Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2026:21793-1

Опубликовано: 03 сент. 2026
Источник: suse-cvrf

Описание

Security update for hauler

This update for hauler fixes the following issues:

Changes in hauler:

  • update to 2.1.0 (bsc#1265425, CVE-2026-41888):

    • v2.1.0 is a minor release built on the containerd- native foundation laid down in v2.0.0. The headline is that hauler store sync and hauler store add are now fully concurrent, with signature verification pinned to digests and running in parallel too. Alongside that, this release adds an audit trail, a store integrity checker, store-to-manifest generation, private/insecure registry support across every pull path, and a set of fixes for containerd imports, chunked hauls, and Docker Hub reference handling.
    • Notable dependency bumps: Go → 1.26.6; containerd/v2 → 2.3.4; sigstore/cosign/v3 → 3.1.3; sigstore/sigstore → 1.10.9; go-containerregistry → 0.22.0; helm/v4 → 4.2.4; k8s.io libs (apimachinery, api, client-go) → 0.37.0; logrus → 1.10.2; docker/go-metrics → 0.1.0; sigstore/rekor → 1.5.4 (CVE resolution); plus x/mod and go-isatty.

  • update to 2.0.3 (bsc#1276124, CVE-2026-72817,CVE-2026-72815,CVE-2026-72816):

    • Bump k8s.io/apimachinery from 0.36.2 to 0.36.3 (backport #688)
    • Bump oras.land/oras-go/v2 from 2.6.1 to 2.6.2 in the go_modules group across 1 directory (backport #691)
    • fix for homebrew macOS binary quarantine (backport #690)
    • fix: process Helm deps before --add-images discovery (backport #703)
    • update hauler store remove to handle registry reference as part of string (backport #705)
    • fixed vuln for golang grpc

Список пакетов

openSUSE Leap 16.0
hauler-2.1.0-bp160.1.1

Ссылки

Описание

grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allowed methods. When a POST request with Content-Type application/x-www-form-urlencoded includes this header, the request method is rewritten to an arbitrary attacker-supplied value before routing. This allows bypassing method-based access controls enforced by upstream proxies or WAFs.

Затронутые продукты
openSUSE Leap 16.0:hauler-2.1.0-bp160.1.1
Ссылки

Описание

OpenTelemetry-Go is the Go implementation of OpenTelemetry. Versions 1.41.0 and 1.43.0 removed raw-length rejection and it causes `Parse` to process arbitrarily large/invalid baggage headers and log errors, enabling DoS via oversized inputs. Versions 1.42.0 and 1.44.0 fix the issue.

Затронутые продукты
openSUSE Leap 16.0:hauler-2.1.0-bp160.1.1
Ссылки

Описание

Distribution is a toolkit to pack, ship, store, and deliver container content. Prior to 3.1.1, tag deletion via the DELETE /v2/<name>/manifests/<tag> endpoint bypasses the storage.delete.enabled: false configuration, allowing any API client to remove tags from repositories even when the operator has explicitly disabled deletion. This vulnerability is fixed in 3.1.1.

Затронутые продукты
openSUSE Leap 16.0:hauler-2.1.0-bp160.1.1
Ссылки

Описание

go-chi chi versions >= 5.2.1 and before 5.3.0 contain an IP spoofing vulnerability in the RealIP middleware, which blindly trusts the first (leftmost) value of the X-Forwarded-For HTTP header. A remote attacker can bypass IP-based access control lists and rate-limiting mechanisms, and forge log entries, by supplying a spoofed IP address in the X-Forwarded-For header. The issue is fixed in version 5.3.0.

Затронутые продукты
openSUSE Leap 16.0:hauler-2.1.0-bp160.1.1
Ссылки

Описание

go-chi/chi through 5.2.1 contains an IP spoofing vulnerability in the RealIP middleware (middleware/realip.go). The realIP() function reads client-controlled headers (True-Client-IP, X-Real-IP, and X-Forwarded-For) and overwrites r.RemoteAddr without verifying that the request originated from a trusted proxy. Attackers can supply arbitrary IP addresses in these headers to bypass IP-based access controls, evade rate limiting and geo-IP restrictions, and pollute audit logs. Fixed in 5.3.0.

Затронутые продукты
openSUSE Leap 16.0:hauler-2.1.0-bp160.1.1
Ссылки

Описание

go-chi/chi versions 0.9.0 before 5.3.0 contains an IP spoofing vulnerability in the RealIP middleware, which resolves the request source IP (Request.RemoteAddr) using the first IP in the X-Forwarded-For header without validating trusted proxies. A malicious client can prepend a forged IP as the first value of the X-Forwarded-For header to spoof the request source IP, potentially bypassing access controls or falsifying request logs.

Затронутые продукты
openSUSE Leap 16.0:hauler-2.1.0-bp160.1.1
Ссылки