Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2026:20380-1

Опубликовано: 17 мар. 2026
Источник: suse-cvrf

Описание

Security update for snpguest

This update for snpguest fixes the following issues:

  • CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion (bsc#1257927).
  • Update to version 0.10.0 (bsc#1257877):
    • chore: updating tool version to 0.10.0
    • refactor(certs): remove redundant branch in file-write logic
    • Docs: Adding verify measure, host-data, report-data to docs
    • verify: verify measurent, host data, and report data attributes from the attestation report.
    • library: Updating sev library to 7.1.0
    • ci: replace deprecated gh actions
    • feat: multi-format integer parsing for key subcommand arguments
    • chore(main): remove unused import clap::arg
    • feat(fetch): add fetch crl subcommand
    • .github/lint: Bump toolchain version to 1.86
    • Bump rust version to 1.86
    • feat: bumping tool to version 0.9.2
    • fix(verify): silence mismatched_lifetime_syntaxes in SnpOid::oid
    • feat: support SEV-SNP ABI Spec 1.58 (bump sev to v6.3.0)
    • docs: restore and clarify Global Options section
    • doc: fix CL argument orders + address recent changes
    • fix(hyperv): downgrade VMPL check from error to warning
    • fix(report.rs): remove conflict check between --random flag and Hyper-V
    • fix(report.rs): Decouple runtime behavior from hyperv build feature
    • refactor: clarify --platform error message
    • docs: add Azure/Hyper-V build note for --platform
    • docs: Update README.md
    • report: Writing Req Data as Binary (#101)
    • deps: bump virtee/sev to 6.2.1 (fix TCB-serialization bug) (#99)

Список пакетов

openSUSE Leap 16.0
snpguest-0.10.0-160000.1.1

Описание

time provides date and time handling in Rust. From 0.3.6 to before 0.3.47, when user-provided input is provided to any type that parses with the RFC 2822 format, a denial of service attack via stack exhaustion is possible. The attack relies on formally deprecated and rarely-used features that are part of the RFC 2822 format used in a malicious manner. Ordinary, non-malicious input will never encounter this scenario. A limit to the depth of recursion was added in v0.3.47. From this version, an error will be returned rather than exhausting the stack.


Затронутые продукты
openSUSE Leap 16.0:snpguest-0.10.0-160000.1.1

Ссылки