Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2026:3795-1

Опубликовано: 25 авг. 2026
Источник: suse-cvrf

Описание

Security update for librest

This update for librest fixes the following issue:

  • CVE-2026-16615: PKCE implementation for OAuth authorization uses a cryptographically insecure pseudo-random number generator (bsc#1272399).

Список пакетов

SUSE Linux Enterprise Module for Desktop Applications 15 SP7
librest-1_0-0-0.9.1-150600.3.3.1
librest-devel-0.9.1-150600.3.3.1
typelib-1_0-Rest-1_0-0.9.1-150600.3.3.1

Ссылки

Описание

A flaw was found in librest. The PKCE implementation for OAuth authorization uses the GRand function from the GLib API, a cryptographically insecure pseudo-random number generator. Because the generated "code verifier" lacks sufficient cryptographic entropy, a malicious actor can reverse-engineer the pseudo-random number generator (PRNG) seed to predict or reconstruct the code verifier string, allowing an attacker to bypass PKCE protections and successfully impersonate the client during the OAuth 2.0 authorization flow.

Затронутые продукты
SUSE Linux Enterprise Module for Desktop Applications 15 SP7:librest-1_0-0-0.9.1-150600.3.3.1
SUSE Linux Enterprise Module for Desktop Applications 15 SP7:librest-devel-0.9.1-150600.3.3.1
SUSE Linux Enterprise Module for Desktop Applications 15 SP7:typelib-1_0-Rest-1_0-0.9.1-150600.3.3.1
Ссылки
Уязвимость SUSE-SU-2026:3795-1