Описание
Security update for google-osconfig-agent
This update for google-osconfig-agent fixes the following issues
- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266603).
- CVE-2026-56852: golang.org/x/text/unicode/norm: improper handling of input containing invalid UTF-8 bytes can lead to infinite loop (bsc#1272118).
Список пакетов
SUSE Linux Enterprise Micro 5.5
SUSE Linux Enterprise Module for Public Cloud 15 SP4
SUSE Linux Enterprise Module for Public Cloud 15 SP5
SUSE Linux Enterprise Module for Public Cloud 15 SP6
SUSE Linux Enterprise Module for Public Cloud 15 SP7
Ссылки
- Link for SUSE-SU-2026:3432-1
- E-Mail link for SUSE-SU-2026:3432-1
- SUSE Security Ratings
- SUSE Bug 1266603
- SUSE Bug 1272118
- SUSE CVE CVE-2026-39821 page
- SUSE CVE CVE-2026-56852 page
Описание
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".
Затронутые продукты
Ссылки
- CVE-2026-39821
- SUSE Bug 1266474
Описание
A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.
Затронутые продукты
Ссылки
- CVE-2026-56852
- SUSE Bug 1271661