Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2026:21454-1

Опубликовано: 27 июл. 2026
Источник: suse-cvrf

Описание

Security update for yq

This update for yq fixes the following issues:

Changes in yq:

  • Update the golang.org/x/net dependency to version v0.57.0 to fix CVE-2026-39821 for good (bsc#1267199).

  • update to v4.53.3 Add --ini-preserve-quotes flag for INI round-trip quote preservation. Fix: reset INI decoder state on init. Fix: decode properties array bracket paths. Fix: preserve floats with trailing zero when encoding YAML to JSON. Fix: JSON to TOML root scope and null handling. Fix: reset TOML decoder finished flag on Init for multi-doc evaluation. Fix: reset TOML decoder between files when evaluating all at once. Fix: preserve TOML inline table array scope. Fix: preserve empty TOML arrays in tables Fix: TOML encoder uses inline tables for YAML FlowStyle mappings. Fix nested inline YAML merge explode. Fix repeatString overflow test on 32-bit platforms.

  • Fix CVE-2026-56852 (GO-2026-5970) (bsc#1271994): A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.

Список пакетов

openSUSE Leap 16.0
yq-4.53.3-bp160.1.1
yq-bash-completion-4.53.3-bp160.1.1
yq-fish-completion-4.53.3-bp160.1.1
yq-zsh-completion-4.53.3-bp160.1.1

Ссылки

Описание

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".

Затронутые продукты
openSUSE Leap 16.0:yq-4.53.3-bp160.1.1
openSUSE Leap 16.0:yq-bash-completion-4.53.3-bp160.1.1
openSUSE Leap 16.0:yq-fish-completion-4.53.3-bp160.1.1
openSUSE Leap 16.0:yq-zsh-completion-4.53.3-bp160.1.1
Ссылки

Описание

A norm.Iter can enter an infinite loop when handling input containing invalid UTF-8 bytes.

Затронутые продукты
openSUSE Leap 16.0:yq-4.53.3-bp160.1.1
openSUSE Leap 16.0:yq-bash-completion-4.53.3-bp160.1.1
openSUSE Leap 16.0:yq-fish-completion-4.53.3-bp160.1.1
openSUSE Leap 16.0:yq-zsh-completion-4.53.3-bp160.1.1
Ссылки
Уязвимость openSUSE-SU-2026:21454-1