{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for hauler",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for hauler fixes the following issues:\n\n- Update to version 1.3.1 (bsc#1251516, CVE-2025-47911,\n  bsc#1251891, CVE-2025-11579, bsc#1251651, CVE-2025-58190,\n  bsc#1248937, CVE-2025-58058):\n  * bump github.com/containerd/containerd (#474)\n  * another fix to tests for new tests (#472)\n  * fixed typo in testdata (#471)\n  * fixed/cleaned new tests (#470)\n  * trying a new way for hauler testing (#467)\n  * update for cosign v3 verify (#469)\n  * added digests view to info (#465)\n  * bump github.com/nwaples/rardecode/v2 from 2.1.1 to 2.2.0 in the go_modules group across 1 directory (#457)\n  * update oras-go to v1.2.7 for security patches (#464)\n  * update cosign to v3.0.2+hauler.1 (#463)\n  * fixed homebrew directory deprecation (#462)\n  * add registry logout command (#460)\n\n- Update to version 1.3.0:\n  * bump the go_modules group across 1 directory with 2 updates (#455)\n  * upgraded versions/dependencies/deprecations (#454)\n  * allow loading of docker tarballs (#452)\n  * bump the go_modules group across 1 directory with 2 updates (#449)\n\n- update to 1.2.5 (bsc#1246722, CVE-2025-46569):\n  * Bump github.com/open-policy-agent/opa from 1.1.0 to 1.4.0 in\n    the go_modules group across 1 directory (CVE-2025-46569)\n  * deprecate auth from hauler store copy\n  * Bump github.com/cloudflare/circl from 1.3.7 to 1.6.1 in the\n    go_modules group across 1 directory\n  * Bump github.com/go-viper/mapstructure/v2 from 2.2.1 to 2.3.0\n    in the go_modules group across 1 directory\n  * upgraded go and dependencies versions\n\n- Update to version 1.2.5:\n  * upgraded go and dependencies versions (#444)\n  * Bump github.com/go-viper/mapstructure/v2 (#442)\n  * bump github.com/cloudflare/circl (#441)\n  * deprecate auth from hauler store copy (#440)\n  * Bump github.com/open-policy-agent/opa (#438)\n\n- update to 1.2.4 (CVE-2025-22872, bsc#1241804):\n  * Bump golang.org/x/net from 0.37.0 to 0.38.0 in the go_modules\n    group across 1 directory\n  * minor tests updates\n\n- Update to version 1.2.3:\n  * formatting and flag text updates\n  * add keyless signature verification (#434)\n  * bump helm.sh/helm/v3 in the go_modules group across 1 directory (#430)\n  * add --only flag to hauler store copy (for images) (#429)\n  * fix tlog verification error/warning output (#428)\n\n- Update to version 1.2.2 (bsc#1241184, CVE-2024-0406):\n  * cleanup new tlog flag typos and add shorthand (#426)\n  * default public transparency log verification to false to be airgap friendly but allow override (#425)\n  * bump github.com/golang-jwt/jwt/v4 (#423)\n  * bump the go_modules group across 1 directory with 2 updates (#422)\n  * bump github.com/go-jose/go-jose/v3 (#417)\n  * bump github.com/go-jose/go-jose/v4 (#415)\n  * clear default manifest name if product flag used with sync (#412)\n  * updates for v1.2.0 (#408)\n  * fixed remote code (#407)\n  * added remote file fetch to load (#406)\n  * added remote and multiple file fetch to sync (#405)\n  * updated save flag and related logs (#404)\n  * updated load flag and related logs [breaking change] (#403)\n  * updated sync flag and related logs [breaking change] (#402)\n  * upgraded api update to v1/updated dependencies (#400)\n  * fixed consts for oci declarations (#398)\n  * fix for correctly grabbing platform post cosign 2.4 updates (#393)\n  * use cosign v2.4.1+carbide.2 to address containerd annotation in index.json (#390)\n  * Bump the go_modules group across 1 directory with 2 updates (#385)\n  * replace mholt/archiver with mholt/archives (#384)\n  * forked cosign bump to 2.4.1 and use as a library vs embedded binary (#383)\n  * cleaned up registry and improved logging (#378)\n  * Bump golang.org/x/crypto in the go_modules group across 1 directory (#377)\n- bump net/html dependencies (bsc#1235332, CVE-2024-45338)\n\n- Update to version 1.1.1:\n  * fixed cli desc for store env var (#374)\n  * updated versions for go/k8s/helm (#373)\n  * updated version flag to internal/flags (#369)\n  * renamed incorrectly named consts (#371)\n  * added store env var (#370)\n  * adding ignore errors and retries for continue on error/fail on error (#368)\n  * updated/fixed hauler directory (#354)\n  * standardize consts (#353)\n  * removed cachedir code (#355)\n  * removed k3s code (#352)\n  * updated dependencies for go, helm, and k8s (#351)\n  * [feature] build with boring crypto where available (#344)\n  * updated workflow to goreleaser builds (#341)\n  * added timeout to goreleaser workflow (#340)\n  * trying new workflow build processes (#337)\n  * improved workflow performance (#336)\n  * have extract use proper ref (#335)\n  * yet another workflow goreleaser fix (#334)\n  * even more workflow fixes (#333)\n  * added more fixes to github workflow (#332)\n  * fixed typo in hauler store save (#331)\n  * updates to fix build processes (#330)\n  * added integration tests for non hauler tarballs (#325)\n  * bump: golang \u003e= 1.23.1 (#328)\n  * add platform flag to store save (#329)\n  * Update feature_request.md\n  * updated/standardize command descriptions (#313)\n  * use new annotation for \u0027store save\u0027 manifest.json (#324)\n  * enable docker load for hauler tarballs (#320)\n  * bump to cosign v2.2.3-carbide.3 for new annotation (#322)\n  * continue on error when adding images to store (#317)\n  * Update README.md (#318)\n  * fixed completion commands (#312)\n  * github.com/rancherfederal/hauler =\u003e hauler.dev/go/hauler (#311)\n  * pages: enable go install hauler.dev/go/hauler (#310)\n  * Create CNAME\n  * pages: initial workflow (#309)\n  * testing and linting updates (#305)\n  * feat-273: TLS Flags (#303)\n  * added list-repos flag (#298)\n  * fixed hauler login typo (#299)\n  * updated cobra function for shell completion (#304)\n  * updated install.sh to remove github api (#293)\n  * fix image ref keys getting squashed when containing sigs/atts (#291)\n  * fix missing versin info in release build (#283)\n  * bump github.com/docker/docker in the go_modules group across 1 directory (#281)\n  * updated install script (`install.sh`) (#280)\n  * fix digest images being lost on load of hauls (Signed). (#259)\n  * feat: add readonly flag (#277)\n  * fixed makefile for goreleaser v2 changes (#278)\n  * updated goreleaser versioning defaults (#279)\n  * update feature_request.md (#274)\n  * updated old references\n  * updated actions workflow user\n  * added dockerhub to github actions workflow\n  * removed helm chart\n  * added debug container and workflow\n  * updated products flag description\n  * updated chart for release\n  * fixed workflow errors/warnings\n  * fixed permissions on testdata\n  * updated chart versions (will need to update again)\n  * last bit of fixes to workflow\n  * updated unit test workflow\n  * updated goreleaser deprecations\n  * added helm chart release job\n  * updated github template names\n  * updated imports (and go fmt)\n  * formatted gitignore to match dockerignore\n  * formatted all code (go fmt)\n  * updated chart tests for new features\n  * Adding the timeout flag for fileserver command\n  * Configure chart commands to use helm clients for OCI and private registry support\n  * Added some documentation text to sync command\n  * Bump golang.org/x/net from 0.17.0 to 0.23.0\n  * fix for dup digest smashing in cosign\n  * removed vagrant scripts\n  * last bit of updates and formatting of chart\n  * updated hauler testdata\n  * adding functionality and cleaning up\n  * added initial helm chart\n  * removed tag in release workflow\n  * updated/fixed image ref in release workflow\n  * updated/fixed platforms in release workflow\n  * updated/cleaned github actions (#222)\n  * Make Product Registry configurable (#194)\n  * updated fileserver directory name (#219)\n  * fix logging for files\n  * add extra info for the tempdir override flag\n  * tempdir override flag for load\n  * deprecate the cache flag instead of remove\n  * switch to using bci-golang as builder image\n  * fix: ensure /tmp for hauler store load\n  * added the copy back for now\n  * remove copy at the image sync not needed with cosign update\n  * removed misleading cache flag\n  * better logging when adding to store\n  * update to v2.2.3 of our cosign fork\n  * add: dockerignore\n  * add: Dockerfile\n  * Bump google.golang.org/protobuf from 1.31.0 to 1.33.0\n  * Bump github.com/docker/docker\n  * updated and added new logos\n  * updated github files\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Leap-16.0-packagehub-54",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2025_20160-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1235332",
        "url": "https://bugzilla.suse.com/1235332"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1241184",
        "url": "https://bugzilla.suse.com/1241184"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1241804",
        "url": "https://bugzilla.suse.com/1241804"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1246722",
        "url": "https://bugzilla.suse.com/1246722"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1248937",
        "url": "https://bugzilla.suse.com/1248937"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1251516",
        "url": "https://bugzilla.suse.com/1251516"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1251651",
        "url": "https://bugzilla.suse.com/1251651"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1251891",
        "url": "https://bugzilla.suse.com/1251891"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-0406 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-0406/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-45338 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-45338/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-11579 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-11579/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-22872 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-22872/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-46569 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-46569/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-47911 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-47911/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-58058 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-58058/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-58190 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-58190/"
      }
    ],
    "title": "Security update for hauler",
    "tracking": {
      "current_release_date": "2025-12-12T13:20:11Z",
      "generator": {
        "date": "2025-12-12T13:20:11Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2025:20160-1",
      "initial_release_date": "2025-12-12T13:20:11Z",
      "revision_history": [
        {
          "date": "2025-12-12T13:20:11Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "hauler-1.3.1-bp160.1.1.aarch64",
                "product": {
                  "name": "hauler-1.3.1-bp160.1.1.aarch64",
