Vulnerability from csaf_opensuse
Published
2025-03-28 00:00
Modified
2025-03-28 00:00
Summary
govulncheck-vulndb-0.0.20250327T184518-1.1 on GA media
Notes
Title of the patch
govulncheck-vulndb-0.0.20250327T184518-1.1 on GA media
Description of the patch
These are all security issues fixed in the govulncheck-vulndb-0.0.20250327T184518-1.1 package on the GA media of openSUSE Tumbleweed.
Patchnames
openSUSE-Tumbleweed-2025-14937
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{ document: { aggregate_severity: { namespace: "https://www.suse.com/support/security/rating/", text: "moderate", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright 2024 SUSE LLC. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "govulncheck-vulndb-0.0.20250327T184518-1.1 on GA media", title: "Title of the patch", }, { category: "description", text: "These are all security issues fixed in the govulncheck-vulndb-0.0.20250327T184518-1.1 package on the GA media of openSUSE Tumbleweed.", title: "Description of the patch", }, { category: "details", text: "openSUSE-Tumbleweed-2025-14937", title: "Patchnames", }, { category: "legal_disclaimer", text: "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).", title: "Terms of use", }, ], publisher: { category: "vendor", contact_details: "https://www.suse.com/support/security/contact/", name: "SUSE Product Security Team", namespace: "https://www.suse.com/", }, references: [ { category: "external", summary: "SUSE ratings", url: "https://www.suse.com/support/security/rating/", }, { category: "self", summary: "URL of this CSAF notice", url: "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2025_14937-1.json", }, { category: "self", summary: "URL for openSUSE-SU-2025:14937-1", url: "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/NEVFAGUWHTVZSJTUAIU6C4S26DP2KIGB/", }, { category: "self", summary: "E-Mail link for openSUSE-SU-2025:14937-1", url: "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/NEVFAGUWHTVZSJTUAIU6C4S26DP2KIGB/", }, { category: "self", summary: "SUSE CVE CVE-2024-25132 page", url: "https://www.suse.com/security/cve/CVE-2024-25132/", }, { category: "self", summary: "SUSE CVE CVE-2024-53348 page", url: "https://www.suse.com/security/cve/CVE-2024-53348/", }, { category: "self", summary: "SUSE CVE CVE-2024-53351 page", url: "https://www.suse.com/security/cve/CVE-2024-53351/", }, { category: "self", summary: "SUSE CVE CVE-2024-7598 page", url: "https://www.suse.com/security/cve/CVE-2024-7598/", }, { category: "self", summary: "SUSE CVE CVE-2024-7631 page", url: "https://www.suse.com/security/cve/CVE-2024-7631/", }, { category: "self", summary: "SUSE CVE CVE-2024-9042 page", url: "https://www.suse.com/security/cve/CVE-2024-9042/", }, { category: "self", summary: "SUSE CVE CVE-2024-9900 page", url: "https://www.suse.com/security/cve/CVE-2024-9900/", }, { category: "self", summary: "SUSE CVE CVE-2025-1097 page", url: "https://www.suse.com/security/cve/CVE-2025-1097/", }, { category: "self", summary: "SUSE CVE CVE-2025-1098 page", url: "https://www.suse.com/security/cve/CVE-2025-1098/", }, { category: "self", summary: "SUSE CVE CVE-2025-1472 page", url: "https://www.suse.com/security/cve/CVE-2025-1472/", }, { category: "self", summary: "SUSE CVE CVE-2025-1767 page", url: "https://www.suse.com/security/cve/CVE-2025-1767/", }, { category: "self", summary: "SUSE CVE CVE-2025-1974 page", url: "https://www.suse.com/security/cve/CVE-2025-1974/", }, { category: "self", summary: "SUSE CVE CVE-2025-24513 page", url: "https://www.suse.com/security/cve/CVE-2025-24513/", }, { category: "self", summary: "SUSE CVE CVE-2025-24514 page", url: "https://www.suse.com/security/cve/CVE-2025-24514/", }, { category: "self", summary: "SUSE CVE CVE-2025-24920 page", url: "https://www.suse.com/security/cve/CVE-2025-24920/", }, { category: "self", summary: "SUSE CVE CVE-2025-25068 page", url: "https://www.suse.com/security/cve/CVE-2025-25068/", }, { category: "self", summary: "SUSE CVE CVE-2025-25274 page", url: "https://www.suse.com/security/cve/CVE-2025-25274/", }, { category: "self", summary: "SUSE CVE CVE-2025-27612 page", url: "https://www.suse.com/security/cve/CVE-2025-27612/", }, { category: "self", summary: "SUSE CVE CVE-2025-27715 page", url: "https://www.suse.com/security/cve/CVE-2025-27715/", }, { category: "self", summary: "SUSE CVE CVE-2025-27933 page", url: "https://www.suse.com/security/cve/CVE-2025-27933/", }, { category: "self", summary: "SUSE CVE CVE-2025-29778 page", url: "https://www.suse.com/security/cve/CVE-2025-29778/", }, { category: "self", summary: "SUSE CVE CVE-2025-29914 page", url: "https://www.suse.com/security/cve/CVE-2025-29914/", }, { category: "self", summary: "SUSE CVE CVE-2025-29922 page", url: "https://www.suse.com/security/cve/CVE-2025-29922/", }, { category: "self", summary: "SUSE CVE CVE-2025-29923 page", url: "https://www.suse.com/security/cve/CVE-2025-29923/", }, { category: "self", summary: "SUSE CVE CVE-2025-30077 page", url: "https://www.suse.com/security/cve/CVE-2025-30077/", }, { category: "self", summary: "SUSE CVE CVE-2025-30153 page", url: "https://www.suse.com/security/cve/CVE-2025-30153/", }, { category: "self", summary: "SUSE CVE CVE-2025-30162 page", url: "https://www.suse.com/security/cve/CVE-2025-30162/", }, { category: "self", summary: "SUSE CVE CVE-2025-30163 page", url: "https://www.suse.com/security/cve/CVE-2025-30163/", }, { category: "self", summary: "SUSE CVE CVE-2025-30179 page", url: "https://www.suse.com/security/cve/CVE-2025-30179/", }, { category: "self", summary: "SUSE CVE CVE-2025-30204 page", url: "https://www.suse.com/security/cve/CVE-2025-30204/", }, ], title: "govulncheck-vulndb-0.0.20250327T184518-1.1 on GA media", tracking: { current_release_date: "2025-03-28T00:00:00Z", generator: { date: "2025-03-28T00:00:00Z", engine: { name: "cve-database.git:bin/generate-csaf.pl", version: "1", }, }, id: "openSUSE-SU-2025:14937-1", initial_release_date: "2025-03-28T00:00:00Z", revision_history: [ { date: "2025-03-28T00:00:00Z", number: "1", summary: "Current version", }, ], status: "final", version: "1", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_version", name: "govulncheck-vulndb-0.0.20250327T184518-1.1.aarch64", product: { name: "govulncheck-vulndb-0.0.20250327T184518-1.1.aarch64", product_id: "govulncheck-vulndb-0.0.20250327T184518-1.1.aarch64", }, }, ], category: "architecture", name: "aarch64", }, { branches: [ { category: "product_version", name: "govulncheck-vulndb-0.0.20250327T184518-1.1.ppc64le", product: { name: "govulncheck-vulndb-0.0.20250327T184518-1.1.ppc64le", product_id: "govulncheck-vulndb-0.0.20250327T184518-1.1.ppc64le", }, }, ], category: "architecture", name: "ppc64le", }, { branches: [ { category: "product_version", name: "govulncheck-vulndb-0.0.20250327T184518-1.1.s390x", product: { name: "govulncheck-vulndb-0.0.20250327T184518-1.1.s390x", product_id: "govulncheck-vulndb-0.0.20250327T184518-1.1.s390x", }, }, ], category: "architecture", name: "s390x", }, { branches: [ { category: "product_version", name: "govulncheck-vulndb-0.0.20250327T184518-1.1.x86_64", product: { name: "govulncheck-vulndb-0.0.20250327T184518-1.1.x86_64", product_id: "govulncheck-vulndb-0.0.20250327T184518-1.1.x86_64", }, }, ], category: "architecture", name: "x86_64", }, { branches: [ { category: "product_name", name: "openSUSE Tumbleweed", product: { name: "openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed", product_identification_helper: { cpe: "cpe:/o:opensuse:tumbleweed", }, }, }, ], category: "product_family", name: "SUSE Linux Enterprise", }, ], category: "vendor", name: "SUSE", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "govulncheck-vulndb-0.0.20250327T184518-1.1.aarch64 as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.aarch64", }, product_reference: "govulncheck-vulndb-0.0.20250327T184518-1.1.aarch64", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "govulncheck-vulndb-0.0.20250327T184518-1.1.ppc64le as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.ppc64le", }, product_reference: "govulncheck-vulndb-0.0.20250327T184518-1.1.ppc64le", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "govulncheck-vulndb-0.0.20250327T184518-1.1.s390x as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.s390x", }, product_reference: "govulncheck-vulndb-0.0.20250327T184518-1.1.s390x", relates_to_product_reference: "openSUSE Tumbleweed", }, { category: "default_component_of", full_product_name: { name: "govulncheck-vulndb-0.0.20250327T184518-1.1.x86_64 as component of openSUSE Tumbleweed", product_id: "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.x86_64", }, product_reference: "govulncheck-vulndb-0.0.20250327T184518-1.1.x86_64", relates_to_product_reference: "openSUSE Tumbleweed", }, ], }, vulnerabilities: [ { cve: "CVE-2024-25132", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2024-25132", }, ], notes: [ { category: "general", text: "A flaw was found in the Hive hibernation controller component of OpenShift Dedicated. The ClusterDeployment.hive.openshift.io/v1 resource can be created with the spec.installed field set to true, regardless of the installation status, and a positive timespan for the spec.hibernateAfter value. If a ClusterSync.hiveinternal.openshift.io/v1alpha1 resource is also created, the hive hibernation controller will enter the reconciliation loop leading to a panic when accessing a non-existing field in the ClusterDeployment's status section, resulting in a denial of service.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.aarch64", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.ppc64le", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.s390x", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2024-25132", url: "https://www.suse.com/security/cve/CVE-2024-25132", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.aarch64", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.ppc64le", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.s390x", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2025-03-28T00:00:00Z", details: "moderate", }, ], title: "CVE-2024-25132", }, { cve: "CVE-2024-53348", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2024-53348", }, ], notes: [ { category: "general", text: "LoxiLB v.0.9.7 and before is vulnerable to Incorrect Access Control which allows attackers to obtain sensitive information and escalate privileges.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.aarch64", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.ppc64le", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.s390x", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2024-53348", url: "https://www.suse.com/security/cve/CVE-2024-53348", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.aarch64", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.ppc64le", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.s390x", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2025-03-28T00:00:00Z", details: "important", }, ], title: "CVE-2024-53348", }, { cve: "CVE-2024-53351", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2024-53351", }, ], notes: [ { category: "general", text: "Insecure permissions in pipecd v0.49 allow attackers to gain access to the service account's token, leading to escalation of privileges.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.aarch64", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.ppc64le", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.s390x", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2024-53351", url: "https://www.suse.com/security/cve/CVE-2024-53351", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.aarch64", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.ppc64le", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.s390x", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2025-03-28T00:00:00Z", details: "critical", }, ], title: "CVE-2024-53351", }, { cve: "CVE-2024-7598", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2024-7598", }, ], notes: [ { category: "general", text: "A security issue was discovered in Kubernetes where a malicious or compromised pod could bypass network restrictions enforced by network policies during namespace deletion. The order in which objects are deleted during namespace termination is not defined, and it is possible for network policies to be deleted before the pods that they protect. This can lead to a brief period in which the pods are running, but network policies that should apply to connections to and from the pods are not enforced.