Описание
Security update for openQA, os-autoinst
This update for openQA, os-autoinst fixes the following issues:
Changes in openQA:
-
Update to version 5.1783076943.6691832d:
- test: Stabilize
t/05-scheduler-full.t
- test: Stabilize
-
Clarify resolution of three CVEs
- The following CVEs have been fixed (see previous changelog
entries that mentioned only the according Bugzilla tickets):
- bsc#1259005 - CVE-2026-27904
- bsc#1264376 - CVE-2026-6321
- bsc#1258632 - CVE-2026-26996
- The following CVEs have been fixed (see previous changelog
entries that mentioned only the according Bugzilla tickets):
-
Update to version 5.1782995932.ffeb09be:
- feat: throw 404 for nonexistent groups in overview
- feat: Avoid logwarn notifications for non-critical auth error
- chore(deps): Dependency cron 2026-07-02
- git subrepo pull (merge) external/os-autoinst-common
- fix: Check also hidden files in checklist plugin
- test: Enable faster re-connects in full scheduler test consistently
- test: Avoid silent daemons in verbose mode
- test: Allow running
t/43-…-scalability.tin parallel - test: Allow running
t/05-scheduler-full.tin parallel - test: Avoid race condition when generating ports in
25-cache.t - test: Avoid wasting seconds in
40-script_load_dump_templates.t - refactor: Remove disabled code in
openqa-load-templates - test: Avoid race condition when generating ports in many tests
- chore(deps): Dependency cron 2026-07-01
- fix(ci): format inline comments in workflows to pass yamllint
- test: Avoid running into "Address already in use" in fullstack test
- feat(ci): pin GitHub Actions by commit hash
Changes in os-autoinst:
-
Update to version 5.1783082953.c3cb41d:
- test: Disable unstable
t/28-signalblocker.ton ppc64le OBS builds - fix: Check also hidden files in checklist plugin
- feat(ci): disable Mergify interactive queue controls in PR comments
- test: assert pipe size adjustment dynamically
- test: assert terminal session boundary safety
- refactor: support pretty markers in script_sudo and become_root
- fix: mmapi test failures and infinite loop hangs
- test: simplify Level 3 pretty marker detection
- fix: exclude virt-firmware on all older Leap archs
- test: Disable unstable
-
Update to version 5.1782917048.dcc97e9:
- fix: Check also hidden files in checklist plugin
- feat(ci): disable Mergify interactive queue controls in PR comments
- fix(ci): format inline comments in workflows to pass yamllint
- feat(ci): pin GitHub Actions by commit hash
- test: assert pipe size adjustment dynamically
- test: assert terminal session boundary safety
- refactor: support pretty markers in script_sudo and become_root
- fix: mmapi test failures and infinite loop hangs
- test: simplify Level 3 pretty marker detection
- fix: exclude virt-firmware on all older Leap archs
Список пакетов
openSUSE Leap 16.0
Ссылки
- SUSE Security Ratings
- SUSE Bug 1258632
- SUSE Bug 1259005
- SUSE Bug 1264376
- SUSE CVE CVE-2026-26996 page
- SUSE CVE CVE-2026-27904 page
- SUSE CVE CVE-2026-6321 page
Описание
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.
Затронутые продукты
Ссылки
- CVE-2026-26996
- SUSE Bug 1258621
Описание
minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), which exhibit catastrophic backtracking in V8. With a 12-byte pattern `*(*(*(a|b)))` and an 18-byte non-matching input, `minimatch()` stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the default `minimatch()` API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects `+()` extglobs equally. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.
Затронутые продукты
Ссылки
- CVE-2026-27904
- SUSE Bug 1258994
Описание
fast-uri decoded percent-encoded path separators and dot segments before applying dot-segment removal in its normalize() and equal() functions. Encoded path data was treated like real slashes and parent-directory references, so distinct URIs could collapse onto the same normalized path. Applications that normalize or compare attacker-controlled URLs to enforce path-based policy can be bypassed, with a path that appears confined under an allowed prefix normalizing to a different location. Versions <= 3.1.0 are affected. Update to 3.1.1 or later.
Затронутые продукты
Ссылки
- CVE-2026-6321
- SUSE Bug 1264367