafana was updated from version 10.4.13 to 10.4.15:\n\n- Security issues fixed:\n * CVE-2024-45339: Fixed vulnerability when creating log files (bsc#1236559)\n * CVE-2024-11741: Fixed the Grafana Alerting VictorOps integration (bsc#1236734)\n * CVE-2025-21613: Removed vulnerable library github.com/go-git/go-git/v5 (bsc#1235574)\n * CVE-2024-28180: Fixed improper handling of highly compressed data (bsc#1235206)\n- Other bugs fixed and changes:\n * Alerting: Do not fetch Orgs if the user is authenticated by apikey/sa or render key\n * Added provisioning directories\n * Use /bin/bash in wrapper scripts\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-2025-624,SUSE-SLE-Manager-Tools-15-2025-624",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2025_0624-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2025:0624-1",
"url": "https://www.suse.com/support/update/announcement/2025/suse-su-20250624-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2025:0624-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2025-February/020387.html"
},
{
"category": "self",
"summary": "SUSE Bug 1235206",
"url": "https://bugzilla.suse.com/1235206"
},
{
"category": "self",
"summary": "SUSE Bug 1235574",
"url": "https://bugzilla.suse.com/1235574"
},
{
"category": "self",
"summary": "SUSE Bug 1236559",
"url": "https://bugzilla.suse.com/1236559"
},
{
"category": "self",
"summary": "SUSE Bug 1236734",
"url": "https://bugzilla.suse.com/1236734"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-11741 page",
"url": "https://www.suse.com/security/cve/CVE-2024-11741/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-28180 page",
"url": "https://www.suse.com/security/cve/CVE-2024-28180/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-45339 page",
"url": "https://www.suse.com/security/cve/CVE-2024-45339/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-21613 page",
"url": "https://www.suse.com/security/cve/CVE-2025-21613/"
}
],
"title": "Security update for grafana",
"tracking": {
"current_release_date": "2025-02-21T11:00:27Z",
"generator": {
"date": "2025-02-21T11:00:27Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2025:0624-1",
"initial_release_date": "2025-02-21T11:00:27Z",
"revision_history": [
{
"date": "2025-02-21T11:00:27Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "grafana-10.4.15-150000.1.71.1.aarch64",
"product": {
"name": "grafana-10.4.15-150000.1.71.1.aarch64",
"product_id": "grafana-10.4.15-150000.1.71.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "grafana-10.4.15-150000.1.71.1.i586",
"product": {
"name": "grafana-10.4.15-150000.1.71.1.i586",
"product_id": "grafana-10.4.15-150000.1.71.1.i586"
}
}
],
"category": "architecture",
"name": "i586"
},
{
"branches": [
{
"category": "product_version",
"name": "grafana-10.4.15-150000.1.71.1.ppc64le",
"product": {
"name": "grafana-10.4.15-150000.1.71.1.ppc64le",
"product_id": "grafana-10.4.15-150000.1.71.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "grafana-10.4.15-150000.1.71.1.s390x",
"product": {
"name": "grafana-10.4.15-150000.1.71.1.s390x",
"product_id": "grafana-10.4.15-150000.1.71.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "grafana-10.4.15-150000.1.71.1.x86_64",
"product": {
"name": "grafana-10.4.15-150000.1.71.1.x86_64",
"product_id": "grafana-10.4.15-150000.1.71.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Manager Client Tools 15",
"product": {
"name": "SUSE Manager Client Tools 15",
"product_id": "SUSE Manager Client Tools 15"
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-10.4.15-150000.1.71.1.aarch64 as component of SUSE Manager Client Tools 15",
"product_id": "SUSE Manager Client Tools 15:grafana-10.4.15-150000.1.71.1.aarch64"
},
"product_reference": "grafana-10.4.15-150000.1.71.1.aarch64",
"relates_to_product_reference": "SUSE Manager Client Tools 15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-10.4.15-150000.1.71.1.ppc64le as component of SUSE Manager Client Tools 15",
"product_id": "SUSE Manager Client Tools 15:grafana-10.4.15-150000.1.71.1.ppc64le"
},
"product_reference": "grafana-10.4.15-150000.1.71.1.ppc64le",
"relates_to_product_reference": "SUSE Manager Client Tools 15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-10.4.15-150000.1.71.1.s390x as component of SUSE Manager Client Tools 15",
"product_id": "SUSE Manager Client Tools 15:grafana-10.4.15-150000.1.71.1.s390x"
},
"product_reference": "grafana-10.4.15-150000.1.71.1.s390x",
"relates_to_product_reference": "SUSE Manager Client Tools 15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-10.4.15-150000.1.71.1.x86_64 as component of SUSE Manager Client Tools 15",
"product_id": "SUSE Manager Client Tools 15:grafana-10.4.15-150000.1.71.1.x86_64"
},
"product_reference": "grafana-10.4.15-150000.1.71.1.x86_64",
"relates_to_product_reference": "SUSE Manager Client Tools 15"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-11741",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-11741"
}
],
"notes": [
{
"category": "general",
"text": "Grafana is an open-source platform for monitoring and observability. \nThe Grafana Alerting VictorOps integration was not properly protected and could be exposed to users with Viewer permission. \nFixed in versions 11.5.0, 11.4.1, 11.3.3, 11.2.6, 11.1.11, 11.0.11 and 10.4.15",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Manager Client Tools 15:grafana-10.4.15-150000.1.71.1.aarch64",
"SUSE Manager Client Tools 15:grafana-10.4.15-150000.1.71.1.ppc64le",
"SUSE Manager Client Tools 15:grafana-10.4.15-150000.1.71.1.s390x",
"SUSE Manager Client Tools 15:grafana-10.4.15-150000.1.71.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-11741",
"url": "https://www.suse.com/security/cve/CVE-2024-11741"
},
{
"category": "external",
"summary": "SUSE Bug 1236734 for CVE-2024-11741",
"url": "https://bugzilla.suse.com/1236734"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Manager Client Tools 15:grafana-10.4.15-150000.1.71.1.aarch64",
"SUSE Manager Client Tools 15:grafana-10.4.15-150000.1.71.1.ppc64le",
"SUSE Manager Client Tools 15:grafana-10.4.15-150000.1.71.1.s390x",
"SUSE Manager Client Tools 15:grafana-10.4.15-150000.1.71.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Manager Client Tools 15:grafana-10.4.15-150000.1.71.1.aarch64",
"SUSE Manager Client Tools 15:grafana-10.4.15-150000.1.71.1.ppc64le",
"SUSE Manager Client Tools 15:grafana-10.4.15-150000.1.71.1.s390x",
"SUSE Manager Client Tools 15:grafana-10.4.15-150000.1.71.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-02-21T11:00:27Z",
"details": "moderate"
}
],
"title": "CVE-2024-11741"
},
{
"cve": "CVE-2024-28180",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-28180"
}
],
"notes": [
{
"category": "general",
"text": "Package jose aims to provide an implementation of the Javascript Object Signing and Encryption set of standards. An attacker could send a JWE containing compressed data that used large amounts of memory and CPU when decompressed by Decrypt or DecryptMulti. Those functions now return an error if the decompressed data would exceed 250kB or 10x the compressed size (whichever is larger). This vulnerability has been patched in versions 4.0.1, 3.0.3 and 2.6.3.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Manager Client Tools 15:grafana-10.4.15-150000.1.71.1.aarch64",
"SUSE Manager Client Tools 15:grafana-10.4.15-150000.1.71.1.ppc64le",
"SUSE Manager Client Tools 15:grafana-10.4.15-150000.1.71.1.s390x",
"SUSE Manager Client Tools 15:grafana-10.4.15-150000.1.71.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-28180",
"url": "https://www.suse.com/security/cve/CVE-2024-28180"
},
{
"category": "external",
"summary": "SUSE Bug 1234984 for CVE-2024-28180",
"url": "https://bugzilla.suse.com/1234984"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Manager Client Tools 15:grafana-10.4.15-150000.1.71.1.aarch64",
"SUSE Manager Client Tools 15:grafana-10.4.15-150000.1.71.1.ppc64le",
"SUSE Manager Client Tools 15:grafana-10.4.15-150000.1.71.1.s390x",
"SUSE Manager Client Tools 15:grafana-10.4.15-150000.1.71.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"SUSE Manager Client Tools 15:grafana-10.4.15-150000.1.71.1.aarch64",
"SUSE Manager Client Tools 15:grafana-10.4.15-150000.1.71.1.ppc64le",
"SUSE Manager Client Tools 15:grafana-10.4.15-150000.1.71.1.s390x",
"SUSE Manager Client Tools 15:grafana-10.4.15-150000.1.71.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-02-21T11:00:27Z",
"details": "moderate"
}
],
"title": "CVE-2024-28180"
},
{
"cve": "CVE-2024-45339",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-45339"
}
],
"notes": [
{
"category": "general",
"text": "When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process\u0027s log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix that, glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Manager Client Tools 15:grafana-10.4.15-150000.1.71.1.aarch64",
"SUSE Manager Client Tools 15:grafana-10.4.15-150000.1.71.1.ppc64le",
"SUSE Manager Client Tools 15:grafana-10.4.15-150000.1.71.1.s390x",
"SUSE Manager Client Tools 15:grafana-10.4.15-150000.1.71.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-45339",
"url": "https://www.suse.com/security/cve/CVE-2024-45339"
},
{
"category": "external",
"summary": "SUSE Bug 1236541 for CVE-2024-45339",
"url": "https://bugzilla.suse.com/1236541"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Manager Client Tools 15:grafana-10.4.15-150000.1.71.1.aarch64",
"SUSE Manager Client Tools 15:grafana-10.4.15-150000.1.71.1.ppc64le",
"SUSE Manager Client Tools 15:grafana-10.4.15-150000.1.71.1.s390x",
"SUSE Manager Client Tools 15:grafana-10.4.15-150000.1.71.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Manager Client Tools 15:grafana-10.4.15-150000.1.71.1.aarch64",
"SUSE Manager Client Tools 15:grafana-10.4.15-150000.1.71.1.ppc64le",
"SUSE Manager Client Tools 15:grafana-10.4.15-150000.1.71.1.s390x",
