OPENSUSE-SU-2026:11551-1

Vulnerability from csaf_opensuse - Published: 2026-08-19 00:00 - Updated: 2026-08-19 00:00
Summary
perl-Net-OAuth-0.330.0-1.1 on GA media
Severity
Moderate
Notes
Title of the patch: perl-Net-OAuth-0.330.0-1.1 on GA media
Description of the patch: These are all security issues fixed in the perl-Net-OAuth-0.330.0-1.1 package on the GA media of openSUSE Tumbleweed.
Patchnames: openSUSE-Tumbleweed-2026-11551
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
CVE-2026-72887
Affected products
Product Identifier Version Remediation
Unresolved product id: openSUSE Tumbleweed:perl-Net-OAuth-0.330.0-1.1.aarch64 —
Vendor Fix
Unresolved product id: openSUSE Tumbleweed:perl-Net-OAuth-0.330.0-1.1.ppc64le —
Vendor Fix
Unresolved product id: openSUSE Tumbleweed:perl-Net-OAuth-0.330.0-1.1.s390x —
Vendor Fix
Unresolved product id: openSUSE Tumbleweed:perl-Net-OAuth-0.330.0-1.1.x86_64 —
Vendor Fix
Threats
Impact critical
CVE-2026-72888
Affected products
Product Identifier Version Remediation
Unresolved product id: openSUSE Tumbleweed:perl-Net-OAuth-0.330.0-1.1.aarch64 —
Vendor Fix
Unresolved product id: openSUSE Tumbleweed:perl-Net-OAuth-0.330.0-1.1.ppc64le —
Vendor Fix
Unresolved product id: openSUSE Tumbleweed:perl-Net-OAuth-0.330.0-1.1.s390x —
Vendor Fix
Unresolved product id: openSUSE Tumbleweed:perl-Net-OAuth-0.330.0-1.1.x86_64 —
Vendor Fix
Threats
Impact moderate
CVE-2026-72889
Affected products
Product Identifier Version Remediation
Unresolved product id: openSUSE Tumbleweed:perl-Net-OAuth-0.330.0-1.1.aarch64 —
Vendor Fix
Unresolved product id: openSUSE Tumbleweed:perl-Net-OAuth-0.330.0-1.1.ppc64le —
Vendor Fix
Unresolved product id: openSUSE Tumbleweed:perl-Net-OAuth-0.330.0-1.1.s390x —
Vendor Fix
Unresolved product id: openSUSE Tumbleweed:perl-Net-OAuth-0.330.0-1.1.x86_64 —
Vendor Fix
Threats
Impact moderate
CVE-2026-75589
Affected products
Product Identifier Version Remediation
Unresolved product id: openSUSE Tumbleweed:perl-Net-OAuth-0.330.0-1.1.aarch64 —
Vendor Fix
Unresolved product id: openSUSE Tumbleweed:perl-Net-OAuth-0.330.0-1.1.ppc64le —
Vendor Fix
Unresolved product id: openSUSE Tumbleweed:perl-Net-OAuth-0.330.0-1.1.s390x —
Vendor Fix
Unresolved product id: openSUSE Tumbleweed:perl-Net-OAuth-0.330.0-1.1.x86_64 —
Vendor Fix
Threats
Impact moderate
References
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "perl-Net-OAuth-0.330.0-1.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the perl-Net-OAuth-0.330.0-1.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2026-11551",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_11551-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-72887 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-72887/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-72888 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-72888/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-72889 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-72889/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-75589 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-75589/"
      }
    ],
    "title": "perl-Net-OAuth-0.330.0-1.1 on GA media",
    "tracking": {
      "current_release_date": "2026-08-19T00:00:00Z",
      "generator": {
        "date": "2026-08-19T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:11551-1",
      "initial_release_date": "2026-08-19T00:00:00Z",
      "revision_history": [
        {
          "date": "2026-08-19T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "perl-Net-OAuth-0.330.0-1.1.aarch64",
                "product": {
                  "name": "perl-Net-OAuth-0.330.0-1.1.aarch64",
                  "product_id": "perl-Net-OAuth-0.330.0-1.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "perl-Net-OAuth-0.330.0-1.1.ppc64le",
                "product": {
                  "name": "perl-Net-OAuth-0.330.0-1.1.ppc64le",
                  "product_id": "perl-Net-OAuth-0.330.0-1.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "perl-Net-OAuth-0.330.0-1.1.s390x",
                "product": {
                  "name": "perl-Net-OAuth-0.330.0-1.1.s390x",
                  "product_id": "perl-Net-OAuth-0.330.0-1.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "perl-Net-OAuth-0.330.0-1.1.x86_64",
                "product": {
                  "name": "perl-Net-OAuth-0.330.0-1.1.x86_64",
                  "product_id": "perl-Net-OAuth-0.330.0-1.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perl-Net-OAuth-0.330.0-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:perl-Net-OAuth-0.330.0-1.1.aarch64"
