SUSE-SU-2026:22242-1

SUSE-SU-2026:22242-1 · Security update for google-osconfig-agent

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

Esta página muestra una selección de datos de las fuentes. Consulte los avisos enlazados para ver la descripción completa y las versiones afectadas.

This update for google-osconfig-agent fixes the following issues - CVE-2023-45288: golang.org/x/net/http2: close connections when receiving too many headers (bsc#1236533). - CVE-2025-47911: golang.org/x/net/html: various algorithms with quadratic complexity when parsing HTML documents (bsc#1251453). - CVE-2025-58190: golang.org/x/net/html: excessive memory consumption by `html.ParseFragment` when processing specially crafted input (bsc#1251704). - CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo- header (bsc#1260264). - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265762). - CVE-2026-34986: github.com/go-jose/go-jose/v4: crafted JWE input with a missing encrypted key can lead to a denial of service (bsc#1262926). - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266603). - CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266171). - CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266171). - CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266171). - CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh (bsc#1266171). - CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh (bsc#1266171). - CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent (bsc#1266171). - CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266171). - CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266171). - CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266171). - CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts (bsc#1266171). - CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh (bsc#1266171). - CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266171). - CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266171). - CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during smart-HTTP clone and fetch operations (bsc#1264923). Changes for google-osconfig-agent: - Update to version 20260615.01 * Upgrade golang.org/x/crypto & golang.org/x/net (#1006) - from version 20260615.00 * Add unit tests for ospatch_apt_upgrade.go (#938) - Update to version 20260611.00 * Add unit tests for policies/policies.go PART 5 (#998) - from version 20260610.00 * Add unit tests for policies/policies.go PART 4 (#997) - from version 20260609.02 * squash commits (#936) - from version 20260609.01 * Add unit tests for policies/policies.go PART 3 (#996) - from version 20260609.00 * Add unit tests for policies/policies.go PART 2 (#991) - from version 20260602.01 * Align format of dates and timestamp collected across Windows packages (#973) - from version 20260602.00 * Add unit tests for config/config,go (#979) - from version 20260528.00 * Bump github.com/containerd/containerd (#990) - from version 20260521.00 * Cover agentconfig functionality by unit tests (#925) - from version 20260520.04 * Add unit tests for policies/googet.go (#961) * Bump github.com/go-git/go-git/v5 (#987) - from version 20260520.02 * Add unit tests for policies/yum.go (#952) * Add unit tests for policies/apt.go PART 3 (#951) - from version 20260520.00 * Add unit tests for policies/zypper.go (#953) - from version 20260519.00 * Add unit tests for policies/policies.go PART 1 (#949) - from version 20260513.01 * Bump github.com/go-git/go-git/v5 (#981), this also updates golang.org/x/net to v0.53.0 (bsc#1265762, CVE-2026-33814) - from version 20260513.00 * upgrade a few packages (#980) - from version 20260512.02 * Add/improve unit tests for agentendpoint/exec_task.go (#933) - from version 20260512.01 * Cover google_update.go by unit tests (#941) - from version 20260512.00 * Change zone for arm64 builds because of stockout (#978) - Update to version 20260511.00 * switch to t2a-standard-2 on ARM package build (#977) - from version 20260505.03 * Cover zypper_patch by unit tests (#958) - from version 20260505.02 * Remove unused functions DisableAutoUpdates (#970) - from version 20260505.01 * Bump go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc (#966) - from version 20260505.00 * Upgrade a few dependencies across the repo (#968) + github.com/go-git/go-git/v5 5.16.2->5.18.0 (bsc#1264923, CVE-2026-41506) + github.com/go-jose/go-jose/v4 4.1.3->4.1.4 (bsc#1262926, CVE-2026-34986) + github.com/go-viper/mapstructure/v2 2.3.0->2.4.0 + go.opentelemetry.io/otel 1.40.0->1.41.0 + go.opentelemetry.io/otel/sdk 1.39.0->1.43.0 - from version 20260504.01 * bump github.com/docker/cli to 29.2.0 (#962) - from version 20260504.00 * Bump github.com/opencontainers/selinux (#960) - Update to version 20260428.00 * Add/improve unit tests for agentendpoint/agentendpoint.go (#930) - from version 20260427.03 * Cover config/file.go by unit tests (#935) - from version 20260422.01 * Cover patch_linux.go by unit tests (#932) - from version 20260422.00 * upgrade grpc package in main package and e2e tests (#959) (bsc#1260264, CVE-2026-33186) - from version 20260417.04 * Bump OSV-Scalibr version to v0.4.3 (#956) - from version 20260417.03 * Add unit tests for updates_linux.go (#937) - from version 20260417.02 * Add zone to CreateDisk step (#955) - from version 20260417.01 * Change disk type for deb11 (#954) - from version 20260417.00 * Add unit tests for policies/apt.go PART 1 (#950) - from version 20260410.02 * Add unit tests for packages/pty_linux.go (#943) - from version 20260410.01 * fix disk type for arm workflows (#948) - from version 20260410.00 * Change machine type for arm based workflows (#946) - Update to version 20260330.00 * bump timeouts for all workflows (#940) - from version 20260326.00 * Cover exec_resource.go by unit tests (#934) - from version 20260318.00 * Integrate OSConfig agent with ReportVmInventory (#923) - from version 20260313.02 * remove cacheonly flag from yum upgrade (#924) - from version 20260313.01 * conditions python version override (#927) - from version 20260313.00 * Fix presubmits by explicitly set python version for rpm based systems (#926) - from version 20260311.00 * Bump osconfig version (#922) - from version 20260309.02 * Extend OSV scalibr extractor (#921) - from version 20260309.01 * upgrade golang.org/x/crypto and it's transitive deps (#918) - from version 20260309.00 * Add purl to pkg info (#920) - from version 20260306.00 * Add 'Type' field to PkgInfo (#919) - from version 20260303.01 * Upgrade go.opentelemetry.io/otel/sdk (#913) - from version 20260303.00 * Bump github.com/vbatts/tar-split from 0.11.5 to 0.12.2 (#908) - from version 20260302.00 * Bump github.com/spdx/tools-golang from 0.5.3 to 0.5.7 (#906) - from version 20260126.00 * Bump go.opentelemetry.io/otel/sdk from 1.38.0 to 1.39.0 (#905) * Bump github.com/sirupsen/logrus (#894) - Update to version 20260119.00 * Bump cloud.google.com/go/storage from 1.56.0 to 1.58.0 (#899) - Update to version 20251230.00 * chore: Migrate gsutil usage to gcloud storage (#904) - from version 20251223.00 * fix e2e tests for report inventory (#903) - from version 20251222.01 * Revert "Bump cloud.google.com/go/longrunning from 0.6.3 to 0.7.0 (#882)" (#902) - from version 20251222.00 * Bump golang to the new versi

Corrección disponible

Publicación

2026-06-22T09:09:04Z

Actualización

2026-06-26T18:24:10.461684090Z

Pila tecnológica: system

Comprueba tu servidor →