"SUSE Manager Client Tools 15:grafana-10.4.15-150000.1.71.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-02-21T11:00:27Z",
"details": "important"
}
],
"title": "CVE-2024-45339"
},
{
"cve": "CVE-2025-21613",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-21613"
}
],
"notes": [
{
"category": "general",
"text": "go-git is a highly extensible git implementation library written in pure Go. An argument injection vulnerability was discovered in go-git versions prior to v5.13. Successful exploitation of this vulnerability could allow an attacker to set arbitrary values to git-upload-pack flags. This only happens when the file transport protocol is being used, as that is the only protocol that shells out to git binaries. This vulnerability is fixed in 5.13.0.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Manager Client Tools 15:grafana-10.4.15-150000.1.71.1.aarch64",
"SUSE Manager Client Tools 15:grafana-10.4.15-150000.1.71.1.ppc64le",
"SUSE Manager Client Tools 15:grafana-10.4.15-150000.1.71.1.s390x",
"SUSE Manager Client Tools 15:grafana-10.4.15-150000.1.71.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-21613",
"url": "https://www.suse.com/security/cve/CVE-2025-21613"
},
{
"category": "external",
"summary": "SUSE Bug 1235572 for CVE-2025-21613",
"url": "https://bugzilla.suse.com/1235572"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Manager Client Tools 15:grafana-10.4.15-150000.1.71.1.aarch64",
"SUSE Manager Client Tools 15:grafana-10.4.15-150000.1.71.1.ppc64le",
"SUSE Manager Client Tools 15:grafana-10.4.15-150000.1.71.1.s390x",
"SUSE Manager Client Tools 15:grafana-10.4.15-150000.1.71.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Manager Client Tools 15:grafana-10.4.15-150000.1.71.1.aarch64",
"SUSE Manager Client Tools 15:grafana-10.4.15-150000.1.71.1.ppc64le",
"SUSE Manager Client Tools 15:grafana-10.4.15-150000.1.71.1.s390x",
"SUSE Manager Client Tools 15:grafana-10.4.15-150000.1.71.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-02-21T11:00:27Z",
"details": "important"
}
],
"title": "CVE-2025-21613"
}
]
}
SUSE-SU-2025:20746-1
Vulnerability from csaf_suse - Published: 2025-09-12 09:02 - Updated: 2025-09-12 09:02Summary
Security update for google-osconfig-agent
Severity
Moderate
Notes
Title of the patch: Security update for google-osconfig-agent
Description of the patch: This update for google-osconfig-agent fixes the following issues:
Update to version 20250416.02 (bsc#1244304, bsc#1244503)
* defaultSleeper: tolerate 10% difference to reduce test flakiness (#810)
* Add output of some packagemanagers to the testdata (#808)
From version 20250416.01:
* Refactor OS Info package (#809)
From version 20250416.00:
* Report RPM inventory as YUM instead of empty SoftwarePackage
when neither Zypper nor YUM are installed. (#805)
From version 20250414.00:
* Update hash computation algorithm (#799)
Update to version 20250320.00:
* Bump github.com/envoyproxy/protoc-gen-validate from 1.1.0 to 1.2.1 (#797)
* Bump go.opentelemetry.io/otel/sdk/metric from 1.32.0 to 1.35.0 (#793)
* Bump cel.dev/expr from 0.18.0 to 0.22.0 (#792)
* Bump github.com/golang/glog from 1.2.3 to 1.2.4 in the go_modules group (#785)
* Bump cloud.google.com/go/logging from 1.12.0 to 1.13.0 (#774)
* Add tests for retryutil package. (#795)
* Update OWNERS (#794)
* Use separate counters for pre- and post-patch reboots. (#788)
* Update owners (#789)
* Fix the vet errors for contants in logging (#786)
* change available package check (#783)
* Fix Inventory reporting e2e tests. (#782)
* fix e2e tests (#781)
- Add -buildmode=pie to go build command line (bsc#1239948)
Patchnames: SUSE-SLE-Micro-6.1-262
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
7.1 (High)
Affected products
Recommended
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20250416.02-slfo.1.1_1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20250416.02-slfo.1.1_1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20250416.02-slfo.1.1_1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.1:google-osconfig-agent-20250416.02-slfo.1.1_1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
References
12 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for google-osconfig-agent",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for google-osconfig-agent fixes the following issues:\n\nUpdate to version 20250416.02 (bsc#1244304, bsc#1244503)\n\n * defaultSleeper: tolerate 10% difference to reduce test flakiness (#810)\n * Add output of some packagemanagers to the testdata (#808)\n\nFrom version 20250416.01:\n\n * Refactor OS Info package (#809)\n\nFrom version 20250416.00:\n\n * Report RPM inventory as YUM instead of empty SoftwarePackage\n when neither Zypper nor YUM are installed. (#805)\n\nFrom version 20250414.00:\n\n * Update hash computation algorithm (#799)\n\nUpdate to version 20250320.00:\n\n * Bump github.com/envoyproxy/protoc-gen-validate from 1.1.0 to 1.2.1 (#797)\n * Bump go.opentelemetry.io/otel/sdk/metric from 1.32.0 to 1.35.0 (#793)\n * Bump cel.dev/expr from 0.18.0 to 0.22.0 (#792)\n * Bump github.com/golang/glog from 1.2.3 to 1.2.4 in the go_modules group (#785)\n * Bump cloud.google.com/go/logging from 1.12.0 to 1.13.0 (#774)\n * Add tests for retryutil package. (#795)\n * Update OWNERS (#794)\n * Use separate counters for pre- and post-patch reboots. (#788)\n * Update owners (#789)\n * Fix the vet errors for contants in logging (#786)\n * change available package check (#783)\n * Fix Inventory reporting e2e tests. (#782)\n * fix e2e tests (#781)\n- Add -buildmode=pie to go build command line (bsc#1239948)\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-SLE-Micro-6.1-262",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2025_20746-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2025:20746-1",
"url": "https://www.suse.com/support/update/announcement/2025/suse-su-202520746-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2025:20746-1",
"url": "https://lists.suse.com/pipermail/sle-updates/2025-September/041898.html"
},
{
"category": "self",
"summary": "SUSE Bug 1212418",
"url": "https://bugzilla.suse.com/1212418"
},
{
"category": "self",
"summary": "SUSE Bug 1212759",
"url": "https://bugzilla.suse.com/1212759"
},
{
"category": "self",
"summary": "SUSE Bug 1239948",
"url": "https://bugzilla.suse.com/1239948"
},
{
"category": "self",
"summary": "SUSE Bug 1244304",
"url": "https://bugzilla.suse.com/1244304"
},
{
"category": "self",
"summary": "SUSE Bug 1244503",
"url": "https://bugzilla.suse.com/1244503"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-45339 page",
"url": "https://www.suse.com/security/cve/CVE-2024-45339/"
}
],
"title": "Security update for google-osconfig-agent",
"tracking": {
"current_release_date": "2025-09-12T09:02:40Z",
"generator": {
"date": "2025-09-12T09:02:40Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2025:20746-1",
"initial_release_date": "2025-09-12T09:02:40Z",
"revision_history": [
{
"date": "2025-09-12T09:02:40Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "google-osconfig-agent-20250416.02-slfo.1.1_1.1.aarch64",
"product": {
"name": "google-osconfig-agent-20250416.02-slfo.1.1_1.1.aarch64",
"product_id": "google-osconfig-agent-20250416.02-slfo.1.1_1.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "google-osconfig-agent-20250416.02-slfo.1.1_1.1.ppc64le",
"product": {
"name": "google-osconfig-agent-20250416.02-slfo.1.1_1.1.ppc64le",
"product_id": "google-osconfig-agent-20250416.02-slfo.1.1_1.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "google-osconfig-agent-20250416.02-slfo.1.1_1.1.s390x",
"product": {
"name": "google-osconfig-agent-20250416.02-slfo.1.1_1.1.s390x",
"product_id": "google-osconfig-agent-20250416.02-slfo.1.1_1.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "google-osconfig-agent-20250416.02-slfo.1.1_1.1.x86_64",
"product": {
"name": "google-osconfig-agent-20250416.02-slfo.1.1_1.1.x86_64",
"product_id": "google-osconfig-agent-20250416.02-slfo.1.1_1.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Micro 6.1",
"product": {
"name": "SUSE Linux Micro 6.1",
"product_id": "SUSE Linux Micro 6.1",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sl-micro:6.1"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "google-osconfig-agent-20250416.02-slfo.1.1_1.1.aarch64 as component of SUSE Linux Micro 6.1",
"product_id": "SUSE Linux Micro 6.1:google-osconfig-agent-20250416.02-slfo.1.1_1.1.aarch64"
},
"product_reference": "google-osconfig-agent-20250416.02-slfo.1.1_1.1.aarch64",
"relates_to_product_reference": "SUSE Linux Micro 6.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-osconfig-agent-20250416.02-slfo.1.1_1.1.ppc64le as component of SUSE Linux Micro 6.1",
"product_id": "SUSE Linux Micro 6.1:google-osconfig-agent-20250416.02-slfo.1.1_1.1.ppc64le"
},
"product_reference": "google-osconfig-agent-20250416.02-slfo.1.1_1.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Micro 6.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-osconfig-agent-20250416.02-slfo.1.1_1.1.s390x as component of SUSE Linux Micro 6.1",
"product_id": "SUSE Linux Micro 6.1:google-osconfig-agent-20250416.02-slfo.1.1_1.1.s390x"
},
"product_reference": "google-osconfig-agent-20250416.02-slfo.1.1_1.1.s390x",
"relates_to_product_reference": "SUSE Linux Micro 6.1"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-osconfig-agent-20250416.02-slfo.1.1_1.1.x86_64 as component of SUSE Linux Micro 6.1",
"product_id": "SUSE Linux Micro 6.1:google-osconfig-agent-20250416.02-slfo.1.1_1.1.x86_64"
},
"product_reference": "google-osconfig-agent-20250416.02-slfo.1.1_1.1.x86_64",
"relates_to_product_reference": "SUSE Linux Micro 6.1"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-45339",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-45339"
}
],
"notes": [
{
"category": "general",
