Описание
Security update for terraform-provider-susepubliccloud
This update for terraform-provider-susepubliccloud fixes the following issues
- CVE-2022-41723: go1.19,go1.20: net/http2: quadratic complexity in HPACK decoding (bsc#1208300).
- CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2
:pathpseudo-header (bsc#1260180). - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266477).
- CVE-2026-41602: github.com/apache/thrift:
TFramedTransportframe size headers can lead to auint32integer overflow (bsc#1263515). - CVE-2026-41603: github.com/apache/thrift: improper hostname verification in
TSSLTransportFactorycan lead to host mismatch (bsc#1263606). - CVE-2026-41604: github.com/apache/thrift: swift input with an invalid field range can lead to an out-of-bounds read and application crash (bsc#1263445).
- CVE-2026-41605: github.com/apache/thrift: compact protocol messages with large integer values can lead to integer overflow (bsc#1263411).
- CVE-2026-41606: github.com/apache/thrift: crafted nested messages in
c_glibdispatch can lead to uncontrolled recursion and denial of service (bsc#1263357). - CVE-2026-41607: github.com/apache/thrift: crafted message with improper length validation can lead to an out-of-bounds read and potential information disclosure (bsc#1263316).
- CVE-2026-41636: github.com/apache/thrift: uncontrolled recursion in Node.js bindings can lead to denial of service via stack exhaustion (bsc#1263247).
Список пакетов
SUSE Linux Enterprise Module for Public Cloud 15 SP4
SUSE Linux Enterprise Module for Public Cloud 15 SP5
Ссылки
- Link for SUSE-SU-2026:3057-1
- E-Mail link for SUSE-SU-2026:3057-1
- SUSE Security Ratings
- SUSE Bug 1208300
- SUSE Bug 1260180
- SUSE Bug 1263247
- SUSE Bug 1263316
- SUSE Bug 1263357
- SUSE Bug 1263411
- SUSE Bug 1263445
- SUSE Bug 1263515
- SUSE Bug 1263606
- SUSE Bug 1266477
- SUSE CVE CVE-2022-41723 page
- SUSE CVE CVE-2026-33186 page
- SUSE CVE CVE-2026-33814 page
- SUSE CVE CVE-2026-39821 page
- SUSE CVE CVE-2026-41602 page
- SUSE CVE CVE-2026-41603 page
- SUSE CVE CVE-2026-41604 page
Описание
A maliciously crafted HTTP/2 stream could cause excessive CPU consumption in the HPACK decoder, sufficient to cause a denial of service from a small number of small requests.
Затронутые продукты
Ссылки
- CVE-2022-41723
- SUSE Bug 1208270
- SUSE Bug 1215588
Описание
gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from improper input validation of the HTTP/2 `:path` pseudo-header. The gRPC-Go server was too lenient in its routing logic, accepting requests where the `:path` omitted the mandatory leading slash (e.g., `Service/Method` instead of `/Service/Method`). While the server successfully routed these requests to the correct handler, authorization interceptors (including the official `grpc/authz` package) evaluated the raw, non-canonical path string. Consequently, "deny" rules defined using canonical paths (starting with `/`) failed to match the incoming request, allowing it to bypass the policy if a fallback "allow" rule was present. This affects gRPC-Go servers that use path-based authorization interceptors, such as the official RBAC implementation in `google.golang.org/grpc/authz` or custom interceptors relying on `info.FullMethod` or `grpc.Method(ctx)`; AND that have a security policy contains specific "deny" rules for canonical paths but allows other requests by default (a fallback "allow" rule). The vulnerability is exploitable by an attacker who can send raw HTTP/2 frames with malformed `:path` headers directly to the gRPC server. The fix in version 1.79.3 ensures that any request with a `:path` that does not start with a leading slash is immediately rejected with a `codes.Unimplemented` error, preventing it from reaching authorization interceptors or handlers with a non-canonical path string. While upgrading is the most secure and recommended path, users can mitigate the vulnerability using one of the following methods: Use a validating interceptor (recommended mitigation); infrastructure-level normalization; and/or policy hardening.
Затронутые продукты
Ссылки
- CVE-2026-33186
- SUSE Bug 1260085
- SUSE Bug 1268676
Описание
When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.
Затронутые продукты
Ссылки
- CVE-2026-33814
- SUSE Bug 1264506
- SUSE Bug 1268758
Описание
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".
Затронутые продукты
Ссылки
- CVE-2026-39821
- SUSE Bug 1266474
Описание
Integer Overflow or Wraparound vulnerability in Apache Thrift TFramedTransport Go language implementation This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.
Затронутые продукты
Ссылки
- CVE-2026-41602
- SUSE Bug 1263496
Описание
Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.
Затронутые продукты
Ссылки
- CVE-2026-41603
- SUSE Bug 1263605
Описание
Out-of-bounds Read vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.
Затронутые продукты
Ссылки
- CVE-2026-41604
- SUSE Bug 1263444
Описание
Integer Overflow or Wraparound vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.
Затронутые продукты
Ссылки
- CVE-2026-41605
- SUSE Bug 1263368
Описание
Uncontrolled Recursion vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.
Затронутые продукты
Ссылки
- CVE-2026-41606
- SUSE Bug 1263323
Описание
Out-of-bounds Read vulnerability in Apache Thrift. This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.
Затронутые продукты
Ссылки
- CVE-2026-41607
- SUSE Bug 1263256
Описание
Uncontrolled Recursion vulnerability in Apache Thrift Node.js bindings This issue affects Apache Thrift: before 0.23.0. Users are recommended to upgrade to version 0.23.0, which fixes the issue.
Затронутые продукты
Ссылки
- CVE-2026-41636
- SUSE Bug 1263185