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.aarch64", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.ppc64le", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.s390x", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2024-7598", url: "https://www.suse.com/security/cve/CVE-2024-7598", }, { category: "external", summary: "SUSE Bug 1240110 for CVE-2024-7598", url: "https://bugzilla.suse.com/1240110", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.aarch64", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.ppc64le", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.s390x", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 3.1, baseSeverity: "LOW", vectorString: "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", version: "3.1", }, products: [ "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.aarch64", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.ppc64le", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.s390x", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2025-03-28T00:00:00Z", details: "low", }, ], title: "CVE-2024-7598", }, { cve: "CVE-2024-7631", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2024-7631", }, ], notes: [ { category: "general", text: "A flaw was found in the OpenShift Console, an endpoint for plugins to serve resources in multiple languages: /locales/resources.json. This endpoint's lng and ns parameters are used to construct a filepath in pkg/plugins/handlers unsafely.go#L112 Because of this unsafe filepath construction, an authenticated user can manipulate the path to retrieve any JSON files on the console's pod by using sequences of ../ and valid directory paths.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.aarch64", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.ppc64le", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.s390x", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2024-7631", url: "https://www.suse.com/security/cve/CVE-2024-7631", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.aarch64", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.ppc64le", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.s390x", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2025-03-28T00:00:00Z", details: "moderate", }, ], title: "CVE-2024-7631", }, { cve: "CVE-2024-9042", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2024-9042", }, ], notes: [ { category: "general", text: "This CVE affects only Windows worker nodes. Your worker node is vulnerable to this issue if it is running one of the affected versions listed below.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.aarch64", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.ppc64le", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.s390x", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2024-9042", url: "https://www.suse.com/security/cve/CVE-2024-9042", }, { category: "external", summary: "SUSE Bug 1235978 for CVE-2024-9042", url: "https://bugzilla.suse.com/1235978", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.aarch64", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.ppc64le", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.s390x", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 6.6, baseSeverity: "MEDIUM", vectorString: "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.aarch64", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.ppc64le", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.s390x", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2025-03-28T00:00:00Z", details: "important", }, ], title: "CVE-2024-9042", }, { cve: "CVE-2024-9900", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2024-9900", }, ], notes: [ { category: "general", text: "mudler/localai version v2.21.1 contains a Cross-Site Scripting (XSS) vulnerability in its search functionality. The vulnerability arises due to improper sanitization of user input, allowing the injection and execution of arbitrary JavaScript code. This can lead to the execution of malicious scripts in the context of the victim's browser, potentially compromising user sessions, stealing session cookies, redirecting users to malicious websites, or manipulating the DOM.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.aarch64", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.ppc64le", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.s390x", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2024-9900", url: "https://www.suse.com/security/cve/CVE-2024-9900", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.aarch64", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.ppc64le", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.s390x", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2025-03-28T00:00:00Z", details: "moderate", }, ], title: "CVE-2024-9900", }, { cve: "CVE-2025-1097", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2025-1097", }, ], notes: [ { category: "general", text: "A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-cn` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.aarch64", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.ppc64le", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.s390x", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2025-1097", url: "https://www.suse.com/security/cve/CVE-2025-1097", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.aarch64", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.ppc64le", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.s390x", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2025-03-28T00:00:00Z", details: "important", }, ], title: "CVE-2025-1097", }, { cve: "CVE-2025-1098", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2025-1098", }, ], notes: [ { category: "general", text: "A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `mirror-target` and `mirror-host` Ingress annotations can be used to inject arbitrary configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.aarch64", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.ppc64le", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.s390x", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2025-1098", url: "https://www.suse.com/security/cve/CVE-2025-1098", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.aarch64", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.ppc64le", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.s390x", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2025-03-28T00:00:00Z", details: "important", }, ], title: "CVE-2025-1098", }, { cve: "CVE-2025-1472", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2025-1472", }, ], notes: [ { category: "general", text: "Mattermost versions 9.11.x <= 9.11.8 fail to properly perform authorization of the Viewer role which allows an attacker with the Viewer role configured with No Access to Reporting to still view team and site statistics.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.aarch64", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.ppc64le", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.s390x", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2025-1472", url: "https://www.suse.com/security/cve/CVE-2025-1472", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.aarch64", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.ppc64le", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.s390x", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2025-03-28T00:00:00Z", details: "moderate", }, ], title: "CVE-2025-1472", }, { cve: "CVE-2025-1767", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2025-1767", }, ], notes: [ { category: "general", text: "This CVE only affects Kubernetes clusters that utilize the in-tree gitRepo volume to clone git repositories from other pods within the same node. Since the in-tree gitRepo volume feature has been deprecated and will not receive security updates upstream, any cluster still using this feature remains vulnerable.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.aarch64", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.ppc64le", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.s390x", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2025-1767", url: "https://www.suse.com/security/cve/CVE-2025-1767", }, { category: "external", summary: "SUSE Bug 1239643 for CVE-2025-1767", url: "https://bugzilla.suse.com/1239643", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.aarch64", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.ppc64le", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.s390x", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 6.5, baseSeverity: "MEDIUM", vectorString: "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", version: "3.1", }, products: [ "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.aarch64", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.ppc64le", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.s390x", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2025-03-28T00:00:00Z", details: "moderate", }, ], title: "CVE-2025-1767", }, { cve: "CVE-2025-1974", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2025-1974", }, ], notes: [ { category: "general", text: "A security issue was discovered in Kubernetes where under certain conditions, an unauthenticated attacker with access to the pod network can achieve arbitrary code execution in the context of the ingress-nginx controller. This can lead to disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.aarch64", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.ppc64le", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.s390x", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2025-1974", url: "https://www.suse.com/security/cve/CVE-2025-1974", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.aarch64", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.ppc64le", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.s390x", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2025-03-28T00:00:00Z", details: "critical", }, ], title: "CVE-2025-1974", }, { cve: "CVE-2025-24513", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2025-24513", }, ], notes: [ { category: "general", text: "A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where attacker-provided data are included in a filename by the ingress-nginx Admission Controller feature, resulting in directory traversal within the container. This could result in denial of service, or when combined with other vulnerabilities, limited disclosure of Secret objects from the cluster.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.aarch64", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.ppc64le", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.s390x", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2025-24513", url: "https://www.suse.com/security/cve/CVE-2025-24513", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.aarch64", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.ppc64le", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.s390x", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2025-03-28T00:00:00Z", details: "moderate", }, ], title: "CVE-2025-24513", }, { cve: "CVE-2025-24514", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2025-24514", }, ], notes: [ { category: "general", text: "A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingress annotation can be used to inject configuration into nginx. This can lead to arbitrary code execution in the context of the ingress-nginx controller, and disclosure of Secrets accessible to the controller. (Note that in the default installation, the controller can access all Secrets