SUSE-SU-2026:3576-1

Описание

This update for himmelblau, himmelblau.SUSE_SLE-15-SP5_Update fixes the following issues:

Security fixes:

• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270182).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length (bsc#1270613).
• CVE-2026-41678: openssl: OOB write due to incorrect bounds assertion in aes::unwrap_key() (bsc#1270707).
• CVE-2026-41681: openssl: stack corruption due to MdCtxRef::digest_final() writing past caller buffer with no length check (bsc#1270794).
• CVE-2026-41898: openssl: information leak to network peers due to unchecked callback-returned length in PSK and cookie generate trampolines (bsc#1270830).
• CVE-2026-42327: openssl: undefined behavior in X509Ref::ocsp_responders when processing certificates with non-UTF-8 OCSP URLs (bsc#1270520).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding (bsc#1270939).
• CVE-2026-45784: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers in rust-openssl crate (bsc#1270985).
• GHSA-4f5j-9xgm-8pvr: arbitrary HTTP or HTTPS URL classified as an Office document based on an attacker-controlled file query parameters and forwarded to an Electron application (bsc#1273910).
• GHSA-6cq7-jcwm-cpmr: directory-provided RFC2307 user identifiers accepted without exclusion of systemd's dynamic-user range allows for daemon impersonation and command execution through the task helper (bsc#1273911).
• GHSA-6gp8-pp9v-gx45: daemon acts on Hello PIN enrollment requests whose identity claims it never cryptographically verifies (bsc#1273912).

Other fixes:

• Version 2.3.14+git0.e23b4c54:

  • fix(nss): avoid locked shadow entries

• Version 2.3.14:

  • fix(deps): update libhimmelblau lockfile
  • fix(pam): make account denials terminal
  • debian: make the pam_allow_groups denial terminal in the account phase

• Version 2.3.13:

  • Update cargo vet audits for backport

• Version 2.3.12+git0.9d56c6f1:

  • Fix cargo-fuzz install in fuzz CI
  • cargo vet
  • Update ldap3_proto to 0.7.1

• Version 2.3.12:

  • Update cargo vet audits for backport
  • Remove invalid himmelblau.conf example info
  • Fix SSHd configuration load order on Fedora/RHEL systems
  • himmelblau-init-hsm-pin: don't bind the hsm-pin to PCR7
  • qr-greeter: support GNOME Shell 50
  • Update libhimmelblau to latest version
  • deps(rust): bump tonic in the all-cargo-updates group across 1 directory
  • cargo audit

• Version 2.3.11+git0.c802b25f:

  • Update cargo vet audits for backport
  • Reject auth when token spn local part differs from requested account_id
  • Update libhimmelblau to latest version
  • deps(rust): bump the all-cargo-updates group with 19 updates
  • cargo vet

• Version 2.3.10:

  • nss/pam: bail out early when SYSTEMD_ACTIVATION_UNIT points to himmelblau
  • selinux: allow unconfined_service_t to search himmelblaud_t dirs
  • idprovider: release providers lock before async alias lookup