Описание
Security update for rust1.94
This update for rust1.94 fixes the following issues:
Changes in rust1.94:
- Don't force gcc-15 on SLE-16 and higher (bsc#1261876)
Update to rust1.94.1:
-
Release notes can be found externally: https://github.com/rust-lang/rust/releases/tag/1.94.1
-
Avoid unwrapping varint decoding during parameters parsing (bsc#1259623 CVE-2026-31812).
-
Release notes can be found externally: https://github.com/rust-lang/rust/releases/tag/1.94.0
Список пакетов
openSUSE Leap 16.0
Ссылки
- SUSE Security Ratings
- SUSE Bug 1259623
- SUSE Bug 1261876
- SUSE CVE CVE-2026-31812 page
Описание
Quinn is a pure-Rust, async-compatible implementation of the IETF QUIC transport protocol. Prior to 0.11.14, a remote, unauthenticated attacker can trigger a denial of service in applications using vulnerable quinn versions by sending a crafted QUIC Initial packet containing malformed quic_transport_parameters. In quinn-proto parsing logic, attacker-controlled varints are decoded with unwrap(), so truncated encodings cause Err(UnexpectedEnd) and panic. This is reachable over the network with a single packet and no prior trust or authentication. This vulnerability is fixed in 0.11.14.
Затронутые продукты
Ссылки
- CVE-2026-31812
- SUSE Bug 1259620