Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2026:20854-1

Опубликовано: 01 июн. 2026
Источник: suse-cvrf

Описание

Security update for rqlite

This update for rqlite fixes the following issues:

Changes in rqlite:

  • Update to version 10.2.0:

    • Support verifying mTLS peer Common Name
    • Console supports restore from SQLite data
    • Console "count rows" respects current Tables Expand/Collapse state
    • Console supports dropping indexes
    • Further Console app improvements

  • update go-net depdendency to address IDN Punycode validation bypass CVE-2026-39821 boo#1266544

  • Update to version 10.1.0:

    • Add Schema management page to Console app
    • Display node TLS state in console's Cluster panel

  • includes changes from 10.0.6:

    • Limit number of redirects followed on cluster-join
    • fix HTTP auth reporting

Список пакетов

openSUSE Leap 16.0
rqlite-10.2.0-bp160.1.1

Ссылки

Описание

When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.

Затронутые продукты
openSUSE Leap 16.0:rqlite-10.2.0-bp160.1.1
Ссылки

Описание

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".

Затронутые продукты
openSUSE Leap 16.0:rqlite-10.2.0-bp160.1.1
Ссылки
Уязвимость openSUSE-SU-2026:20854-1