Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2026:20893-1

Опубликовано: 02 июн. 2026
Источник: suse-cvrf

Описание

Security update for cloudflared

This update for cloudflared fixes the following issues:

Changes in cloudflared:

  • Update version to 2026.5.2

    • Add more information to proxy-dns removal message
    • Update tail command to use /management/logs endpoint
    • Add cloudflared management token command
    • Fix bugs
    • Update golang.org/x/net to 0.55.0 (boo#1266794, boo#1265920, CVE-2026-39821 CVE-2026-33814)

  • Update version to 2026.2.0

    • Fix bugs

  • Update version to 2025.11.1

    • bump coredns to solve CVE
    • add vulncheck to cloudflared
    • Remove references to cloudflare-go
    • Add logging format as JSON
    • Centralize UDP origin proxy dialing as ingress service
    • Add virtual DNS service
    • Add OriginDialerService to include TCP
    • Add --dns-resolver-addrs flag
    • Remove P256Kyber768Draft00PQKex curve from nonFips curve preferences
    • Bump go-boring from 1.24.2 to 1.24.4
    • Add metrics for virtual DNS origin
    • set proper url and hostname for cloudflared tail command
    • Add support for login interstitial auto closure
    • update fed callback url for login helper
    • Correct QUIC connection management for datagram handlers
    • Set endpoint in tunnel credentials when generating locally managed tunnel with a Fed token
    • Migrate cloudflared-ci pipelines to Gitlab CI
    • Add support for FedRAMP in originRequest Access config
    • Add buffers for UDP and ICMP datagrams in datagram v3
    • Add write deadline for UDP origin writes
    • Improve metrics for datagram v3
    • Force usage of go-boring 1.24
    • Fix import of GPG keys when two keys are provided
    • Fix parameter order when uploading RPM .repo file to R2
    • Add new datagram v3 feature flag
    • Bump datagram v3 write channel capacity
    • Fix upload of RPM repo file during double signing
    • Fix the cloudflared binary path used in the component test
    • Fix typo causing r2-release-next deployment to fail
    • Update from go1.24.6 to go1.24.9
    • Fix systemd service installation hanging
    • Add cf-proxy-* to control response headers
    • Add pipelines for linux packaging
    • Prefix gitlab steps with operating system
    • Fix docker hub push step
    • Fix CVE-2025-58181 boo#1253918
    • Fix CVE-2025-22869 boo#1239422

  • Update version to 2025.6.0

    • Remove dynamic reloading of features for datagram v3
    • Add metric for unsupported RPC commands for datagram v3
    • Add dynamic loading of features to connections via ConnectionOptionsSnapshot
    • Use is_default_network instead of is_default to create vnet's
    • Update go to 1.24

  • Update version to 2025.4.2

    • emit explicit errors for the service command on unsupported OSes
    • Fix some issues

  • Update version to 2024.12.1

    • TUN-8748: Migrated datagram V3 flows to use migrated context
    • TUN-8737: update metrics server port selection
    • TUN-8731: Implement diag/system endpoint
    • TUN-8728: implement diag/tunnel endpoint
    • TUN-8730: implement diag/configuration
    • TUN-8735: add managed/local log collection
    • TUN-8733: add log collection for docker
    • TUN-8734: add log collection for kubernetes
    • TUN-8640: Refactor ICMPRouter to support new ICMPResponders
    • TUN-8729: implement network collection for diagnostic procedure
    • TUN-8727: implement metrics, runtime, system, and tunnelstate in diagnostic http client
    • TUN-8726: implement compression routine to be used in diagnostic procedure
    • TUN-8732: implement port selection algorithm
    • TUN-8762: fix argument order when invoking tracert and modify network info output parsing
    • TUN-8769: fix k8s log collector arguments
    • TUN-8727: extend client to include function to get cli configuration and tunnel configuration
    • TUN-8725: implement diagnostic procedure
    • TUN-8767: include raw output from network collector in diagnostic zip file
    • TUN-8770: add cli configuration and tunnel configuration to diagnostic zipfile
    • TUN-8768: add job report to diagnostic zipfile
    • TUN-8775: Make sure the session Close can only be called once
    • TUN-8781: Add Trixie, drop Buster. Default to Bookworm
    • TUN-8640: Add ICMP support for datagram V3
    • TUN-8789: make python package installation consistent
    • TUN-8795: update createrepo to createrepo_c to fix the release_pkgs.py script

  • fix CVE-2024-45337 and boo#1234582

  • Update version to 2024.11.1

    • Add cloudflared tunnel health command
    • PPIP-2310: Update quick tunnel disclaimer
    • TUN-8621: Prevent QUIC connection from closing before grace period after unregistering
    • TUN-8484: Print response when QuickTunnel can't be unmarshalled
    • TUN-8592: Use metadata from the edge to determine if request body is empty for QUIC transport
    • TUN-8621: Fix cloudflared version in change notes to account for release date
    • TUN-8638: Add datagram v3 serializers and deserializers
    • TUN-8685: Bump coredns dependency
    • TUN-8688: Correct UDP bind for IPv6 edge connectivity on macOS
    • TUN-8694: Fix github release script
    • TUN-8694: Rework release script
    • TUN-8661: Refactor connection methods to support future different datagram muxing methods
    • TUN-8692: remove dashes from session id
    • TUN-8708: Bump python min version to 3.10
    • TUN-8667: Add datagram v3 session manager
    • TUN-8553: Bump go to 1.22.5 and go-boring 1.22.5-1
    • TUN-8700: Add datagram v3 muxer
    • TUN-8646: Allow experimental feature support for datagram v3
    • TUN-8641: Expose methods to simplify V3 Datagram parsing on the edge
    • VULN-66059: remove ssh server tests
    • TUN-8709: Add session migration for datagram v3
    • TUN-8701: Add metrics and adjust logs for datagram v3
    • add: new go-fuzz targets
    • TUN-8701: Simplify flow registration logs for datagram v3

Список пакетов

openSUSE Leap 16.0
cloudflared-2026.5.2-bp160.1.1

Ссылки

Описание

Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that "A call to this function does not guarantee that the key offered is in fact used to authenticate." Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/cry...@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.

Затронутые продукты
openSUSE Leap 16.0:cloudflared-2026.5.2-bp160.1.1
Ссылки

Описание

SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.

Затронутые продукты
openSUSE Leap 16.0:cloudflared-2026.5.2-bp160.1.1
Ссылки

Описание

SSH servers parsing GSSAPI authentication requests do not validate the number of mechanisms specified in the request, allowing an attacker to cause unbounded memory consumption.

Затронутые продукты
openSUSE Leap 16.0:cloudflared-2026.5.2-bp160.1.1
Ссылки

Описание

When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.

Затронутые продукты
openSUSE Leap 16.0:cloudflared-2026.5.2-bp160.1.1
Ссылки

Описание

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".

Затронутые продукты
openSUSE Leap 16.0:cloudflared-2026.5.2-bp160.1.1
Ссылки