Описание
Security update for himmelblau
This update for himmelblau fixes the following issues:
Update to version 2.3.9+git0.a9fd29b; (jsc#PED-14511):
- CVE-2026-34397: Fix LPE due to name collision during NSS fake-primary group lookup (bsc#1261324).
- CVE-2026-31979: Fix race condition when accessiung /tmp/krb5cc_uid (bsc#1259548).
- CVE-2026-25727: deps(rust): Bump the
all-cargo-updatesgroup with 8 updates (bsc#1257904). - CVE-2025-58160: deps(rust): Bump
tracing-subscriberin the cargo group (bsc#1249013). - CVE-2025-54882: Fix Kerberos credential cache permissions (bsc#1247735).
- CVE-2025-53013: Fix permitted authentication with invalid Hello PIN (bsc#1245437).
- CVE-2024-11738: Fix
rustlsnetwork-reachable panic inAcceptor::accept(bsc#1233949).
Other bug fixes:
- Fix SELinux module packaging to use standard policy macros (bsc#1258236).
Список пакетов
SUSE Linux Enterprise Module for Basesystem 15 SP7
Ссылки
- Link for SUSE-SU-2026:1361-1
- E-Mail link for SUSE-SU-2026:1361-1
- SUSE Security Ratings
- SUSE Bug 1233949
- SUSE Bug 1245437
- SUSE Bug 1247735
- SUSE Bug 1249013
- SUSE Bug 1257904
- SUSE Bug 1258236
- SUSE Bug 1259548
- SUSE Bug 1261324
- SUSE CVE CVE-2024-11738 page
- SUSE CVE CVE-2025-53013 page
- SUSE CVE CVE-2025-54882 page
- SUSE CVE CVE-2025-58160 page
- SUSE CVE CVE-2026-25727 page
- SUSE CVE CVE-2026-31979 page
- SUSE CVE CVE-2026-34397 page
Описание
A flaw was found in Rustls 0.23.13 and related APIs. This vulnerability allows denial of service (panic) via a fragmented TLS ClientHello message.
Затронутые продукты
Ссылки
- CVE-2024-11738
- SUSE Bug 1233897
Описание
Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. A vulnerability present in versions 0.9.10 through 0.9.16 allows a user to authenticate to a Linux host via Himmelblau using an *invalid* Linux Hello PIN, provided the host is offline. While the user gains access to the local system, Single Sign-On (SSO) fails due to the network being down and the inability to issue tokens (due to a failure to unlock the Hello key). The core issue lies in an incorrect assumption within the `acquire_token_by_hello_for_business_key` function: it was expected to return a `TPMFail` error for an invalid Hello key when offline, but instead, a preceding nonce request resulted in a `RequestFailed` error, leading the system to erroneously transition to an offline success state without validating the Hello key unlock. This impacts systems using Himmelblau for authentication when operating in an offline state with Hello PIN authentication enabled. Rocky Linux 8 (and variants) are not affected by this vulnerability. The problem is resolved in Himmelblau version 0.9.17. A workaround is available for users who cannot immediately upgrade. Disabling Hello PIN authentication by setting `enable_hello = false` in `/etc/himmelblau/himmelblau.conf` will mitigate the vulnerability.
Затронутые продукты
Ссылки
- CVE-2025-53013
- SUSE Bug 1245437
Описание
Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. In versions 0.8.0 through 0.9.21 and 1.0.0-beta through 1.1.0, Himmelblau stores the cloud TGT received during logon in the Kerberos credential cache. The created credential cache collection and received credentials are stored as world readable. This is fixed in versions 0.9.22 and 1.2.0. To work around this issue, remove all read access to Himmelblau caches for all users except for owners.
Затронутые продукты
Ссылки
- CVE-2025-54882
- SUSE Bug 1247735
Описание
tracing is a framework for instrumenting Rust programs to collect structured, event-based diagnostic information. Prior to version 0.3.20, tracing-subscriber was vulnerable to ANSI escape sequence injection attacks. Untrusted user input containing ANSI escape sequences could be injected into terminal output when logged, potentially allowing attackers to manipulate terminal title bars, clear screens or modify terminal display, and potentially mislead users through terminal manipulation. tracing-subscriber version 0.3.20 fixes this vulnerability by escaping ANSI control characters when writing events to destinations that may be printed to the terminal. A workaround involves avoiding printing logs to terminal emulators without escaping ANSI control sequences.
Затронутые продукты
Ссылки
- CVE-2025-58160
- SUSE Bug 1249007
Описание
time provides date and time handling in Rust. From 0.3.6 to before 0.3.47, when user-provided input is provided to any type that parses with the RFC 2822 format, a denial of service attack via stack exhaustion is possible. The attack relies on formally deprecated and rarely-used features that are part of the RFC 2822 format used in a malicious manner. Ordinary, non-malicious input will never encounter this scenario. A limit to the depth of recursion was added in v0.3.47. From this version, an error will be returned rather than exhausting the stack.
Затронутые продукты
Ссылки
- CVE-2026-25727
- SUSE Bug 1257901
Описание
Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. Prior to 3.1.0 and 2.3.8, the himmelblaud-tasks daemon, running as root, writes Kerberos cache files under /tmp/krb5cc_<uid> without symlink protections. Since commit 87a51ee, PrivateTmp is explicitly removed from the tasks daemon's systemd hardening, exposing it to the host /tmp. A local user can exploit this via symlink attacks to chown or overwrite arbitrary files, achieving local privilege escalation. This vulnerability is fixed in 3.1.0 and 2.3.8.
Затронутые продукты
Ссылки
- CVE-2026-31979
- SUSE Bug 1259548
Описание
Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. From versions 2.0.0-alpha to before 2.3.9 and 3.0.0-alpha to before 3.1.1, there is a conditional local privilege escalation vulnerability in an edge-case naming collision. Only authenticated himmelblau users whose mapped CN/short name exactly matches a privileged local group name (e.g., "sudo", "wheel", "docker", "adm") can cause the NSS module to resolve that group name to their fake primary group. If the system uses NSS results for group-based authorization decisions (sudo, polkit, etc.), this can grant the attacker the privileges of that group. This issue has been patched in versions 2.3.9 and 3.1.1.
Затронутые продукты
Ссылки
- CVE-2026-34397
- SUSE Bug 1261324