Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2026:21786-1

Опубликовано: 02 сент. 2026
Источник: suse-cvrf

Описание

Security update for cadvisor

This update for cadvisor fixes the following issues:

Changes in cadvisor:

  • update vendor:

    • go.opentelemetry.io/otel@v1.44.0 (bsc#1276727, CVE-2026-41178)

  • update to 0.60.5 (bsc#1266645, CVE-2026-39821):

  • update to 0.60.4:

    • build(deps): bump the go_modules group across 2 directories with 1 update
    • Update containerd ttrpc and typeurl
    • build(deps): bump the go_modules group across 3 directories with 1 update
    • crio: add retry to ContainerInfo call
    • build(deps): bump golang.org/x/crypto from 0.51.0 to 0.54.0 in the go_modules group across 0 directory

Список пакетов

openSUSE Leap 16.0
cadvisor-0.60.5-bp160.1.1

Ссылки

Описание

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".

Затронутые продукты
openSUSE Leap 16.0:cadvisor-0.60.5-bp160.1.1
Ссылки

Описание

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Versions 1.41.0 and 1.43.0 removed raw-length rejection and it causes `Parse` to process arbitrarily large/invalid baggage headers and log errors, enabling DoS via oversized inputs. Versions 1.42.0 and 1.44.0 fix the issue.

Затронутые продукты
openSUSE Leap 16.0:cadvisor-0.60.5-bp160.1.1
Ссылки
Уязвимость openSUSE-SU-2026:21786-1