"text": "When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process\u0027s log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix that, glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.1:google-osconfig-agent-20250416.02-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:google-osconfig-agent-20250416.02-slfo.1.1_1.1.ppc64le",
"SUSE Linux Micro 6.1:google-osconfig-agent-20250416.02-slfo.1.1_1.1.s390x",
"SUSE Linux Micro 6.1:google-osconfig-agent-20250416.02-slfo.1.1_1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-45339",
"url": "https://www.suse.com/security/cve/CVE-2024-45339"
},
{
"category": "external",
"summary": "SUSE Bug 1236541 for CVE-2024-45339",
"url": "https://bugzilla.suse.com/1236541"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.1:google-osconfig-agent-20250416.02-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:google-osconfig-agent-20250416.02-slfo.1.1_1.1.ppc64le",
"SUSE Linux Micro 6.1:google-osconfig-agent-20250416.02-slfo.1.1_1.1.s390x",
"SUSE Linux Micro 6.1:google-osconfig-agent-20250416.02-slfo.1.1_1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.1:google-osconfig-agent-20250416.02-slfo.1.1_1.1.aarch64",
"SUSE Linux Micro 6.1:google-osconfig-agent-20250416.02-slfo.1.1_1.1.ppc64le",
"SUSE Linux Micro 6.1:google-osconfig-agent-20250416.02-slfo.1.1_1.1.s390x",
"SUSE Linux Micro 6.1:google-osconfig-agent-20250416.02-slfo.1.1_1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-09-12T09:02:40Z",
"details": "important"
}
],
"title": "CVE-2024-45339"
}
]
}
SUSE-SU-2026:22242-1
Vulnerability from csaf_suse - Published: 2026-06-22 09:09 - Updated: 2026-06-22 09:09Summary
Security update for google-osconfig-agent
Severity
Important
Notes
Title of the patch: Security update for google-osconfig-agent
Description of the patch: This update for google-osconfig-agent fixes the following issues
- CVE-2023-45288: golang.org/x/net/http2: close connections when receiving too many headers (bsc#1236533).
- CVE-2025-47911: golang.org/x/net/html: various algorithms with quadratic complexity when parsing HTML documents
(bsc#1251453).
- CVE-2025-58190: golang.org/x/net/html: excessive memory consumption by `html.ParseFragment` when processing specially
crafted input (bsc#1251704).
- CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo-
header (bsc#1260264).
- CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE
(bsc#1265762).
- CVE-2026-34986: github.com/go-jose/go-jose/v4: crafted JWE input with a missing encrypted key can lead to a denial of
service (bsc#1262926).
- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation
bypass and privilege escalation (bsc#1266603).
- CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266171).
- CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266171).
- CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266171).
- CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh
(bsc#1266171).
- CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh
(bsc#1266171).
- CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent
(bsc#1266171).
- CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266171).
- CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266171).
- CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266171).
- CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts
(bsc#1266171).
- CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh
(bsc#1266171).
- CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266171).
- CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266171).
- CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during
smart-HTTP clone and fetch operations (bsc#1264923).
Changes for google-osconfig-agent:
- Update to version 20260615.01
* Upgrade golang.org/x/crypto & golang.org/x/net (#1006)
- from version 20260615.00
* Add unit tests for ospatch_apt_upgrade.go (#938)
- Update to version 20260611.00
* Add unit tests for policies/policies.go PART 5 (#998)
- from version 20260610.00
* Add unit tests for policies/policies.go PART 4 (#997)
- from version 20260609.02
* squash commits (#936)
- from version 20260609.01
* Add unit tests for policies/policies.go PART 3 (#996)
- from version 20260609.00
* Add unit tests for policies/policies.go PART 2 (#991)
- from version 20260602.01
* Align format of dates and timestamp collected across Windows packages (#973)
- from version 20260602.00
* Add unit tests for config/config,go (#979)
- from version 20260528.00
* Bump github.com/containerd/containerd (#990)
- from version 20260521.00
* Cover agentconfig functionality by unit tests (#925)
- from version 20260520.04
* Add unit tests for policies/googet.go (#961)
* Bump github.com/go-git/go-git/v5 (#987)
- from version 20260520.02
* Add unit tests for policies/yum.go (#952)
* Add unit tests for policies/apt.go PART 3 (#951)
- from version 20260520.00
* Add unit tests for policies/zypper.go (#953)
- from version 20260519.00
* Add unit tests for policies/policies.go PART 1 (#949)
- from version 20260513.01
* Bump github.com/go-git/go-git/v5 (#981), this also updates
golang.org/x/net to v0.53.0 (bsc#1265762, CVE-2026-33814)
- from version 20260513.00
* upgrade a few packages (#980)
- from version 20260512.02
* Add/improve unit tests for agentendpoint/exec_task.go (#933)
- from version 20260512.01
* Cover google_update.go by unit tests (#941)
- from version 20260512.00
* Change zone for arm64 builds because of stockout (#978)
- Update to version 20260511.00
* switch to t2a-standard-2 on ARM package build (#977)
- from version 20260505.03
* Cover zypper_patch by unit tests (#958)
- from version 20260505.02
* Remove unused functions DisableAutoUpdates (#970)
- from version 20260505.01
* Bump go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc (#966)
- from version 20260505.00
* Upgrade a few dependencies across the repo (#968)
+ github.com/go-git/go-git/v5 5.16.2->5.18.0 (bsc#1264923, CVE-2026-41506)
+ github.com/go-jose/go-jose/v4 4.1.3->4.1.4 (bsc#1262926, CVE-2026-34986)
+ github.com/go-viper/mapstructure/v2 2.3.0->2.4.0
+ go.opentelemetry.io/otel 1.40.0->1.41.0
+ go.opentelemetry.io/otel/sdk 1.39.0->1.43.0
- from version 20260504.01
* bump github.com/docker/cli to 29.2.0 (#962)
- from version 20260504.00
* Bump github.com/opencontainers/selinux (#960)
- Update to version 20260428.00
* Add/improve unit tests for agentendpoint/agentendpoint.go (#930)
- from version 20260427.03
* Cover config/file.go by unit tests (#935)
- from version 20260422.01
* Cover patch_linux.go by unit tests (#932)
- from version 20260422.00
* upgrade grpc package in main package and e2e tests (#959)
(bsc#1260264, CVE-2026-33186)
- from version 20260417.04
* Bump OSV-Scalibr version to v0.4.3 (#956)
- from version 20260417.03
* Add unit tests for updates_linux.go (#937)
- from version 20260417.02
* Add zone to CreateDisk step (#955)
- from version 20260417.01
* Change disk type for deb11 (#954)
- from version 20260417.00
* Add unit tests for policies/apt.go PART 1 (#950)
- from version 20260410.02
* Add unit tests for packages/pty_linux.go (#943)
- from version 20260410.01
* fix disk type for arm workflows (#948)
- from version 20260410.00
* Change machine type for arm based workflows (#946)
- Update to version 20260330.00
* bump timeouts for all workflows (#940)
- from version 20260326.00
* Cover exec_resource.go by unit tests (#934)
- from version 20260318.00
* Integrate OSConfig agent with ReportVmInventory (#923)
- from version 20260313.02
* remove cacheonly flag from yum upgrade (#924)
- from version 20260313.01
* conditions python version override (#927)
- from version 20260313.00
* Fix presubmits by explicitly set python version for rpm based systems (#926)
- from version 20260311.00
* Bump osconfig version (#922)
- from version 20260309.02
* Extend OSV scalibr extractor (#921)
- from version 20260309.01
* upgrade golang.org/x/crypto and it's transitive deps (#918)
- from version 20260309.00
* Add purl to pkg info (#920)
- from version 20260306.00
* Add 'Type' field to PkgInfo (#919)
- from version 20260303.01
* Upgrade go.opentelemetry.io/otel/sdk (#913)
- from version 20260303.00
* Bump github.com/vbatts/tar-split from 0.11.5 to 0.12.2 (#908)
- from version 20260302.00
* Bump github.com/spdx/tools-golang from 0.5.3 to 0.5.7 (#906)
- from version 20260126.00
* Bump go.opentelemetry.io/otel/sdk from 1.38.0 to 1.39.0 (#905)
* Bump github.com/sirupsen/logrus (#894)
- Update to version 20260119.00
* Bump cloud.google.com/go/storage from 1.56.0 to 1.58.0 (#899)
- Update to version 20251230.00
* chore: Migrate gsutil usage to gcloud storage (#904)
- from version 20251223.00
* fix e2e tests for report inventory (#903)
- from version 20251222.01
* Revert "Bump cloud.google.com/go/longrunning from 0.6.3 to 0.7.0 (#882)" (#902)
- from version 20251222.00
* Bump golang to the new version (#900)
- from version 20251218.00
* add new CODEOWNERS (#901)
- from version 20251217.00
* Bump cloud.google.com/go/longrunning from 0.6.3 to 0.7.0 (#882)
- Bump the golang compiler version to 1.24.5
- Update to version 20251202.00
* Revert "Bump github.com/spdx/tools-golang from 0.5.3 to 0.5.5 (#887)" (#893)
- Update to version 20251201.00
* Revert "Bump github.com/containerd/containerd (#890)" (#892)
- Update to version 20251126.00
* Bump github.com/containerd/containerd (#890)
* Bump github.com/spdx/tools-golang from 0.5.3 to 0.5.5 (#887)
- Update to version 20251028.00
* Bump go.opentelemetry.io/otel/sdk/metric from 1.35.0 to 1.38.0 (#886)
* Bump github.com/tidwall/pretty from 1.2.0 to 1.2.1 (#880)
- from version 20251023.02
* Create multiple_os.yaml (#883)
- from version 20251023.00
* Bump github.com/docker/go-connections from 0.4.0 to 0.6.0 (#877)
* Add test runner for e2e tests (#876)
- Update to version 20250925.00
* Bump cloud.google.com/go/auth/oauth2adapt from 0.2.7 to 0.2.8 (#870)
* Bump google.golang.org/protobuf from 1.36.6 to 1.36.9 (#874)
* Bump go.opentelemetry.io/otel from 1.35.0 to 1.38.0 (#872)
* Bump github.com/golang/glog from 1.2.4 to 1.2.5 (#830)
- Update to version 20250902.01