cluster-wide.)", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.aarch64", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.ppc64le", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.s390x", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2025-24514", url: "https://www.suse.com/security/cve/CVE-2025-24514", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.aarch64", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.ppc64le", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.s390x", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2025-03-28T00:00:00Z", details: "important", }, ], title: "CVE-2025-24514", }, { cve: "CVE-2025-24920", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2025-24920", }, ], notes: [ { category: "general", text: "Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8, 10.5.x <= 10.5.0 fail to restrict bookmark creation and updates in archived channels, which allows authenticated users created or update bookmarked in archived channels", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.aarch64", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.ppc64le", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.s390x", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2025-24920", url: "https://www.suse.com/security/cve/CVE-2025-24920", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.aarch64", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.ppc64le", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.s390x", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 4.3, baseSeverity: "MEDIUM", vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", version: "3.1", }, products: [ "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.aarch64", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.ppc64le", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.s390x", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2025-03-28T00:00:00Z", details: "moderate", }, ], title: "CVE-2025-24920", }, { cve: "CVE-2025-25068", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2025-25068", }, ], notes: [ { category: "general", text: "Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8, 10.5.x <= 10.5.0 fail to enforce MFA on plugin endpoints, which allows authenticated attackers to bypass MFA protections via API requests to plugin-specific routes.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.aarch64", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.ppc64le", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.s390x", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2025-25068", url: "https://www.suse.com/security/cve/CVE-2025-25068", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.aarch64", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.ppc64le", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.s390x", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 8.8, baseSeverity: "HIGH", vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.aarch64", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.ppc64le", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.s390x", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2025-03-28T00:00:00Z", details: "important", }, ], title: "CVE-2025-25068", }, { cve: "CVE-2025-25274", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2025-25274", }, ], notes: [ { category: "general", text: "Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8 fail to restrict command execution in archived channels, which allows authenticated users to run commands in archived channels.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.aarch64", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.ppc64le", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.s390x", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2025-25274", url: "https://www.suse.com/security/cve/CVE-2025-25274", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.aarch64", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.ppc64le", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.s390x", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 8.8, baseSeverity: "HIGH", vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", version: "3.1", }, products: [ "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.aarch64", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.ppc64le", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.s390x", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2025-03-28T00:00:00Z", details: "important", }, ], title: "CVE-2025-25274", }, { cve: "CVE-2025-27612", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2025-27612", }, ], notes: [ { category: "general", text: "libcontainer is a library for container control. Prior to libcontainer 0.5.3, while creating a tenant container, the tenant builder accepts a list of capabilities to be added in the spec of tenant container. The logic here adds the given capabilities to all capabilities of main container if present in spec, otherwise simply set provided capabilities as capabilities of the tenant container. However, setting inherited caps in any case for tenant container can lead to elevation of capabilities, similar to CVE-2022-29162. This does not affect youki binary itself. This is only applicable if you are using libcontainer directly and using the tenant builder.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.aarch64", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.ppc64le", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.s390x", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2025-27612", url: "https://www.suse.com/security/cve/CVE-2025-27612", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.aarch64", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.ppc64le", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.s390x", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 5.9, baseSeverity: "MEDIUM", vectorString: "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", version: "3.1", }, products: [ "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.aarch64", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.ppc64le", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.s390x", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2025-03-28T00:00:00Z", details: "moderate", }, ], title: "CVE-2025-27612", }, { cve: "CVE-2025-27715", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2025-27715", }, ], notes: [ { category: "general", text: "Mattermost versions 9.11.x <= 9.11.8 fail to prompt for explicit approval before adding a team admin to a private channel, which team admins to joining private channels via crafted permalink links without explicit consent from them.