                  "product_id": "hauler-1.3.1-bp160.1.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "hauler-1.3.1-bp160.1.1.x86_64",
                "product": {
                  "name": "hauler-1.3.1-bp160.1.1.x86_64",
                  "product_id": "hauler-1.3.1-bp160.1.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Leap 16.0",
                "product": {
                  "name": "openSUSE Leap 16.0",
                  "product_id": "openSUSE Leap 16.0"
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "hauler-1.3.1-bp160.1.1.aarch64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:hauler-1.3.1-bp160.1.1.aarch64"
        },
        "product_reference": "hauler-1.3.1-bp160.1.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "hauler-1.3.1-bp160.1.1.x86_64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:hauler-1.3.1-bp160.1.1.x86_64"
        },
        "product_reference": "hauler-1.3.1-bp160.1.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-0406",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-0406"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was discovered in the mholt/archiver package. This flaw allows an attacker to create a specially crafted tar file, which, when unpacked, may allow access to restricted files or directories. This issue can allow the creation or overwriting of files with the user\u0027s or application\u0027s privileges using the library.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:hauler-1.3.1-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:hauler-1.3.1-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-0406",
          "url": "https://www.suse.com/security/cve/CVE-2024-0406"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1241181 for CVE-2024-0406",
          "url": "https://bugzilla.suse.com/1241181"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:hauler-1.3.1-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:hauler-1.3.1-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:hauler-1.3.1-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:hauler-1.3.1-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-12-12T13:20:11Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-0406"
    },
    {
      "cve": "CVE-2024-45338",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-45338"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:hauler-1.3.1-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:hauler-1.3.1-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-45338",
          "url": "https://www.suse.com/security/cve/CVE-2024-45338"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1234794 for CVE-2024-45338",
          "url": "https://bugzilla.suse.com/1234794"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:hauler-1.3.1-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:hauler-1.3.1-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:hauler-1.3.1-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:hauler-1.3.1-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-12-12T13:20:11Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-45338"
    },
    {
      "cve": "CVE-2025-11579",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-11579"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "github.com/nwaples/rardecode versions \u003c=2.1.1 fail to restrict the dictionary size when reading  large RAR  dictionary sizes, which allows an attacker to provide a specially crafted RAR file and cause Denial of Service via an Out Of Memory Crash.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:hauler-1.3.1-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:hauler-1.3.1-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-11579",
          "url": "https://www.suse.com/security/cve/CVE-2025-11579"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1251871 for CVE-2025-11579",
          "url": "https://bugzilla.suse.com/1251871"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:hauler-1.3.1-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:hauler-1.3.1-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 3.3,
            "baseSeverity": "LOW",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:hauler-1.3.1-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:hauler-1.3.1-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-12-12T13:20:11Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-11579"
    },
    {
      "cve": "CVE-2025-22872",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-22872"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. \u003cmath\u003e, \u003csvg\u003e, etc contexts).",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:hauler-1.3.1-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:hauler-1.3.1-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-22872",
          "url": "https://www.suse.com/security/cve/CVE-2025-22872"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1241710 for CVE-2025-22872",
          "url": "https://bugzilla.suse.com/1241710"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:hauler-1.3.1-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:hauler-1.3.1-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:hauler-1.3.1-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:hauler-1.3.1-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-12-12T13:20:11Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-22872"
    },
    {
