Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

openSUSE-SU-2026:22201-1

Опубликовано: 28 окт. 2026
Источник: suse-cvrf

Описание

Security update for hauler

This update for hauler fixes the following issues:

Changes in hauler:

  • update vendor:

    • CVE-2026-114437: github.com/go-chi/chi/v5: client IP spoofing in ClientIPFromXFF via `X-Forwarded-For (bsc#1287881)

  • update to 2.1.2 (bsc#1285270, CVE-2026-78669):

    • It fixes credential and presigned url leaks, local chart handling, haul formats from --filename, and hauler store copy with image-type files and cosign bundles. It adds hauler, hauler-dev, and hauler@ homebrew casks, and it is the first release published through them. It also bumps go to 1.27.2.

Список пакетов

openSUSE Leap 16.0
hauler-2.1.2-bp160.1.1

Ссылки

Описание

In the Golang Chi web framework, the ClientIPFromXFF middleware skips any X-Forwarded-For entry in a configured trusted CIDR but never verifies that the direct TCP peer in http.Request.RemoteAddr belongs to that CIDR. A client that can reach the Go server directly can therefore append a trusted-looking proxy address and choose the client IP returned by middleware.GetClientIP. This issue affects chi before 5.4.0.

Затронутые продукты
openSUSE Leap 16.0:hauler-2.1.2-bp160.1.1
Ссылки

Описание

A malicious HTTP/2 peer can cause excessive CPU consumption in the client or server by opening a large number of streams and then sending many small SETTINGS frames containing SETTINGS_INITIAL_WINDOW_SIZE values.

Затронутые продукты
openSUSE Leap 16.0:hauler-2.1.2-bp160.1.1
Ссылки