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.aarch64", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.ppc64le", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.s390x", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2025-27715", url: "https://www.suse.com/security/cve/CVE-2025-27715", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.aarch64", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.ppc64le", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.s390x", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 2.7, baseSeverity: "LOW", vectorString: "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N", version: "3.1", }, products: [ "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.aarch64", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.ppc64le", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.s390x", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2025-03-28T00:00:00Z", details: "low", }, ], title: "CVE-2025-27715", }, { cve: "CVE-2025-27933", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2025-27933", }, ], notes: [ { category: "general", text: "Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8 fail to fail to enforce channel conversion restrictions, which allows members with permission to convert public channels to private ones to also convert private ones to public", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.aarch64", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.ppc64le", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.s390x", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2025-27933", url: "https://www.suse.com/security/cve/CVE-2025-27933", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.aarch64", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.ppc64le", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.s390x", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 4.3, baseSeverity: "MEDIUM", vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N", version: "3.1", }, products: [ "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.aarch64", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.ppc64le", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.s390x", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2025-03-28T00:00:00Z", details: "moderate", }, ], title: "CVE-2025-27933", }, { cve: "CVE-2025-29778", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2025-29778", }, ], notes: [ { category: "general", text: "Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to version 1.14.0-alpha.1, Kyverno ignores subjectRegExp and IssuerRegExp while verifying artifact's sign with keyless mode. It allows the attacker to deploy kubernetes resources with the artifacts that were signed by unexpected certificate. Deploying these unauthorized kubernetes resources can lead to full compromise of kubernetes cluster. Version 1.14.0-alpha.1 contains a patch for the issue.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.aarch64", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.ppc64le", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.s390x", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2025-29778", url: "https://www.suse.com/security/cve/CVE-2025-29778", }, { category: "external", summary: "SUSE Bug 1240021 for CVE-2025-29778", url: "https://bugzilla.suse.com/1240021", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.aarch64", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.ppc64le", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.s390x", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 5.8, baseSeverity: "MEDIUM", vectorString: "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:H/A:N", version: "3.1", }, products: [ "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.aarch64", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.ppc64le", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.s390x", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2025-03-28T00:00:00Z", details: "moderate", }, ], title: "CVE-2025-29778", }, { cve: "CVE-2025-29914", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2025-29914", }, ], notes: [ { category: "general", text: "OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. Prior to 3.3.3, if a request is made on an URI starting with //, coraza will set a wrong value in REQUEST_FILENAME. For example, if the URI //bar/uploads/foo.php?a=b is passed to coraza: , REQUEST_FILENAME will be set to /uploads/foo.php. This can lead to a rules bypass. This vulnerability is fixed in 3.3.3.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.aarch64", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.ppc64le", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.s390x", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2025-29914", url: "https://www.suse.com/security/cve/CVE-2025-29914", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.aarch64", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.ppc64le", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.s390x", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2025-03-28T00:00:00Z", details: "moderate", }, ], title: "CVE-2025-29914", }, { cve: "CVE-2025-29922", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2025-29922", }, ], notes: [ { category: "general", text: "kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.26.3, the identified vulnerability allows creating or deleting an object via the APIExport VirtualWorkspace in any arbitrary target workspace for pre-existing resources. By design, this should only be allowed when the workspace owner decides to give access to an API provider by creating an APIBinding. With this vulnerability, it is possible for an attacker to create and delete objects even if none of these requirements are satisfied, i.e. even if there is no APIBinding in that workspace at all or the workspace owner has created an APIBinding, but rejected a permission claim. A fix for this issue has been identified and has been published with kcp 0.26.3 and 0.27.0.