        },
        "product_reference": "perl-Net-OAuth-0.330.0-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perl-Net-OAuth-0.330.0-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:perl-Net-OAuth-0.330.0-1.1.ppc64le"
        },
        "product_reference": "perl-Net-OAuth-0.330.0-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perl-Net-OAuth-0.330.0-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:perl-Net-OAuth-0.330.0-1.1.s390x"
        },
        "product_reference": "perl-Net-OAuth-0.330.0-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "perl-Net-OAuth-0.330.0-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:perl-Net-OAuth-0.330.0-1.1.x86_64"
        },
        "product_reference": "perl-Net-OAuth-0.330.0-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-72887",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-72887"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Net::OAuth::Client versions before 0.32 for Perl allow the service provider to silently downgrade OAuth 1.0a to OAuth 1.0 in get_request_token.\n\nPassing a callback to the constructor selects OAuth 1.0a. get_request_token then revokes that choice when the request token response omits oauth_callback_confirmed, with no exception, no warning and no option to require 1.0a. The access token request is built from the OAuth 1.0 message class, which has no verifier parameter, so oauth_verifier is dropped from the request even when get_access_token was passed one.\n\noauth_verifier is the binding that OAuth 1.0a added between the authorization step and the token exchange. An application that asked for 1.0a and gets 1.0 is open to OAuth 1.0 session fixation, where an attacker obtains a request token, has the victim authorize it, and then completes the exchange themselves, linking the victim\u0027s provider account to a session the attacker controls. No attacker action sets up the downgrade: a provider that does not confirm the callback is enough.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:perl-Net-OAuth-0.330.0-1.1.aarch64",
          "openSUSE Tumbleweed:perl-Net-OAuth-0.330.0-1.1.ppc64le",
          "openSUSE Tumbleweed:perl-Net-OAuth-0.330.0-1.1.s390x",
          "openSUSE Tumbleweed:perl-Net-OAuth-0.330.0-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-72887",
          "url": "https://www.suse.com/security/cve/CVE-2026-72887"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1275447 for CVE-2026-72887",
          "url": "https://bugzilla.suse.com/1275447"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:perl-Net-OAuth-0.330.0-1.1.aarch64",
            "openSUSE Tumbleweed:perl-Net-OAuth-0.330.0-1.1.ppc64le",
            "openSUSE Tumbleweed:perl-Net-OAuth-0.330.0-1.1.s390x",
            "openSUSE Tumbleweed:perl-Net-OAuth-0.330.0-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-19T00:00:00Z",
          "details": "critical"
        }
      ],
      "title": "CVE-2026-72887"
    },
    {
      "cve": "CVE-2026-72888",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-72888"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Net::OAuth versions before 0.32 for Perl allow memory exhaustion via unbounded caching of failed module loads in smart_require.\n\nsmart_require stores results in a process-global hash with no bound and no eviction, and keeps an entry for every class name it is asked about, including names that failed to load, because the return value of the failed eval is stored before the error is checked. The key comes off the wire on the server side: _signature_method_class builds the class name from the signature_method parameter of the incoming message, and verify resolves it before any signature is checked.\n\nA remote client chooses both how many entries are created and how long each key is. In a persistent server the hash grows for the life of the worker process until it exhausts memory. Header size limits bound the key length on the Authorization header path, but not on a POST body.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:perl-Net-OAuth-0.330.0-1.1.aarch64",
          "openSUSE Tumbleweed:perl-Net-OAuth-0.330.0-1.1.ppc64le",
          "openSUSE Tumbleweed:perl-Net-OAuth-0.330.0-1.1.s390x",
          "openSUSE Tumbleweed:perl-Net-OAuth-0.330.0-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-72888",
