Описание
Security update for terraform-provider-aws, terraform-provider-azurerm, terraform-provider-external, terraform-provider-google, terraform-provider-helm, terraform-provider-kubernetes, terraform-provider-local, terraform-provider-null, terraform-provider-random, terraform-provider-tls
This update for terraform-provider-aws, terraform-provider-azurerm, terraform-provider-external, terraform-provider-google, terraform-provider-helm, terraform-provider-kubernetes, terraform-provider-local, terraform-provider-null, terraform-provider-random, terraform-provider-tls fixes the following issues:
- CVE-2026-56852: golang.org/x/text/unicode/norm: improper handling of truncated/invalid UTF-8 input can lead to infinite loop (bsc#1271995, bsc#1272078, bsc#1272090).
- CVE-2026-71556: github.com/go-git/go-git/v5: symlink traversal issue in worktree operations allows for arbitrary file reads/writes (bsc#1276978).
- CVE-2026-71557: github.com/go-git/go-git/v5: improper reference name sanitization before construction of on-disk paths under the reference storage directory can lead to arbitrary file writes (bsc#1276987).
Список пакетов
SUSE Linux Enterprise Module for Public Cloud 15 SP4
SUSE Linux Enterprise Module for Public Cloud 15 SP5
Ссылки
- Link for SUSE-SU-2026:3916-1
- E-Mail link for SUSE-SU-2026:3916-1
- SUSE Security Ratings
- SUSE Bug 1271995
- SUSE Bug 1272078
- SUSE Bug 1272090
- SUSE Bug 1276978
- SUSE Bug 1276987
- SUSE CVE CVE-2026-56852 page
- SUSE CVE CVE-2026-71556 page
- SUSE CVE CVE-2026-71557 page
Описание
A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.
Затронутые продукты
Ссылки
- CVE-2026-56852
- SUSE Bug 1271661
Описание
go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations (including checkout, status, and add) resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted repository containing a symlink can cause go-git to read from or write to files outside the intended working directory when the repository is cloned and its worktree operations are used. Versions 5.19.2 and 6.0.0-alpha.5.
Затронутые продукты
Ссылки
- CVE-2026-71556
- SUSE Bug 1276977
Описание
go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciously crafted reference name (for example containing directory-traversal sequences) can cause go-git to write files outside the intended reference storage directory. Versions 5.19.2 and 6.0.0-alpha.5 fix the issue.
Затронутые продукты
Ссылки
- CVE-2026-71557
- SUSE Bug 1276986