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.aarch64", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.ppc64le", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.s390x", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2025-29922", url: "https://www.suse.com/security/cve/CVE-2025-29922", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.aarch64", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.ppc64le", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.s390x", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2025-03-28T00:00:00Z", details: "critical", }, ], title: "CVE-2025-29922", }, { cve: "CVE-2025-29923", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2025-29923", }, ], notes: [ { category: "general", text: "go-redis is the official Redis client library for the Go programming language. Prior to 9.5.5, 9.6.3, and 9.7.3, go-redis potentially responds out of order when `CLIENT SETINFO` times out during connection establishment. This can happen when the client is configured to transmit its identity, there are network connectivity issues, or the client was configured with aggressive timeouts. The problem occurs for multiple use cases. For sticky connections, you receive persistent out-of-order responses for the lifetime of the connection. All commands in the pipeline receive incorrect responses. When used with the default ConnPool once a connection is returned after use with ConnPool#Put the read buffer will be checked and the connection will be marked as bad due to the unread data. This means that at most one out-of-order response before the connection is discarded. This issue is fixed in 9.5.5, 9.6.3, and 9.7.3. You can prevent the vulnerability by setting the flag DisableIndentity to true when constructing the client instance.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.aarch64", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.ppc64le", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.s390x", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2025-29923", url: "https://www.suse.com/security/cve/CVE-2025-29923", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.aarch64", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.ppc64le", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.s390x", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2025-03-28T00:00:00Z", details: "low", }, ], title: "CVE-2025-29923", }, { cve: "CVE-2025-30077", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2025-30077", }, ], notes: [ { category: "general", text: "Open Networking Foundation SD-RAN ONOS onos-lib-go 0.10.28 allows an index out-of-range panic in asn1/aper GetBitString via a zero value of numBits.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.aarch64", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.ppc64le", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.s390x", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2025-30077", url: "https://www.suse.com/security/cve/CVE-2025-30077", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.aarch64", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.ppc64le", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.s390x", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2025-03-28T00:00:00Z", details: "moderate", }, ], title: "CVE-2025-30077", }, { cve: "CVE-2025-30153", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2025-30153", }, ], notes: [ { category: "general", text: "kin-openapi is a Go project for handling OpenAPI files. Prior to 0.131.0, when validating a request with a multipart/form-data schema, if the OpenAPI schema allows it, an attacker can upload a crafted ZIP file (e.g., a ZIP bomb), causing the server to consume all available system memory. The root cause comes from the ZipFileBodyDecoder, which is registered automatically by the module (contrary to what the documentation says). This vulnerability is fixed in 0.131.0.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.aarch64", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.ppc64le", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.s390x", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2025-30153", url: "https://www.suse.com/security/cve/CVE-2025-30153", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.aarch64", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.ppc64le", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.s390x", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2025-03-28T00:00:00Z", details: "important", }, ], title: "CVE-2025-30153", }, { cve: "CVE-2025-30162", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2025-30162", }, ], notes: [ { category: "general", text: "Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For Cilium users who use Gateway API for Ingress for some services and use LB-IPAM or BGP for LB Service implementation and use network policies to block egress traffic from workloads in a namespace to workloads in other namespaces, egress traffic from workloads covered by such network policies to LoadBalancers configured by `Gateway` resources will incorrectly be allowed. LoadBalancer resources not deployed via a Gateway API configuration are not affected by this issue. This issue affects: Cilium v1.15 between v1.15.0 and v1.15.14 inclusive, v1.16 between v1.16.0 and v1.16.7 inclusive, and v1.17 between v1.17.0 and v1.17.1 inclusive. This issue is fixed in Cilium v1.15.15, v1.16.8, and v1.17.2. A Clusterwide Cilium Network Policy can be used to work around this issue for users who are unable to upgrade.