SUSE-SU-2026:4125-1
Security update for azure-storage-azcopy
Severidad por fuente
Ninguna fuente da una puntuación CVSS.
La etiqueta propia de Trivy es CRITICAL. Crítica según SUSE.
Descripción
This update for azure-storage-azcopy fixes the following issues: - CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs (bsc#1276733). - CVE-2026-84303: google.golang.org/grpc: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches (bsc#1279330). - CVE-2026-84304: google.golang.org/grpc: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1279223). - CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS servers (bsc#1279026). Changes for azure-storage-azcopy: - Update to 10.32.8
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| SUSE Linux Enterprise 15.4 | azure-storage-azcopy | 10.32.8-150400.9.21.1 |
| SUSE Linux Enterprise 15.5 | azure-storage-azcopy | 10.32.8-150400.9.21.1 |
| SUSE Linux Enterprise 15.6 | azure-storage-azcopy | 10.32.8-150400.9.21.1 |
| SUSE Linux Enterprise 15.7 | azure-storage-azcopy | 10.32.8-150400.9.21.1 |
Referencias
- https://bugzilla.suse.com/1276733
- https://bugzilla.suse.com/1279026
- https://bugzilla.suse.com/1279223
- https://bugzilla.suse.com/1279330
- https://lists.suse.com/pipermail/sle-security-updates/2026-September/029011.html
- https://www.suse.com/security/cve/CVE-2026-41178/
- https://www.suse.com/security/cve/CVE-2026-84303/
- https://www.suse.com/security/cve/CVE-2026-84304/