Описание
Security update for kubevirt
This update for kubevirt fixes the following issues:
-
Security update correcting a CVE over-claim from the previous update, verified by auditing the fix code actually present in the vendored tree:
- CVE-2026-39821 (bsc#1266575): the previous entry claimed this fixed by the golang.org/x/net v0.55.0 re-vendor, but 0.55.0's idna fix is compile-time gated on Unicode 16 tables, which only exist for go1.27+ - it is inert in our go1.25 builds, so the claim was incorrect. Re-vendor golang.org/x/net v0.55.0 -> v0.57.0, whose idna package rejects all-ASCII Punycode labels unconditionally; the CVE is now actually fixed.
-
Re-vendor golang.org/x/text v0.37.0 -> v0.40.0: CVE-2026-56852 (bsc#1271661), infinite loop on invalid input in unicode/norm.
-
golang.org/x/crypto v0.52.0 -> v0.54.0 (pulled in by x/net 0.57.0; no additional CVE claims, all previously listed x/crypto fixes remain included).
-
CVE-2026-13201 (bsc#1269093), safepath resolves a path whose last component is a symlink without detecting it, allowing metadata operations via /proc/self/fd to act on the symlink target. Backports of upstream release-1.7 commits 9ecda4ad5e and 1494cee849.
-
x/net 0.57.0 also contains the fix for CVE-2026-46600 (bsc#1272415) in dns/dnsmessage; kubevirt does not vendor that package (not affected), the bump merely rides past it.
Список пакетов
SUSE Linux Enterprise Module for Containers 15 SP7
Ссылки
- Link for SUSE-SU-2026:3480-1
- E-Mail link for SUSE-SU-2026:3480-1
- SUSE Security Ratings
- SUSE Bug 1266575
- SUSE Bug 1269093
- SUSE Bug 1271661
- SUSE Bug 1272415
- SUSE CVE CVE-2026-13201 page
- SUSE CVE CVE-2026-39821 page
- SUSE CVE CVE-2026-46600 page
- SUSE CVE CVE-2026-56852 page
Описание
A flaw was found in KubeVirt's safepath package used by virt-handler. The OpenAtNoFollow function uses O_PATH|O_NOFOLLOW to obtain a file descriptor to a path leaf, but downstream operations resolve the path via /proc/self/fd/N using link-following syscalls. When the leaf is a symlink, the kernel dereferences it, defeating the intended no-follow protection. An attacker with access to a virt-launcher pod can exploit this to redirect virt-handler's IPC socket connections, including the notify socket used for VM domain lifecycle events. By hijacking this socket, the attacker can inject arbitrary domain events into virt-handler, causing it to take incorrect lifecycle actions, corrupt VM state in the Kubernetes API, or crash - resulting in sustained denial of VM management services for all virtual machines on the affected node. Additionally, the same symlink following flaw allows virt-handler to apply file ownership or permission changes to unintended host paths.
Затронутые продукты
Ссылки
- CVE-2026-13201
- SUSE Bug 1269093
Описание
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".
Затронутые продукты
Ссылки
- CVE-2026-39821
- SUSE Bug 1266474
Описание
Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer.
Затронутые продукты
Ссылки
- CVE-2026-46600
- SUSE Bug 1272415
Описание
A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.
Затронутые продукты
Ссылки
- CVE-2026-56852
- SUSE Bug 1271661