Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2026:5067-1

Опубликовано: 03 нояб. 2026
Источник: suse-cvrf

Описание

Security update for amazon-ssm-agent

This update for amazon-ssm-agent fixes the following issues:

  • CVE-2025-47913: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type in response to a key listing or signing request (bsc#1253611).
  • CVE-2025-47914: golang.org/x/crypto/ssh/agent: non validated message size can cause a panic due to an out of bounds read (bsc#1254082).
  • CVE-2025-58181: golang.org/x/crypto/ssh: invalidated number of mechanisms can cause unbounded memory consumption (bsc#1253946).

Update to version 3.3.5678.0:

  • Bump golang.org/x/sys from v0.47.0 to v0.48.0
  • Bump golang.org/x/net from v0.57.0 to v0.60.0
  • Upgrade Go version to 1.26.10
  • Bug fixes for aws-sdk-go-v2
  • Upgrade Go version to 1.26.9

Список пакетов

SUSE Linux Enterprise Module for Public Cloud 12
amazon-ssm-agent-3.3.5678.0-4.55.1

Ссылки

Описание

SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process.

Затронутые продукты
SUSE Linux Enterprise Module for Public Cloud 12:amazon-ssm-agent-3.3.5678.0-4.55.1
Ссылки

Описание

SSH Agent servers do not validate the size of messages when processing new identity requests, which may cause the program to panic if the message is malformed due to an out of bounds read.

Затронутые продукты
SUSE Linux Enterprise Module for Public Cloud 12:amazon-ssm-agent-3.3.5678.0-4.55.1
Ссылки

Описание

SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.

Затронутые продукты
SUSE Linux Enterprise Module for Public Cloud 12:amazon-ssm-agent-3.3.5678.0-4.55.1
Ссылки