Описание
Security update for go1.26-openssl
This update for go1.26-openssl fixes the following issues
- Update to version go1.26.5 (bsc#1255111).
- CVE-2026-27145: crypto/x509: split candidate hostname only once (bsc#1267450).
- CVE-2026-39822: os: Root escape via symlink plus trailing slash (bsc#1271014).
- CVE-2026-42504: mime: quadratic complexity in WordDecoder.DecodeHeader (bsc#1267442).
- CVE-2026-42505: crypto/tls: omit PSK in ECH outer client hello (bsc#1271015).
- CVE-2026-42507: net/textproto: arbitrary input are included in errors without any escaping (bsc#1267444).
Список пакетов
SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS
SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS
SUSE Linux Enterprise High Performance Computing 15 SP5-ESPOS
SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS
SUSE Linux Enterprise Server 15 SP4-LTSS
SUSE Linux Enterprise Server 15 SP5-LTSS
SUSE Linux Enterprise Server for SAP Applications 15 SP4
SUSE Linux Enterprise Server for SAP Applications 15 SP5
Ссылки
- Link for SUSE-SU-2026:3047-1
- E-Mail link for SUSE-SU-2026:3047-1
- SUSE Security Ratings
- SUSE Bug 1245878
- SUSE Bug 1255111
- SUSE Bug 1264395
- SUSE Bug 1267442
- SUSE Bug 1267444
- SUSE Bug 1267450
- SUSE Bug 1271014
- SUSE Bug 1271015
- SUSE CVE CVE-2026-27145 page
- SUSE CVE CVE-2026-39822 page
- SUSE CVE CVE-2026-42504 page
- SUSE CVE CVE-2026-42505 page
- SUSE CVE CVE-2026-42507 page
Описание
(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically based on the number of SAN entries multiplied by the hostname's label count. Because x509.Verify validates hostnames before building the certificate chain, this overhead occurred even for untrusted certificates.
Затронутые продукты
Ссылки
- CVE-2026-27145
- SUSE Bug 1267450
Описание
On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /. For example, 'root.Open("symlink/")' will open "symlink" even when "symlink" is a symbolic link pointing outside of the root.
Затронутые продукты
Ссылки
- CVE-2026-39822
- SUSE Bug 1271014
Описание
Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.
Затронутые продукты
Ссылки
- CVE-2026-42504
- SUSE Bug 1267442
Описание
Handshakes which used Encrypted Client Hello could be de-anonymized by a passive network observer due to a disclosure of pre-shared key identities in the unencrypted client hello.
Затронутые продукты
Ссылки
- CVE-2026-42505
- SUSE Bug 1271015
Описание
When returning errors, functions in the net/textproto package would include its input as part of the error. This might allow an attacker to inject misleading content to errors that are printed or logged.
Затронутые продукты
Ссылки
- CVE-2026-42507
- SUSE Bug 1267444