openSUSE-SU-2026:21225-1

Описание

This update for rmt-server fixes the following issue

Update to 3.0.0:

• CVE-2026-42256: net-imap: hostile server can perform a DoS on client authenticating a connection with SCRAM-SHA1 or SCRAM-SHA2 (bsc#1265369).

Changes for rmt-server:

• Version 3.0.0

• Security fix: Remove unused ActionMailer/ActionMailbox components to eliminate CVE-2026-42256 (bsc#1265369)
• Split Rails meta-gem into individual components for better security control

• Version 2.26

• Add support for processing, storing, and syncing system profiles (jsc#TEL-265)

• Version 2.25

• fix rmt-cli list and purge commands for large data (bsc#1253146 and bsc#1253147)
• Fix mirroring of SLE16 NVIDIA-GPU-Compute-Toolkit-CUDA repo (bsc#1256826)
• Support for new redirect_repo_hosts config, to exclude some repo hosts from mirroring, and send clients directly there (jsc#SCC-452)
• rmt-server-pubcloud
• Clearer error message (bsc#1256883)
• Handle zypper response when data exporter raises an error (bsc#1257133)
• Add Valkey + Sidekiq for async processing
• Enable mirroring xz compressed repositories (bsc#1246976)
• Rack 2.2.20 security update (bsc#1253953, bsc#1251937)
• Drop some de-published products from RMT
• Include Live-Patching for SLES 15.X (jsc#PCT-630)
• Handle only one data exporter (bsc#1248869)
• Do not decode instance data from db to access registry (bsc#1248510)
• Handle instance verification exceptions