* Bump github.com/googleapis/enterprise-certificate-proxy (#829)
- from version 20250902.00
* update github.com/go-jose/go-jose/v4 (#869)
* Upgrade scalibr and other deps (#866)
- from version 20250901.00
* Fix possibility of path traversal for zip and tar archival (#868)
- from version 20250825.00
* set CODEOWNERS file as required by org (#863)
- from version 20250819.00
* Fix/rhel10 build centos image (#860)
- from version 20250814.00
* Fix/rhel10 build image (#859)
- from version 20250813.00
* Fix: Add RHEL 10 support to RPM startup script (#858)
- from version 20250811.00
* Remove old/sles-15-sp4-sap as image is deprecated (#857)
- Update to version 20250806.00
* Fixed JSON identifier for the universe domain (#855)
- from version 20250729.00
* Bump github.com/google/s2a-go from 0.1.8 to 0.1.9 (#828)
- from version 20250725.02
* Update utils.go (#854)
* Upgrade golang.org/x/oauth2 package to the latest. (#853)
* Bump golang.org/x/time from 0.9.0 to 0.12.0 (#839)
- from version 20250725.01
* Bump golang.org/x/oauth2 (#848)
* Port fix for debian 11 to goo package manager. (#852)
- from version 20250725.00
* Update Golang version in common.sh and skip backports
repo for debian 11 (#850)
- from version 20250723.01
* Add workflows to build package for el10 (#849)
- from version 20250721.00
* Make OS Config agent TPC aware (#846)
- from version 20250718.00
* Create workflows for new Debian 13. (#847)
- Update to version 20250703.00
* Fix sles images (#844)
- from version 20250702.00
* Remove rhel-sap 8-4 add rhel-sap 8-10 (#843)
- from version 20250701.00
* Bump the go_modules group across 1 directory with 2 updates (#840)
- Update to version 20250606.00
* Change base docker images Google's official base images. (#838)
- Update to version 20250523.01
* Add a simple no-op OS policy for user testing (#837)
- from version 20250523.00
* Introduce scalibr inventory extractor for dpkg/rpm/cos
os/filesystem extractors (linux) (#834)
* Trace GetInstalledPackages memory levels (#835)
- from version 20250520.00
- Update to version 20250513.00
* Fix rpm extractor, handle (none) value correctly. (#833)
- from version 20250512.01
* Bump github.com/envoyproxy/go-control-plane from 0.13.1 to 0.13.4 (#816)
- from version 20250512.00
* Bump golang.org/x/net from 0.39.0 to 0.40.0 (#819)
- from version 20250508.01
* cosmetic refactoring to osinfo package (#826)
- from version 20250508.00
* Refactor /inventory with dependency injection (#825)
* Add debian, ubuntu (InstalledDebPackages) snapshots (#821)
* cover packages_linux.go file with tests (#824)
* Add debian (10,11,12) GetPackageUpdates output snapshots (#822)
- from version 20250507.00
* Add InstalledRPMPackages snapshot tests (#823)
- from version 20250506.02
* Yum tests: simplify initialization of exit errors (#820)
- from version 20250506.01
* Improve test coverage for gem package manager (#818)
- from version 20250506.00
* after go/x/crypto update 0.32.0 -> 0.37.0 (#817)
- from version 20250505.01
* Improve packages package coverage (#814)
* Bump golang.org/x/net from 0.34.0 to 0.39.0 (#807)
- from version 20250505.00
* Bump golang.org/x/crypto from 0.32.0 to 0.37.0 (#806)
- from version 20250430.00
* Snapshot YumUpdates (GetPackageUpdates) output (#813)
- from version 20250428.00
* Snapshot ZypperPatches, ZypperUpdates (GetPackageUpdates) output
for sles 12, 15 testdata (#812)
- from version 20250423.00
* Introduce MatchSnapshot large test results matcher function, snapshot
apt-deb GetPackageUpdates (#811)
- from version 20250416.02
* defaultSleeper: tolerate 10% difference to reduce test flakiness (#810)
* Add output of some packagemanagers to the testdata (#808)
- from version 20250416.01
* Refactor OS Info package (#809)
- from version 20250416.00
* Report RPM inventory as YUM instead of empty SoftwarePackage
when neither Zypper nor YUM are installed. (#805)
- from version 20250414.00
* Update hash computation algorithm (#799)
- Update to version 20250320.00
* Bump github.com/envoyproxy/protoc-gen-validate from 1.1.0 to 1.2.1 (#797)
- from version 20250318.00
* Bump go.opentelemetry.io/otel/sdk/metric from 1.32.0 to 1.35.0 (#793)
- from version 20250317.02
* Bump cel.dev/expr from 0.18.0 to 0.22.0 (#792)
* Bump github.com/golang/glog from 1.2.3 to 1.2.4 in the go_modules group (#785)
- from version 20250317.01
* Bump cloud.google.com/go/logging from 1.12.0 to 1.13.0 (#774)
- from version 20250317.00
* Add tests for retryutil package. (#795)
- from version 20250306.00
* Update OWNERS (#794)
- from version 20250206.01
* Use separate counters for pre- and post-patch reboots. (#788)
- from version 20250206.00
* Update owners (#789)
- from version 20250203.00
* Fix the vet errors for contants in logging (#786)
- from version 20250122.00
* change available package check (#783)
- from version 20250121.00
* Fix Inventory reporting e2e tests. (#782)
- from version 20250120.00
* fix e2e tests (#781)
- Add -buildmode=pie to go build command line (bsc#1239948)
- from version 20240501.00 (bsc#1236533, CVE-2023-45288)
Patchnames: SUSE-SLE-Micro-6.0-764
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
5.3 (Medium)
Affected products
Recommended
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
7.1 (High)
Affected products
Recommended
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
5.3 (Medium)
Affected products
Recommended
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
5.3 (Medium)
Affected products
Recommended
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
8.1 (High)
Affected products
Recommended
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.4 (High)
Affected products
Recommended
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
6.5 (Medium)
Affected products
Recommended
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.1 (High)
Affected products
Recommended
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
6.5 (Medium)
Affected products
Recommended
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.1 (High)
Affected products
Recommended
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.4 (High)
Affected products
Recommended
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.7 (High)
Affected products
Recommended
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
6.5 (Medium)
Affected products
Recommended
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
8.1 (High)
Affected products
Recommended
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.1 (High)
Affected products
Recommended
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
References
89 references
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for google-osconfig-agent",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for google-osconfig-agent fixes the following issues\n\n- CVE-2023-45288: golang.org/x/net/http2: close connections when receiving too many headers (bsc#1236533).\n- CVE-2025-47911: golang.org/x/net/html: various algorithms with quadratic complexity when parsing HTML documents\n (bsc#1251453).\n- CVE-2025-58190: golang.org/x/net/html: excessive memory consumption by `html.ParseFragment` when processing specially\n crafted input (bsc#1251704).\n- CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo-\n header (bsc#1260264).\n- CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE\n (bsc#1265762).\n- CVE-2026-34986: github.com/go-jose/go-jose/v4: crafted JWE input with a missing encrypted key can lead to a denial of\n service (bsc#1262926).\n- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation\n bypass and privilege escalation (bsc#1266603).\n- CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266171).\n- CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266171).\n- CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266171).\n- CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh\n (bsc#1266171).\n- CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh\n (bsc#1266171).\n- CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent \n (bsc#1266171).\n- CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266171).\n- CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266171).\n- CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266171).\n- CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts\n (bsc#1266171).\n- CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh\n (bsc#1266171).\n- CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266171).\n- CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266171).\n- CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during\n smart-HTTP clone and fetch operations (bsc#1264923).