Описание
Security update for docker
This update for docker fixes the following issues:
Security issues fixed:
- CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265782).
- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266625).
- CVE-2026-39984: github.com/sigstore/timestamp-authority/v2/pkg/verification: improper certificate validation can be used to bypass some authorization controls (bsc#1262346).
- CVE-2026-41567: arbitrary code execution with full daemon privileges when a user uploads a compressed archive into that container (bsc#1267827).
Non security issue fixed:
- SELinux CIL files are not shipped in Docker (bsc#1278193).
Changes for docker:
- Update to Docker 29.7.2. See upstream changelog online at https://docs.docker.com/engine/release-notes/29/#2972 fixes(bsc#1268280, bsc#1268359, bsc#1271209, bsc#1266176)
- Update to buildx 0.36.1. See upstream changelog online at https://github.com/docker/buildx/releases/tag/v0.36.1
Список пакетов
openSUSE Leap 16.0
Ссылки
- SUSE Security Ratings
- SUSE Bug 1073877
- SUSE Bug 1099277
- SUSE Bug 1262346
- SUSE Bug 1265782
- SUSE Bug 1266176
- SUSE Bug 1266625
- SUSE Bug 1267827
- SUSE Bug 1268280
- SUSE Bug 1268359
- SUSE Bug 1271209
- SUSE Bug 1278193
- SUSE CVE CVE-2026-31431 page
- SUSE CVE CVE-2026-33814 page
- SUSE CVE CVE-2026-39821 page
- SUSE CVE CVE-2026-39984 page
- SUSE CVE CVE-2026-41567 page
Описание
In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place This mostly reverts commit 72548b093ee3 except for the copying of the associated data. There is no benefit in operating in-place in algif_aead since the source and destination come from different mappings. Get rid of all the complexity added for in-place operation and just copy the AD directly.
Затронутые продукты
Ссылки
- CVE-2026-31431
- SUSE Bug 1262573
- SUSE Bug 1263689
- SUSE Bug 1263938
- SUSE Bug 1263939
- SUSE Bug 1264274
- SUSE Bug 1265460
Описание
When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.
Затронутые продукты
Ссылки
- CVE-2026-33814
- SUSE Bug 1264506
- SUSE Bug 1268758
Описание
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege escalation in programs using the idna package. For example, a program which performs privilege checks on the ASCII hostname may reject "example.com" but permit "xn--example-.com". If that program subsequently converts the ASCII hostname to Unicode, it will inadvertently permits access to the Unicode name "example.com".
Затронутые продукты
Ссылки
- CVE-2026-39821
- SUSE Bug 1266474
Описание
Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Versions 2.0.5 and below contain an authorization bypass vulnerability in the VerifyTimestampResponse function. VerifyTimestampResponse correctly verifies the certificate chain signature, but the TSA-specific constraint checks in VerifyLeafCert uses the first non-CA certificate from the PKCS#7 certificate bag instead of the leaf certificate from the verified chain. An attacker can exploit this by prepending a forged certificate to the certificate bag while the message is signed with an authorized key, causing the library to validate the signature against one certificate but perform authorization checks against another. This vulnerability only affects users of the timestamp-authority/v2/pkg/verification package and does not affect the timestamp-authority service itself or sigstore-go. The issue has been fixed in version 2.0.6.
Затронутые продукты
Ссылки
- CVE-2026-39984
- SUSE Bug 1262338
Описание
Moby is an open source container framework. In versions prior to 29.5.1 and in moby/moby v2 prior to v2.0.0-beta.14, when a compressed archive is uploaded to a container via `PUT /containers/{id}/archive` or piped through `docker cp -`, the daemon resolves decompression binaries (such as `xz` or `unpigz`) from the container's filesystem rather than the host's due to incorrect ordering of operations. A malicious container image containing a trojanized decompression binary can achieve arbitrary code execution with full daemon privileges, including host root UID and unrestricted capabilities, when a user uploads a compressed (xz or gzip) archive into that container. This issue is fixed in Docker Engine 29.5.1 and moby/moby v2.0.0-beta.14. Workarounds include only running containers from trusted images, using authorization plugins to restrict access to the `PUT /containers/{id}/archive` endpoint, and avoiding piping compressed archives into containers created from untrusted images
Затронутые продукты
Ссылки
- CVE-2026-41567
- SUSE Bug 1267827