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.aarch64", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.ppc64le", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.s390x", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2025-30162", url: "https://www.suse.com/security/cve/CVE-2025-30162", }, { category: "external", summary: "SUSE Bug 1240019 for CVE-2025-30162", url: "https://bugzilla.suse.com/1240019", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.aarch64", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.ppc64le", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.s390x", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2025-03-28T00:00:00Z", details: "low", }, ], title: "CVE-2025-30162", }, { cve: "CVE-2025-30163", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2025-30163", }, ], notes: [ { category: "general", text: "Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Node based network policies (`fromNodes` and `toNodes`) will incorrectly permit traffic to/from non-node endpoints that share the labels specified in `fromNodes` and `toNodes` sections of network policies. Node based network policy is disabled by default in Cilium. This issue affects: Cilium v1.16 between v1.16.0 and v1.16.7 inclusive and v1.17 between v1.17.0 and v1.17.1 inclusive. This issue is fixed in Cilium v1.16.8 and v1.17.2. Users can work around this issue by ensuring that the labels used in `fromNodes` and `toNodes` fields are used exclusively by nodes and not by other endpoints.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.aarch64", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.ppc64le", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.s390x", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2025-30163", url: "https://www.suse.com/security/cve/CVE-2025-30163", }, { category: "external", summary: "SUSE Bug 1240020 for CVE-2025-30163", url: "https://bugzilla.suse.com/1240020", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.aarch64", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.ppc64le", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.s390x", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2025-03-28T00:00:00Z", details: "low", }, ], title: "CVE-2025-30163", }, { cve: "CVE-2025-30179", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2025-30179", }, ], notes: [ { category: "general", text: "Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8 fail to enforce MFA on certain search APIs, which allows authenticated attackers to bypass MFA protections via user search, channel search, or team search queries.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.aarch64", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.ppc64le", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.s390x", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2025-30179", url: "https://www.suse.com/security/cve/CVE-2025-30179", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.aarch64", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.ppc64le", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.s390x", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 6.5, baseSeverity: "MEDIUM", vectorString: "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", version: "3.1", }, products: [ "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.aarch64", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.ppc64le", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.s390x", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2025-03-28T00:00:00Z", details: "moderate", }, ], title: "CVE-2025-30179", }, { cve: "CVE-2025-30204", ids: [ { system_name: "SUSE CVE Page", text: "https://www.suse.com/security/cve/CVE-2025-30204", }, ], notes: [ { category: "general", text: "golang-jwt is a Go implementation of JSON Web Tokens. Prior to \n5.2.2 and 4.5.2, the function parse.ParseUnverified splits (via a call to strings.Split) its argument (which is untrusted data) on periods. As a result, in the face of a malicious request whose Authorization header consists of Bearer followed by many period characters, a call to that function incurs allocations to the tune of O(n) bytes (where n stands for the length of the function's argument), with a constant factor of about 16. This issue is fixed in 5.2.2 and 4.5.2.", title: "CVE description", }, ], product_status: { recommended: [ "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.aarch64", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.ppc64le", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.s390x", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.x86_64", ], }, references: [ { category: "external", summary: "CVE-2025-30204", url: "https://www.suse.com/security/cve/CVE-2025-30204", }, { category: "external", summary: "SUSE Bug 1240442 for CVE-2025-30204", url: "https://bugzilla.suse.com/1240442", }, ], remediations: [ { category: "vendor_fix", details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n", product_ids: [ "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.aarch64", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.ppc64le", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.s390x", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.x86_64", ], }, ], scores: [ { cvss_v3: { baseScore: 7.5, baseSeverity: "HIGH", vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", version: "3.1", }, products: [ "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.aarch64", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.ppc64le", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.s390x", "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250327T184518-1.1.x86_64", ], }, ], threats: [ { category: "impact", date: "2025-03-28T00:00:00Z", details: "important", }, ], title: "CVE-2025-30204", }, ], }
Log in or create an account to share your comment.
Security Advisory comment format.
This schema specifies the format of a comment related to a security advisory.
Title of the comment
Description of the comment
Loading…
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.