\n\nChanges for google-osconfig-agent:\n\n- Update to version 20260615.01\n * Upgrade golang.org/x/crypto \u0026 golang.org/x/net (#1006)\n- from version 20260615.00\n * Add unit tests for ospatch_apt_upgrade.go (#938)\n- Update to version 20260611.00\n * Add unit tests for policies/policies.go PART 5 (#998)\n- from version 20260610.00\n * Add unit tests for policies/policies.go PART 4 (#997)\n- from version 20260609.02\n * squash commits (#936)\n- from version 20260609.01\n * Add unit tests for policies/policies.go PART 3 (#996)\n- from version 20260609.00\n * Add unit tests for policies/policies.go PART 2 (#991)\n- from version 20260602.01\n * Align format of dates and timestamp collected across Windows packages (#973)\n- from version 20260602.00\n * Add unit tests for config/config,go (#979)\n- from version 20260528.00\n * Bump github.com/containerd/containerd (#990)\n- from version 20260521.00\n * Cover agentconfig functionality by unit tests (#925)\n- from version 20260520.04\n * Add unit tests for policies/googet.go (#961)\n * Bump github.com/go-git/go-git/v5 (#987)\n- from version 20260520.02\n * Add unit tests for policies/yum.go (#952)\n * Add unit tests for policies/apt.go PART 3 (#951)\n- from version 20260520.00\n * Add unit tests for policies/zypper.go (#953)\n- from version 20260519.00\n * Add unit tests for policies/policies.go PART 1 (#949)\n- from version 20260513.01\n * Bump github.com/go-git/go-git/v5 (#981), this also updates\n golang.org/x/net to v0.53.0 (bsc#1265762, CVE-2026-33814)\n- from version 20260513.00\n * upgrade a few packages (#980)\n- from version 20260512.02\n * Add/improve unit tests for agentendpoint/exec_task.go (#933)\n- from version 20260512.01\n * Cover google_update.go by unit tests (#941)\n- from version 20260512.00\n * Change zone for arm64 builds because of stockout (#978)\n- Update to version 20260511.00\n * switch to t2a-standard-2 on ARM package build (#977)\n- from version 20260505.03\n * Cover zypper_patch by unit tests (#958)\n- from version 20260505.02\n * Remove unused functions DisableAutoUpdates (#970)\n- from version 20260505.01\n * Bump go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc (#966)\n- from version 20260505.00\n * Upgrade a few dependencies across the repo (#968)\n + github.com/go-git/go-git/v5 5.16.2-\u003e5.18.0 (bsc#1264923, CVE-2026-41506)\n + github.com/go-jose/go-jose/v4 4.1.3-\u003e4.1.4 (bsc#1262926, CVE-2026-34986)\n + github.com/go-viper/mapstructure/v2 2.3.0-\u003e2.4.0\n + go.opentelemetry.io/otel 1.40.0-\u003e1.41.0\n + go.opentelemetry.io/otel/sdk 1.39.0-\u003e1.43.0\n- from version 20260504.01\n * bump github.com/docker/cli to 29.2.0 (#962)\n- from version 20260504.00\n * Bump github.com/opencontainers/selinux (#960)\n- Update to version 20260428.00\n * Add/improve unit tests for agentendpoint/agentendpoint.go (#930)\n- from version 20260427.03\n * Cover config/file.go by unit tests (#935)\n- from version 20260422.01\n * Cover patch_linux.go by unit tests (#932)\n- from version 20260422.00\n * upgrade grpc package in main package and e2e tests (#959)\n (bsc#1260264, CVE-2026-33186)\n- from version 20260417.04\n * Bump OSV-Scalibr version to v0.4.3 (#956)\n- from version 20260417.03\n * Add unit tests for updates_linux.go (#937)\n- from version 20260417.02\n * Add zone to CreateDisk step (#955)\n- from version 20260417.01\n * Change disk type for deb11 (#954)\n- from version 20260417.00\n * Add unit tests for policies/apt.go PART 1 (#950)\n- from version 20260410.02\n * Add unit tests for packages/pty_linux.go (#943)\n- from version 20260410.01\n * fix disk type for arm workflows (#948)\n- from version 20260410.00\n * Change machine type for arm based workflows (#946)\n- Update to version 20260330.00\n * bump timeouts for all workflows (#940)\n- from version 20260326.00\n * Cover exec_resource.go by unit tests (#934)\n- from version 20260318.00\n * Integrate OSConfig agent with ReportVmInventory (#923)\n- from version 20260313.02\n * remove cacheonly flag from yum upgrade (#924)\n- from version 20260313.01\n * conditions python version override (#927)\n- from version 20260313.00\n * Fix presubmits by explicitly set python version for rpm based systems (#926)\n- from version 20260311.00\n * Bump osconfig version (#922)\n- from version 20260309.02\n * Extend OSV scalibr extractor (#921)\n- from version 20260309.01\n * upgrade golang.org/x/crypto and it\u0027s transitive deps (#918)\n- from version 20260309.00\n * Add purl to pkg info (#920)\n- from version 20260306.00\n * Add \u0027Type\u0027 field to PkgInfo (#919)\n- from version 20260303.01\n * Upgrade go.opentelemetry.io/otel/sdk (#913)\n- from version 20260303.00\n * Bump github.com/vbatts/tar-split from 0.11.5 to 0.12.2 (#908)\n- from version 20260302.00\n * Bump github.com/spdx/tools-golang from 0.5.3 to 0.5.7 (#906)\n- from version 20260126.00\n * Bump go.opentelemetry.io/otel/sdk from 1.38.0 to 1.39.0 (#905)\n * Bump github.com/sirupsen/logrus (#894)\n- Update to version 20260119.00\n * Bump cloud.google.com/go/storage from 1.56.0 to 1.58.0 (#899)\n- Update to version 20251230.00\n * chore: Migrate gsutil usage to gcloud storage (#904)\n- from version 20251223.00\n * fix e2e tests for report inventory (#903)\n- from version 20251222.01\n * Revert \"Bump cloud.google.com/go/longrunning from 0.6.3 to 0.7.0 (#882)\" (#902)\n- from version 20251222.00\n * Bump golang to the new version (#900)\n- from version 20251218.00\n * add new CODEOWNERS (#901)\n- from version 20251217.00\n * Bump cloud.google.com/go/longrunning from 0.6.3 to 0.7.0 (#882)\n- Bump the golang compiler version to 1.24.5\n- Update to version 20251202.00\n * Revert \"Bump github.com/spdx/tools-golang from 0.5.3 to 0.5.5 (#887)\" (#893)\n- Update to version 20251201.00\n * Revert \"Bump github.com/containerd/containerd (#890)\" (#892)\n- Update to version 20251126.00\n * Bump github.com/containerd/containerd (#890)\n * Bump github.com/spdx/tools-golang from 0.5.3 to 0.5.5 (#887)\n- Update to version 20251028.00\n * Bump go.opentelemetry.io/otel/sdk/metric from 1.35.0 to 1.38.0 (#886)\n * Bump github.com/tidwall/pretty from 1.2.0 to 1.2.1 (#880)\n- from version 20251023.02\n * Create multiple_os.yaml (#883)\n- from version 20251023.00\n * Bump github.com/docker/go-connections from 0.4.0 to 0.6.0 (#877)\n * Add test runner for e2e tests (#876)\n- Update to version 20250925.00\n * Bump cloud.google.com/go/auth/oauth2adapt from 0.2.7 to 0.2.8 (#870)\n * Bump google.golang.org/protobuf from 1.36.6 to 1.36.9 (#874)\n * Bump go.opentelemetry.io/otel from 1.35.0 to 1.38.0 (#872)\n * Bump github.com/golang/glog from 1.2.4 to 1.2.5 (#830)\n- Update to version 20250902.01\n * Bump github.com/googleapis/enterprise-certificate-proxy (#829)\n- from version 20250902.00\n * update github.com/go-jose/go-jose/v4 (#869)\n * Upgrade scalibr and other deps (#866)\n- from version 20250901.00\n * Fix possibility of path traversal for zip and tar archival (#868)\n- from version 20250825.00\n * set CODEOWNERS file as required by org (#863)\n- from version 20250819.00\n * Fix/rhel10 build centos image (#860)\n- from version 20250814.00\n * Fix/rhel10 build image (#859)\n- from version 20250813.00\n * Fix: Add RHEL 10 support to RPM startup script (#858)\n- from version 20250811.00\n * Remove old/sles-15-sp4-sap as image is deprecated (#857)\n- Update to version 20250806.00\n * Fixed JSON identifier for the universe domain (#855)\n- from version 20250729.00\n * Bump github.com/google/s2a-go from 0.1.8 to 0.1.9 (#828)\n- from version 20250725.02\n * Update utils.go (#854)\n * Upgrade golang.org/x/oauth2 package to the latest. (#853)\n * Bump golang.org/x/time from 0.9.0 to 0.12.0 (#839)\n- from version 20250725.01\n * Bump golang.org/x/oauth2 (#848)\n * Port fix for debian 11 to goo package manager. (#852)\n- from version 20250725.00\n * Update Golang version in common.sh and skip backports\n repo for debian 11 (#850)\n- from version 20250723.01\n * Add workflows to build package for el10 (#849)\n- from version 20250721.00\n * Make OS Config agent TPC aware (#846)\n- from version 20250718.00\n * Create workflows for new Debian 13. (#847)\n- Update to version 20250703.00\n * Fix sles images (#844)\n- from version 20250702.00\n * Remove rhel-sap 8-4 add rhel-sap 8-10 (#843)\n- from version 20250701.00\n * Bump the go_modules group across 1 directory with 2 updates (#840)\n- Update to version 20250606.00\n * Change base docker images Google\u0027s official base images. (#838)\n- Update to version 20250523.01\n * Add a simple no-op OS policy for user testing (#837)\n- from version 20250523.00\n * Introduce scalibr inventory extractor for dpkg/rpm/cos\n os/filesystem extractors (linux) (#834)\n * Trace GetInstalledPackages memory levels (#835)\n- from version 20250520.00\n- Update to version 20250513.00\n * Fix rpm extractor, handle (none) value correctly. (#833)\n- from version 20250512.01\n * Bump github.com/envoyproxy/go-control-plane from 0.13.1 to 0.13.4 (#816)\n- from version 20250512.00\n * Bump golang.org/x/net from 0.39.0 to 0.40.0 (#819)\n- from version 20250508.01\n * cosmetic refactoring to osinfo package (#826)\n- from version 20250508.00\n * Refactor /inventory with dependency injection (#825)\n * Add debian, ubuntu (InstalledDebPackages) snapshots (#821)\n * cover packages_linux.go file with tests (#824)\n * Add debian (10,11,12) GetPackageUpdates output snapshots (#822)\n- from version 20250507.00\n * Add InstalledRPMPackages snapshot tests (#823)\n- from version 20250506.02\n * Yum tests: simplify initialization of exit errors (#820)\n- from version 20250506.01\n * Improve test coverage for gem package manager (#818)\n- from version 20250506.00\n * after go/x/crypto update 0.32.0 -\u003e 0.37.0 (#817)\n- from version 20250505.01\n * Improve packages package coverage (#814)\n * Bump golang.org/x/net from 0.34.0 to 0.39.0 (#807)\n- from version 20250505.00\n * Bump golang.org/x/crypto from 0.32.0 to 0.37.0 (#806)\n- from version 20250430.00\n * Snapshot YumUpdates (GetPackageUpdates) output (#813)\n- from version 20250428.00\n * Snapshot ZypperPatches, ZypperUpdates (GetPackageUpdates) output\n for sles 12, 15 testdata (#812)\n- from version 20250423.00\n * Introduce MatchSnapshot large test results matcher function, snapshot\n apt-deb GetPackageUpdates (#811)\n- from version 20250416.02\n * defaultSleeper: tolerate 10% difference to reduce test flakiness (#810)\n * Add output of some packagemanagers to the testdata (#808)\n- from version 20250416.01\n * Refactor OS Info package (#809)\n- from version 20250416.00\n * Report RPM inventory as YUM instead of empty SoftwarePackage\n when neither Zypper nor YUM are installed. (#805)\n- from version 20250414.00\n * Update hash computation algorithm (#799)\n- Update to version 20250320.00\n * Bump github.com/envoyproxy/protoc-gen-validate from 1.1.0 to 1.2.1 (#797)\n- from version 20250318.00\n * Bump go.opentelemetry.io/otel/sdk/metric from 1.32.0 to 1.35.0 (#793)\n- from version 20250317.02\n * Bump cel.dev/expr from 0.18.0 to 0.22.0 (#792)\n * Bump github.com/golang/glog from 1.2.3 to 1.2.4 in the go_modules group (#785)\n- from version 20250317.01\n * Bump cloud.google.com/go/logging from 1.12.0 to 1.13.0 (#774)\n- from version 20250317.00\n * Add tests for retryutil package. (#795)\n- from version 20250306.00\n * Update OWNERS (#794)\n- from version 20250206.01\n * Use separate counters for pre- and post-patch reboots. (#788)\n- from version 20250206.00\n * Update owners (#789)\n- from version 20250203.00\n * Fix the vet errors for contants in logging (#786)\n- from version 20250122.00\n * change available package check (#783)\n- from version 20250121.00\n * Fix Inventory reporting e2e tests. (#782)\n- from version 20250120.00\n * fix e2e tests (#781)\n- Add -buildmode=pie to go build command line (bsc#1239948)\n- from version 20240501.00 (bsc#1236533, CVE-2023-45288)\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-SLE-Micro-6.0-764",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_22242-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2026:22242-1",
