Описание
Security update for go1.26-openssl
This update for go1.26-openssl fixes the following issues:
- Update to go1.26.2 (bsc#1255111).
- CVE-2026-27140: cmd/go: trust layer bypass when using cgo and SWIG (bsc#1261653).
- CVE-2026-27143: cmd/compile: possible memory corruption after bound check elimination (bsc#1261654).
- CVE-2026-27144: cmd/compile: no-op interface conversion bypasses overlap checking (bsc#1261655).
- CVE-2026-32280: crypto/x509: unexpected work during chain building (bsc#1261656).
- CVE-2026-32281: crypto/x509: inefficient policy validation (bsc#1261657).
- CVE-2026-32282: os: Root.Chmod can follow symlinks out of the root on Linux (bsc#1261658).
- CVE-2026-32283: crypto/tls: multiple key update handshake messages can cause connection to deadlock (bsc#1261659).
- CVE-2026-32288: archive/tar: unbounded allocation when parsing old format GNU sparse map (bsc#1261660).
- CVE-2026-32289: html/template: JS template literal context incorrectly tracked (bsc#1261661).
- CVE-2026-33810: crypto/x509: excluded DNS constraints not properly applied to wildcard domains (bsc#1261662).
Список пакетов
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS
SUSE Linux Enterprise Server 15 SP4-LTSS
SUSE Linux Enterprise Server 15 SP5-LTSS
SUSE Linux Enterprise Server for SAP Applications 15 SP4
SUSE Linux Enterprise Server for SAP Applications 15 SP5
Ссылки
- Link for SUSE-SU-2026:1580-1
- E-Mail link for SUSE-SU-2026:1580-1
- SUSE Security Ratings
- SUSE Bug 1255111
- SUSE Bug 1261653
- SUSE Bug 1261654
- SUSE Bug 1261655
- SUSE Bug 1261656
- SUSE Bug 1261657
- SUSE Bug 1261658
- SUSE Bug 1261659
- SUSE Bug 1261660
- SUSE Bug 1261661
- SUSE Bug 1261662
- SUSE CVE CVE-2026-27140 page
- SUSE CVE CVE-2026-27143 page
- SUSE CVE CVE-2026-27144 page
- SUSE CVE CVE-2026-32280 page
- SUSE CVE CVE-2026-32281 page
- SUSE CVE CVE-2026-32282 page
Описание
SWIG file names containing 'cgo' and well-crafted payloads could lead to code smuggling and arbitrary code execution at build time due to trust layer bypass.
Затронутые продукты
Ссылки
- CVE-2026-27140
- SUSE Bug 1261653
Описание
Arithmetic over induction variables in loops were not correctly checked for underflow or overflow. As a result, the compiler would allow for invalid indexing to occur at runtime, potentially leading to memory corruption.
Затронутые продукты
Ссылки
- CVE-2026-27143
- SUSE Bug 1261654
Описание
The compiler is meant to unwrap pointers which are the operands of a memory move; a no-op interface conversion prevented the compiler from making the correct determination about non-overlapping moves, potentially leading to memory corruption at runtime.
Затронутые продукты
Ссылки
- CVE-2026-27144
- SUSE Bug 1261655
Описание
During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and users of crypto/tls.
Затронутые продукты
Ссылки
- CVE-2026-32280
- SUSE Bug 1261656
Описание
Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool.
Затронутые продукты
Ссылки
- CVE-2026-32281
- SUSE Bug 1261657
Описание
On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even when the target lies outside the root. The Linux fchmodat syscall silently ignores the AT_SYMLINK_NOFOLLOW flag, which Root.Chmod uses to avoid symlink traversal. Root.Chmod checks its target before acting and returns an error if the target is a symlink lying outside the root, so the impact is limited to cases where the target is replaced with a symlink between the check and operation.
Затронутые продукты
Ссылки
- CVE-2026-32282
- SUSE Bug 1261658
Описание
If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS 1.3.
Затронутые продукты
Ссылки
- CVE-2026-32283
- SUSE Bug 1261659
Описание
tar.Reader can allocate an unbounded amount of memory when reading a maliciously-crafted archive containing a large number of sparse regions encoded in the "old GNU sparse map" format.
Затронутые продукты
Ссылки
- CVE-2026-32288
- SUSE Bug 1261660
Описание
Context was not properly tracked across template branches for JS template literals, leading to possibly incorrect escaping of content when branches were used. Additionally template actions within JS template literals did not properly track the brace depth, leading to incorrect escaping being applied. These issues could cause actions within JS template literals to be incorrectly or improperly escaped, leading to XSS vulnerabilities.
Затронутые продукты
Ссылки
- CVE-2026-32289
- SUSE Bug 1261661
Описание
When verifying a certificate chain containing excluded DNS constraints, these constraints are not correctly applied to wildcard DNS SANs which use a different case than the constraint. This only affects validation of otherwise trusted certificate chains, issued by a root CA in the VerifyOptions.Roots CertPool, or in the system certificate pool.
Затронутые продукты
Ссылки
- CVE-2026-33810
- SUSE Bug 1261662