Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2026:3834-1

Опубликовано: 27 авг. 2026
Источник: suse-cvrf

Описание

Security update for librest0_7

This update for librest0_7 fixes the following issue:

  • CVE-2026-16615: PKCE implementation for OAuth authorization uses a cryptographically insecure pseudo-random number generator (bsc#1272399).

Список пакетов

SUSE Linux Enterprise Workstation Extension 15 SP7
librest-0_7-0-0.8.1-150600.4.3.1
librest0_7-devel-0.8.1-150600.4.3.1
typelib-1_0-Rest-0_7-0.8.1-150600.4.3.1

Ссылки

Описание

A flaw was found in librest. The PKCE implementation for OAuth authorization uses the GRand function from the GLib API, a cryptographically insecure pseudo-random number generator. Because the generated "code verifier" lacks sufficient cryptographic entropy, a malicious actor can reverse-engineer the pseudo-random number generator (PRNG) seed to predict or reconstruct the code verifier string, allowing an attacker to bypass PKCE protections and successfully impersonate the client during the OAuth 2.0 authorization flow.

Затронутые продукты
SUSE Linux Enterprise Workstation Extension 15 SP7:librest-0_7-0-0.8.1-150600.4.3.1
SUSE Linux Enterprise Workstation Extension 15 SP7:librest0_7-devel-0.8.1-150600.4.3.1
SUSE Linux Enterprise Workstation Extension 15 SP7:typelib-1_0-Rest-0_7-0.8.1-150600.4.3.1
Ссылки
Уязвимость SUSE-SU-2026:3834-1