"url": "https://www.suse.com/support/update/announcement/2026/suse-su-202622242-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2026:22242-1",
"url": "https://lists.suse.com/pipermail/sle-updates/2026-June/047622.html"
},
{
"category": "self",
"summary": "SUSE Bug 1210938",
"url": "https://bugzilla.suse.com/1210938"
},
{
"category": "self",
"summary": "SUSE Bug 1236533",
"url": "https://bugzilla.suse.com/1236533"
},
{
"category": "self",
"summary": "SUSE Bug 1239948",
"url": "https://bugzilla.suse.com/1239948"
},
{
"category": "self",
"summary": "SUSE Bug 1244304",
"url": "https://bugzilla.suse.com/1244304"
},
{
"category": "self",
"summary": "SUSE Bug 1244503",
"url": "https://bugzilla.suse.com/1244503"
},
{
"category": "self",
"summary": "SUSE Bug 1251453",
"url": "https://bugzilla.suse.com/1251453"
},
{
"category": "self",
"summary": "SUSE Bug 1251704",
"url": "https://bugzilla.suse.com/1251704"
},
{
"category": "self",
"summary": "SUSE Bug 1260264",
"url": "https://bugzilla.suse.com/1260264"
},
{
"category": "self",
"summary": "SUSE Bug 1262926",
"url": "https://bugzilla.suse.com/1262926"
},
{
"category": "self",
"summary": "SUSE Bug 1264923",
"url": "https://bugzilla.suse.com/1264923"
},
{
"category": "self",
"summary": "SUSE Bug 1265762",
"url": "https://bugzilla.suse.com/1265762"
},
{
"category": "self",
"summary": "SUSE Bug 1266171",
"url": "https://bugzilla.suse.com/1266171"
},
{
"category": "self",
"summary": "SUSE Bug 1266603",
"url": "https://bugzilla.suse.com/1266603"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2023-45288 page",
"url": "https://www.suse.com/security/cve/CVE-2023-45288/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-45339 page",
"url": "https://www.suse.com/security/cve/CVE-2024-45339/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-22868 page",
"url": "https://www.suse.com/security/cve/CVE-2025-22868/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-47911 page",
"url": "https://www.suse.com/security/cve/CVE-2025-47911/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-58190 page",
"url": "https://www.suse.com/security/cve/CVE-2025-58190/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-33186 page",
"url": "https://www.suse.com/security/cve/CVE-2026-33186/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-33814 page",
"url": "https://www.suse.com/security/cve/CVE-2026-33814/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-34986 page",
"url": "https://www.suse.com/security/cve/CVE-2026-34986/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39821 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39821/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39827 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39827/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39828 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39828/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39829 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39829/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39830 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39830/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39831 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39831/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39832 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39832/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39833 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39833/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39834 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39834/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-39835 page",
"url": "https://www.suse.com/security/cve/CVE-2026-39835/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-41506 page",
"url": "https://www.suse.com/security/cve/CVE-2026-41506/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-42508 page",
"url": "https://www.suse.com/security/cve/CVE-2026-42508/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-46595 page",
"url": "https://www.suse.com/security/cve/CVE-2026-46595/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-46597 page",
"url": "https://www.suse.com/security/cve/CVE-2026-46597/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-46598 page",
"url": "https://www.suse.com/security/cve/CVE-2026-46598/"
}
],
"title": "Security update for google-osconfig-agent",
"tracking": {
"current_release_date": "2026-06-22T09:09:04Z",
"generator": {
"date": "2026-06-22T09:09:04Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2026:22242-1",
"initial_release_date": "2026-06-22T09:09:04Z",
"revision_history": [
{
"date": "2026-06-22T09:09:04Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "google-osconfig-agent-20260615.01-1.1.aarch64",
"product": {
"name": "google-osconfig-agent-20260615.01-1.1.aarch64",
"product_id": "google-osconfig-agent-20260615.01-1.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "google-osconfig-agent-20260615.01-1.1.s390x",
"product": {
"name": "google-osconfig-agent-20260615.01-1.1.s390x",
"product_id": "google-osconfig-agent-20260615.01-1.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "google-osconfig-agent-20260615.01-1.1.x86_64",
"product": {
"name": "google-osconfig-agent-20260615.01-1.1.x86_64",
"product_id": "google-osconfig-agent-20260615.01-1.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Micro 6.0",
"product": {
"name": "SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sl-micro:6.0"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "google-osconfig-agent-20260615.01-1.1.aarch64 as component of SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64"
},
"product_reference": "google-osconfig-agent-20260615.01-1.1.aarch64",
"relates_to_product_reference": "SUSE Linux Micro 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-osconfig-agent-20260615.01-1.1.s390x as component of SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x"
},
"product_reference": "google-osconfig-agent-20260615.01-1.1.s390x",
"relates_to_product_reference": "SUSE Linux Micro 6.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "google-osconfig-agent-20260615.01-1.1.x86_64 as component of SUSE Linux Micro 6.0",
"product_id": "SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
},
"product_reference": "google-osconfig-agent-20260615.01-1.1.x86_64",
"relates_to_product_reference": "SUSE Linux Micro 6.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2023-45288",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2023-45288"
}
],
"notes": [
{
"category": "general",
"text": "An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. Maintaining HPACK state requires parsing and processing all HEADERS and CONTINUATION frames on a connection. When a request\u0027s headers exceed MaxHeaderBytes, no memory is allocated to store the excess headers, but they are still parsed. This permits an attacker to cause an HTTP/2 endpoint to read arbitrary amounts of header data, all associated with a request which is going to be rejected. These headers can include Huffman-encoded data which is significantly more expensive for the receiver to decode than for an attacker to send. The fix sets a limit on the amount of excess header frames we will process before closing a connection.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2023-45288",
"url": "https://www.suse.com/security/cve/CVE-2023-45288"
},
{
"category": "external",
"summary": "SUSE Bug 1221400 for CVE-2023-45288",
"url": "https://bugzilla.suse.com/1221400"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-22T09:09:04Z",
"details": "moderate"
}
],
"title": "CVE-2023-45288"
},
{
"cve": "CVE-2024-45339",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-45339"
}
],
"notes": [
{
"category": "general",
"text": "When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process\u0027s log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix that, glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-45339",
"url": "https://www.suse.com/security/cve/CVE-2024-45339"
},
{
"category": "external",
"summary": "SUSE Bug 1236541 for CVE-2024-45339",
"url": "https://bugzilla.suse.com/1236541"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-22T09:09:04Z",
"details": "important"
}
],
"title": "CVE-2024-45339"
},
{
"cve": "CVE-2025-22868",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-22868"
}
],
"notes": [
{
"category": "general",
"text": "An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-22868",
"url": "https://www.suse.com/security/cve/CVE-2025-22868"
},
{
"category": "external",
"summary": "SUSE Bug 1239185 for CVE-2025-22868",
"url": "https://bugzilla.suse.com/1239185"
},
{
"category": "external",
"summary": "SUSE Bug 1239186 for CVE-2025-22868",
"url": "https://bugzilla.suse.com/1239186"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-22T09:09:04Z",
"details": "important"
}
],
"title": "CVE-2025-22868"
},
{
"cve": "CVE-2025-47911",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-47911"
}
],
"notes": [
{
"category": "general",
