openSUSE-SU-2026:21927-1
Security update for apptainer
Kaynağa göre önem derecesi
Hiçbir kaynak CVSS puanı vermiyor.
Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: SUSE.
Açıklama
This update for apptainer fixes the following issues: Changes in apptainer: - Fix potential authentication bypass and deadlocks in the crypto/ssh library by updating golang.org/x/crypto to v0.56.0. CVE-2026-56854,CVE-2026-78662,CVE-2026-56855 (bsc#1278666) - Fix * a potential DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS servers CVE-2026-84445 (bsc#1279033), * a potential heap memory exhaustion via HTTP/2 DATA frame fragmentation CVE-2026-84304 (bsc#1279236), * a potential bypass of authorization policies via mixed-case or canonical-case header matches due to an xDS RBAC HTTP filter implementation issue CVE-2026-84303 (bsc#1279333) by updating google.golang.org/grpc to v1.83.2
Etkilenen paketler ve düzeltilmiş sürümler
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| openSUSE Leap 16.0 | apptainer, apptainer-leap | 1.5.3-bp160.4.1 |
1 kaynaktaki 2 kaydın hepsini göster
| Kaynak | Paket | Düzeltildiği sürüm |
|---|---|---|
| openSUSE Leap 16.0 | apptainer | 1.5.3-bp160.4.1 |
| openSUSE Leap 16.0 | apptainer-leap | 1.5.3-bp160.4.1 |
Referanslar
- https://bugzilla.suse.com/1278666
- https://bugzilla.suse.com/1279033
- https://bugzilla.suse.com/1279236
- https://bugzilla.suse.com/1279333
- https://www.suse.com/security/cve/CVE-2026-56854/
- https://www.suse.com/security/cve/CVE-2026-56855/
- https://www.suse.com/security/cve/CVE-2026-78662/
- https://www.suse.com/security/cve/CVE-2026-84303/