Описание
Security update for amazon-ssm-agent
This update for amazon-ssm-agent fixes the following issues:
- CVE-2026-56854: golang.org/x/crypto/ssh: source-address restriction bypassed in 5 callback families (bsc#1278681)
- CVE-2026-56855: golang.org/x/crypto/ssh: prevent DoS on deadlocked established channel (bsc#1278681)
- CVE-2026-78662: golang.org/x/crypto/ssh: prevent DoS on deadlocked undecided channel (bsc#1278681).
- CVE-2026-71556: github.com/go-git/go-git/v5: Arbitrary file read/write via symbolic link resolution (bsc#1276981).
- CVE-2026-71557: github.com/go-git/go-git/v5: Malicious reference names may modify files outside the reference storage (bsc#1276994).
Changes for amazon-ssm-agent:
- Update to version 3.3.5390.0
Список пакетов
SUSE Linux Enterprise Module for Public Cloud 12
Ссылки
- Link for SUSE-SU-2026:4286-1
- E-Mail link for SUSE-SU-2026:4286-1
- SUSE Security Ratings
- SUSE Bug 1276981
- SUSE Bug 1276994
- SUSE Bug 1278681
- SUSE CVE CVE-2026-56854 page
- SUSE CVE CVE-2026-56855 page
- SUSE CVE CVE-2026-71556 page
- SUSE CVE CVE-2026-71557 page
- SUSE CVE CVE-2026-78662 page
Описание
The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback.
Затронутые продукты
Ссылки
- CVE-2026-56854
- SUSE Bug 1278446
- SUSE Bug 1280553
Описание
Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.
Затронутые продукты
Ссылки
- CVE-2026-56855
- SUSE Bug 1278446
- SUSE Bug 1280553
Описание
go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations (including checkout, status, and add) resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted repository containing a symlink can cause go-git to read from or write to files outside the intended working directory when the repository is cloned and its worktree operations are used. Versions 5.19.2 and 6.0.0-alpha.5.
Затронутые продукты
Ссылки
- CVE-2026-71556
- SUSE Bug 1276977
Описание
go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciously crafted reference name (for example containing directory-traversal sequences) can cause go-git to write files outside the intended reference storage directory. Versions 5.19.2 and 6.0.0-alpha.5 fix the issue.
Затронутые продукты
Ссылки
- CVE-2026-71557
- SUSE Bug 1276986
Описание
Previously, a channel registered in the mux's chanList is not usable until it is established. A malicious peer was able flood the channel's incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.
Затронутые продукты
Ссылки
- CVE-2026-78662
- SUSE Bug 1278446
- SUSE Bug 1280553