"text": "The html.Parse function in golang.org/x/net/html has quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-47911",
"url": "https://www.suse.com/security/cve/CVE-2025-47911"
},
{
"category": "external",
"summary": "SUSE Bug 1251308 for CVE-2025-47911",
"url": "https://bugzilla.suse.com/1251308"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-22T09:09:04Z",
"details": "moderate"
}
],
"title": "CVE-2025-47911"
},
{
"cve": "CVE-2025-58190",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-58190"
}
],
"notes": [
{
"category": "general",
"text": "The html.Parse function in golang.org/x/net/html has an infinite parsing loop when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-58190",
"url": "https://www.suse.com/security/cve/CVE-2025-58190"
},
{
"category": "external",
"summary": "SUSE Bug 1251309 for CVE-2025-58190",
"url": "https://bugzilla.suse.com/1251309"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-22T09:09:04Z",
"details": "moderate"
}
],
"title": "CVE-2025-58190"
},
{
"cve": "CVE-2026-33186",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-33186"
}
],
"notes": [
{
"category": "general",
"text": "gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the `:path` omitted the mandatory leading slash (e.g., `Service/Method` instead of `/Service/Method`). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official `grpc/authz` package) evaluated the raw, non-canonical path string. Consequently, \"deny\" rules defined using canonical paths (starting with `/`) failed to match the incoming request, allowing it to bypass the policy if a fallback \"allow\" rule was present. This affects gRPC-Go servers that use path-based authorization interceptors, such as the official RBAC implementation in `google.golang.org/grpc/authz` or custom interceptors relying on `info.FullMethod` or `grpc.Method(ctx)`; AND that have a security policy contains specific \"deny\" rules for canonical paths but allows other requests by default (a fallback \"allow\" rule). The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed `:path` headers directly to the gRPC server. The fix in version 1.79.3 ensures that any request with a `:path` that does not start with a leading slash is immediately rejected with a `codes.Unimplemented` error, preventing it from reaching authorization interceptors or handlers with a non-canonical path string. While upgrading is the most secure and recommended path, users can mitigate the vulnerability using one of the following methods: Use a validating interceptor (recommended mitigation); infrastructure-level normalization; and/or policy hardening.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-33186",
"url": "https://www.suse.com/security/cve/CVE-2026-33186"
},
{
"category": "external",
"summary": "SUSE Bug 1260085 for CVE-2026-33186",
"url": "https://bugzilla.suse.com/1260085"
},
{
"category": "external",
"summary": "SUSE Bug 1268676 for CVE-2026-33186",
"url": "https://bugzilla.suse.com/1268676"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-22T09:09:04Z",
"details": "important"
}
],
"title": "CVE-2026-33186"
},
{
"cve": "CVE-2026-33814",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-33814"
}
],
"notes": [
{
"category": "general",
"text": "When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-33814",
"url": "https://www.suse.com/security/cve/CVE-2026-33814"
},
{
"category": "external",
"summary": "SUSE Bug 1264506 for CVE-2026-33814",
"url": "https://bugzilla.suse.com/1264506"
},
{
"category": "external",
"summary": "SUSE Bug 1268758 for CVE-2026-33814",
"url": "https://bugzilla.suse.com/1268758"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-22T09:09:04Z",
"details": "important"
}
],
"title": "CVE-2026-33814"
},
{
"cve": "CVE-2026-34986",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-34986"
}
],
"notes": [
{
"category": "general",
"text": "Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. Prior to 4.1.4 and 3.0.5, decrypting a JSON Web Encryption (JWE) object will panic if the alg field indicates a key wrapping algorithm (one ending in KW, with the exception of A128GCMKW, A192GCMKW, and A256GCMKW) and the encrypted_key field is empty. The panic happens when cipher.KeyUnwrap() in key_wrap.go attempts to allocate a slice with a zero or negative length based on the length of the encrypted_key. This code path is reachable from ParseEncrypted() / ParseEncryptedJSON() / ParseEncryptedCompact() followed by Decrypt() on the resulting object. Note that the parse functions take a list of accepted key algorithms. If the accepted key algorithms do not include any key wrapping algorithms, parsing will fail and the application will be unaffected. This panic is also reachable by calling cipher.KeyUnwrap() directly with any ciphertext parameter less than 16 bytes long, but calling this function directly is less common. Panics can lead to denial of service. This vulnerability is fixed in 4.1.4 and 3.0.5.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-34986",
"url": "https://www.suse.com/security/cve/CVE-2026-34986"
},
{
"category": "external",
"summary": "SUSE Bug 1262805 for CVE-2026-34986",
"url": "https://bugzilla.suse.com/1262805"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-22T09:09:04Z",
"details": "important"
}
],
"title": "CVE-2026-34986"
},
{
"cve": "CVE-2026-39821",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39821"
}
],
"notes": [
{
"category": "general",
"text": "The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode(\"xn--example-.com\") incorrectly returns the name \"example.com\" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject \"example.com\" but permit \"xn--example-.com\". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name \"example.com\".",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39821",
"url": "https://www.suse.com/security/cve/CVE-2026-39821"
},
{
"category": "external",
"summary": "SUSE Bug 1266474 for CVE-2026-39821",
"url": "https://bugzilla.suse.com/1266474"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-22T09:09:04Z",
"details": "important"
}
],
"title": "CVE-2026-39821"
},
{
"cve": "CVE-2026-39827",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39827"
}
],
"notes": [
{
"category": "general",
"text": "An authenticated SSH client that repeatedly opened channels which were rejected by the server caused unbounded memory growth, eventually crashing the server process and affecting all connected users. Rejected channels are now properly removed from the connection\u0027s internal state and released for garbage collection.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39827",
"url": "https://www.suse.com/security/cve/CVE-2026-39827"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39827",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-22T09:09:04Z",
"details": "important"
}
],
"title": "CVE-2026-39827"
},
{
"cve": "CVE-2026-39828",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39828"
}
],
"notes": [
{
"category": "general",
"text": "When an SSH server authentication callback returned PartialSuccessError with non-nil Permissions, those permissions were silently discarded, potentially dropping certificate restrictions such as force-command after a second factor succeeded. Returning non-nil Permissions with PartialSuccessError now results in a connection error.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39828",
"url": "https://www.suse.com/security/cve/CVE-2026-39828"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39828",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-22T09:09:04Z",
"details": "important"
}
],
"title": "CVE-2026-39828"
},
{
"cve": "CVE-2026-39829",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39829"
}
],
"notes": [
{
"category": "general",
"text": "The RSA and DSA public key parsers did not enforce size limits on key parameters. A crafted public key with an excessively large modulus or DSA parameter could cause several minutes of CPU consumption during signature verification. This could be triggered by unauthenticated clients during public key authentication. RSA moduli are now limited to 8192 bits, and DSA parameters are validated per FIPS 186-2.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39829",
"url": "https://www.suse.com/security/cve/CVE-2026-39829"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39829",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-22T09:09:04Z",
"details": "important"
}
],
"title": "CVE-2026-39829"
},
{
"cve": "CVE-2026-39830",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39830"
}
],
"notes": [
{
"category": "general",
"text": "A malicious SSH peer could send unsolicited global request responses to fill an internal buffer, blocking the connection\u0027s read loop. The blocked goroutine could not be released by calling Close(), resulting in a resource leak per connection. Unsolicited global responses are now discarded.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39830",
"url": "https://www.suse.com/security/cve/CVE-2026-39830"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39830",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-22T09:09:04Z",
"details": "important"
}
],
"title": "CVE-2026-39830"
},
{
"cve": "CVE-2026-39831",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39831"
}
],
"notes": [
{
"category": "general",
"text": "The Verify() method for FIDO/U2F security key types (sk-ecdsa-sha2-nistp256@openssh.com, sk-ssh-ed25519@openssh.com) did not check the User Presence flag. Signatures generated without physical touch were accepted, allowing unattended use of a hardware security key. To restore the previous behavior, return a \"no-touch-required\" extension in Permissions.Extensions from PublicKeyCallback.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39831",
"url": "https://www.suse.com/security/cve/CVE-2026-39831"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39831",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-22T09:09:04Z",