      "cve": "CVE-2025-46569",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-46569"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Open Policy Agent (OPA) is an open source, general-purpose policy engine. Prior to version 1.4.0, when run as a server, OPA exposes an HTTP Data API for reading and writing documents. Requesting a virtual document through the Data API entails policy evaluation, where a Rego query containing a single data document reference is constructed from the requested path. This query is then used for policy evaluation. A HTTP request path can be crafted in a way that injects Rego code into the constructed query. The evaluation result cannot be made to return any other data than what is generated by the requested path, but this path can be misdirected, and the injected Rego code can be crafted to make the query succeed or fail; opening up for oracle attacks or, given the right circumstances, erroneous policy decision results. Furthermore, the injected code can be crafted to be computationally expensive, resulting in a Denial Of Service (DoS) attack. This issue has been patched in version 1.4.0. A workaround involves having network access to OPA\u0027s RESTful APIs being limited to `localhost` and/or trusted networks, unless necessary for production reasons.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:hauler-1.3.1-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:hauler-1.3.1-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-46569",
          "url": "https://www.suse.com/security/cve/CVE-2025-46569"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1246710 for CVE-2025-46569",
          "url": "https://bugzilla.suse.com/1246710"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:hauler-1.3.1-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:hauler-1.3.1-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:hauler-1.3.1-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:hauler-1.3.1-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-12-12T13:20:11Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-46569"
    },
    {
      "cve": "CVE-2025-47911",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-47911"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "unknown",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:hauler-1.3.1-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:hauler-1.3.1-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-47911",
          "url": "https://www.suse.com/security/cve/CVE-2025-47911"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1251308 for CVE-2025-47911",
          "url": "https://bugzilla.suse.com/1251308"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:hauler-1.3.1-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:hauler-1.3.1-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:hauler-1.3.1-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:hauler-1.3.1-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-12-12T13:20:11Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-47911"
    },
    {
      "cve": "CVE-2025-58058",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-58058"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "xz is a pure golang package for reading and writing xz-compressed files. Prior to version 0.5.14, it is possible to put data in front of an LZMA-encoded byte stream without detecting the situation while reading the header. This can lead to increased memory consumption because the current implementation allocates the full decoding buffer directly after reading the header. The LZMA header doesn\u0027t include a magic number or has a checksum to detect such an issue according to the specification. Note that the code recognizes the issue later while reading the stream, but at this time the memory allocation has already been done. This issue has been patched in version 0.5.14.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:hauler-1.3.1-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:hauler-1.3.1-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-58058",
          "url": "https://www.suse.com/security/cve/CVE-2025-58058"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1248889 for CVE-2025-58058",
          "url": "https://bugzilla.suse.com/1248889"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:hauler-1.3.1-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:hauler-1.3.1-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:hauler-1.3.1-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:hauler-1.3.1-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-12-12T13:20:11Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-58058"
    },
    {
      "cve": "CVE-2025-58190",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-58190"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "unknown",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:hauler-1.3.1-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:hauler-1.3.1-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-58190",
          "url": "https://www.suse.com/security/cve/CVE-2025-58190"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1251309 for CVE-2025-58190",
          "url": "https://bugzilla.suse.com/1251309"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:hauler-1.3.1-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:hauler-1.3.1-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:hauler-1.3.1-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:hauler-1.3.1-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-12-12T13:20:11Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-58190"
    }
  ]
}