Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2025:03445-1

Опубликовано: 01 окт. 2025
Источник: suse-cvrf

Описание

Security update for snpguest

This update for snpguest fixes the following issues:

  • CVE-2024-12224: idna: acceptance of Punycode labels that do not produce any non-ASCII output may lead to incorrect hostname comparisons and incorrect URL parsing (bsc#1243869).
  • CVE-2025-3416: openssl: use-after-free in Md::fetch and Cipher::fetch when Some(...) value is passed to the properties argument (bsc#1242601).

Список пакетов

Container suse/manager/5.0/x86_64/server-attestation:latest
snpguest-0.3.2-150600.3.6.1
SUSE Linux Enterprise Module for Server Applications 15 SP6
snpguest-0.3.2-150600.3.6.1
openSUSE Leap 15.6
snpguest-0.3.2-150600.3.6.1

Ссылки

Описание

Improper Validation of Unsafe Equivalence in punycode by the idna crate from Servo rust-url allows an attacker to create a punycode hostname that one part of a system might treat as distinct while another part of that system would treat as equivalent to another hostname.

Затронутые продукты
Container suse/manager/5.0/x86_64/server-attestation:latest:snpguest-0.3.2-150600.3.6.1
SUSE Linux Enterprise Module for Server Applications 15 SP6:snpguest-0.3.2-150600.3.6.1
openSUSE Leap 15.6:snpguest-0.3.2-150600.3.6.1
Ссылки

Описание

A flaw was found in OpenSSL's handling of the properties argument in certain functions. This vulnerability can allow use-after-free exploitation, which may result in undefined behavior or incorrect property parsing, leading to OpenSSL treating the input as an empty string.

Затронутые продукты
Container suse/manager/5.0/x86_64/server-attestation:latest:snpguest-0.3.2-150600.3.6.1
SUSE Linux Enterprise Module for Server Applications 15 SP6:snpguest-0.3.2-150600.3.6.1
openSUSE Leap 15.6:snpguest-0.3.2-150600.3.6.1
Ссылки
Уязвимость SUSE-SU-2025:03445-1