"details": "important"
}
],
"title": "CVE-2026-39831"
},
{
"cve": "CVE-2026-39832",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39832"
}
],
"notes": [
{
"category": "general",
"text": "When adding a key to a remote agent constraint extensions such as restrict-destination-v00@openssh.com were not serialized in the request. Destination restrictions were silently stripped when forwarding keys, allowing unrestricted use of the key on the remote host. The client now serializes all constraint extensions. Additionally, the in-memory keyring returned by NewKeyring() now rejects keys with unsupported constraint extensions instead of silently ignoring them.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39832",
"url": "https://www.suse.com/security/cve/CVE-2026-39832"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39832",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-22T09:09:04Z",
"details": "important"
}
],
"title": "CVE-2026-39832"
},
{
"cve": "CVE-2026-39833",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39833"
}
],
"notes": [
{
"category": "general",
"text": "The in-memory keyring returned by NewKeyring() silently accepted keys with the ConfirmBeforeUse constraint but never enforced it. The key would sign without any confirmation prompt, with no indication to the caller that the constraint was not in effect. NewKeyring() now returns an error when unsupported constraints are requested.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39833",
"url": "https://www.suse.com/security/cve/CVE-2026-39833"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39833",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-22T09:09:04Z",
"details": "important"
}
],
"title": "CVE-2026-39833"
},
{
"cve": "CVE-2026-39834",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39834"
}
],
"notes": [
{
"category": "general",
"text": "When writing data larger than 4GB in a single Write call on an SSH channel, an integer overflow in the internal payload size calculation caused the write loop to spin indefinitely, sending empty packets without making progress. The size comparison now uses int64 to prevent truncation.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39834",
"url": "https://www.suse.com/security/cve/CVE-2026-39834"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39834",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-22T09:09:04Z",
"details": "important"
}
],
"title": "CVE-2026-39834"
},
{
"cve": "CVE-2026-39835",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-39835"
}
],
"notes": [
{
"category": "general",
"text": "SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. CertChecker now returns an error instead of panicking when these callbacks are nil.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-39835",
"url": "https://www.suse.com/security/cve/CVE-2026-39835"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-39835",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-22T09:09:04Z",
"details": "important"
}
],
"title": "CVE-2026-39835"
},
{
"cve": "CVE-2026-41506",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-41506"
}
],
"notes": [
{
"category": "general",
"text": "go-git is an extensible git implementation library written in pure Go. Prior to versions 5.18.0 and 6.0.0-alpha.2, go-git may leak HTTP authentication credentials when following redirects during smart-HTTP clone and fetch operations. This issue has been patched in versions 5.18.0 and 6.0.0-alpha.2.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-41506",
"url": "https://www.suse.com/security/cve/CVE-2026-41506"
},
{
"category": "external",
"summary": "SUSE Bug 1264854 for CVE-2026-41506",
"url": "https://bugzilla.suse.com/1264854"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-22T09:09:04Z",
"details": "moderate"
}
],
"title": "CVE-2026-41506"
},
{
"cve": "CVE-2026-42508",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-42508"
}
],
"notes": [
{
"category": "general",
"text": "Previously, a revoked \u0027SignatureKey\u0027 belonging to a CA was not correctly checked for revocation. Now, both the \u0027key\u0027 and \u0027key.SignatureKey\u0027 are checked for @revoked.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-42508",
"url": "https://www.suse.com/security/cve/CVE-2026-42508"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-42508",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-22T09:09:04Z",
"details": "important"
}
],
"title": "CVE-2026-42508"
},
{
"cve": "CVE-2026-46595",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-46595"
}
],
"notes": [
{
"category": "general",
"text": "Previously, CVE-2024-45337 fixed an authorization bypass for misused ssh server configurations; if any other type of callback is passed other than public key, then the source-address validation would be skipped.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-46595",
"url": "https://www.suse.com/security/cve/CVE-2026-46595"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-46595",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-22T09:09:04Z",
"details": "important"
}
],
"title": "CVE-2026-46595"
},
{
"cve": "CVE-2026-46597",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-46597"
}
],
"notes": [
{
"category": "general",
"text": "An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-46597",
"url": "https://www.suse.com/security/cve/CVE-2026-46597"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-46597",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-22T09:09:04Z",
"details": "important"
}
],
"title": "CVE-2026-46597"
},
{
"cve": "CVE-2026-46598",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-46598"
}
],
"notes": [
{
"category": "general",
"text": "For certain crafted inputs, a \u0027ed25519.PrivateKey\u0027 was created by casting malformed wire bytes, leading to a panic when used.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-46598",
"url": "https://www.suse.com/security/cve/CVE-2026-46598"
},
{
"category": "external",
"summary": "SUSE Bug 1266049 for CVE-2026-46598",
"url": "https://bugzilla.suse.com/1266049"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.aarch64",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.s390x",
"SUSE Linux Micro 6.0:google-osconfig-agent-20260615.01-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-06-22T09:09:04Z",
"details": "important"
}
],
"title": "CVE-2026-46598"
}
]
}
ubuntu-cve-2024-45339
Vulnerability from osv_ubuntu
Published
2025-01-28 02:15
Modified
2025-10-24 05:12
Summary
Details
When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process's log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix that, glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists.
Severity
7.1 (High)
N/A (UNKNOWN)
References
{
"affected": [
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "golang-glog-dev",
"binary_version": "0+git20150801.fca8c88-1"
}
]
},
"package": {
"ecosystem": "Ubuntu:16.04:LTS",
"name": "golang-glog",
"purl": "pkg:deb/ubuntu/golang-glog@0+git20150801.fca8c88-1?arch=source\u0026distro=xenial"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0+git20150214.44145f0-2",
"0+git20150801.fca8c88-1"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "golang-glog-dev",
"binary_version": "0.0~git20160126.23def4e-1"
}
]
},
"package": {
"ecosystem": "Ubuntu:18.04:LTS",
"name": "golang-glog",
"purl": "pkg:deb/ubuntu/golang-glog@0.0~git20160126.23def4e-1?arch=source\u0026distro=bionic"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0+git20150801.fca8c88-1",
"0.0~git20160126.23def4e-1"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "golang-glog-dev",
"binary_version": "0.0~git20160126.23def4e-3"
}
]
},
"package": {
"ecosystem": "Ubuntu:20.04:LTS",
"name": "golang-glog",
"purl": "pkg:deb/ubuntu/golang-glog@0.0~git20160126.23def4e-3?arch=source\u0026distro=focal"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.0~git20160126.23def4e-3"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "golang-glog-dev",
"binary_version": "0.0~git20160126.23def4e-5"
}
]
},
"package": {
"ecosystem": "Ubuntu:22.04:LTS",
"name": "golang-glog",
"purl": "pkg:deb/ubuntu/golang-glog@0.0~git20160126.23def4e-5?arch=source\u0026distro=jammy"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.0~git20160126.23def4e-3",
"0.0~git20160126.23def4e-5"
]
},
{
"ecosystem_specific": {
"binaries": [
{
"binary_name": "golang-glog-dev",
"binary_version": "1.1.2-1"
}
]
},
"package": {
"ecosystem": "Ubuntu:24.04:LTS",
"name": "golang-glog",
"purl": "pkg:deb/ubuntu/golang-glog@1.1.2-1?arch=source\u0026distro=noble"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.0~git20160126.23def4e-5",
"1.1.2-1"
]
}
],
"aliases": [],
"details": "When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process\u0027s log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix that, glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists.",
"id": "UBUNTU-CVE-2024-45339",
"modified": "2025-10-24T05:12:20Z",
"published": "2025-01-28T02:15:00Z",
"references": [
{
"type": "REPORT",
"url": "https://ubuntu.com/security/CVE-2024-45339"
},
{
"type": "REPORT",
"url": "https://www.cve.org/CVERecord?id=CVE-2024-45339"
},
{
"type": "REPORT",
"url": "https://github.com/golang/glog/pull/74"
},
{
"type": "REPORT",
"url": "https://github.com/golang/glog/pull/74/commits/b8741656e406e66d6992bc2c9575e460ecaa0ec2"
},
{
"type": "REPORT",
"url": "https://groups.google.com/g/golang-announce/c/H-Q4ouHWyKs"
},
{
"type": "REPORT",
"url": "https://owasp.org/www-community/vulnerabilities/Insecure_Temporary_File"
},
{
"type": "REPORT",
"url": "https://pkg.go.dev/vuln/GO-2025-3372"
}
],
"related": [],
"schema_version": "1.7.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "medium",
"type": "Ubuntu"
}
],
"upstream": [
"CVE-2024-45339"
]
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…