          "url": "https://www.suse.com/security/cve/CVE-2026-72888"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1275446 for CVE-2026-72888",
          "url": "https://bugzilla.suse.com/1275446"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:perl-Net-OAuth-0.330.0-1.1.aarch64",
            "openSUSE Tumbleweed:perl-Net-OAuth-0.330.0-1.1.ppc64le",
            "openSUSE Tumbleweed:perl-Net-OAuth-0.330.0-1.1.s390x",
            "openSUSE Tumbleweed:perl-Net-OAuth-0.330.0-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-19T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-72888"
    },
    {
      "cve": "CVE-2026-72889",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-72889"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Net::OAuth versions before 0.33 for Perl allow the sender to choose the signature algorithm in verify.\n\nverify resolves the signature method class from the signature_method parameter of the incoming message. signature_method is required on every request, so the algorithm used to check a signature is chosen by whoever sent it, and nothing lets the verifying party pin the method instead. When a message names HMAC-SHA1 or HMAC-SHA256, the key is derived from consumer_secret and token_secret rather than from the key the provider deployed.\n\nA provider deployed on RSA-SHA1 holds only the consumer public key, and RFC 5849 does not use consumer_secret for that method, so the required parameter is filled with a placeholder. A client that names HMAC-SHA1 instead has its signature checked against that placeholder, so a guessable one is enough to forge requests for any consumer key and token.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:perl-Net-OAuth-0.330.0-1.1.aarch64",
          "openSUSE Tumbleweed:perl-Net-OAuth-0.330.0-1.1.ppc64le",
          "openSUSE Tumbleweed:perl-Net-OAuth-0.330.0-1.1.s390x",
          "openSUSE Tumbleweed:perl-Net-OAuth-0.330.0-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-72889",
          "url": "https://www.suse.com/security/cve/CVE-2026-72889"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1275759 for CVE-2026-72889",
          "url": "https://bugzilla.suse.com/1275759"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:perl-Net-OAuth-0.330.0-1.1.aarch64",
            "openSUSE Tumbleweed:perl-Net-OAuth-0.330.0-1.1.ppc64le",
            "openSUSE Tumbleweed:perl-Net-OAuth-0.330.0-1.1.s390x",
            "openSUSE Tumbleweed:perl-Net-OAuth-0.330.0-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-19T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-72889"
    },
    {
      "cve": "CVE-2026-75589",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-75589"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Net::OAuth versions before 0.33 for Perl check HMAC-SHA1, HMAC-SHA256 and PLAINTEXT signatures with a non-constant-time comparison in verify.\n\nEach of the three compares the signature carried in the message against the locally computed one with the eq operator, which returns as soon as the two strings differ. The time taken to reject a signature varies with the length of the matching prefix. RSA-SHA1 is not affected, as it verifies through the RSA key object rather than by comparing strings.\n\nA client that can submit messages and time the replies may recover a valid signature one byte at a time rather than searching the whole signature space. Under PLAINTEXT the value compared against is the signature key itself, so the search recovers consumer_secret and token_secret.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:perl-Net-OAuth-0.330.0-1.1.aarch64",
          "openSUSE Tumbleweed:perl-Net-OAuth-0.330.0-1.1.ppc64le",
          "openSUSE Tumbleweed:perl-Net-OAuth-0.330.0-1.1.s390x",
          "openSUSE Tumbleweed:perl-Net-OAuth-0.330.0-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-75589",
          "url": "https://www.suse.com/security/cve/CVE-2026-75589"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1275651 for CVE-2026-75589",
          "url": "https://bugzilla.suse.com/1275651"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:perl-Net-OAuth-0.330.0-1.1.aarch64",
            "openSUSE Tumbleweed:perl-Net-OAuth-0.330.0-1.1.ppc64le",
            "openSUSE Tumbleweed:perl-Net-OAuth-0.330.0-1.1.s390x",
            "openSUSE Tumbleweed:perl-Net-OAuth-0.330.0-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-08-19T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-75589"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.