SUSE-SU-2026:22242-1

SUSE-SU-2026:22242-1 · Security update for google-osconfig-agent

Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.

Cette page présente une partie des faits des sources. Consultez les avis liés pour la description complète et les versions concernées.

This update for google-osconfig-agent fixes the following issues - CVE-2023-45288: golang.org/x/net/http2: close connections when receiving too many headers (bsc#1236533). - CVE-2025-47911: golang.org/x/net/html: various algorithms with quadratic complexity when parsing HTML documents (bsc#1251453). - CVE-2025-58190: golang.org/x/net/html: excessive memory consumption by `html.ParseFragment` when processing specially crafted input (bsc#1251704). - CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2 :path pseudo- header (bsc#1260264). - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265762). - CVE-2026-34986: github.com/go-jose/go-jose/v4: crafted JWE input with a missing encrypted key can lead to a denial of service (bsc#1262926). - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266603). - CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266171). - CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266171). - CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266171). - CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh (bsc#1266171). - CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh (bsc#1266171). - CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent (bsc#1266171). - CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266171). - CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266171). - CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266171). - CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts (bsc#1266171). - CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh (bsc#1266171). - CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266171). - CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266171). - CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during smart-HTTP clone and fetch operations (bsc#1264923). Changes for google-osconfig-agent: - Update to version 20260615.01 * Upgrade golang.org/x/crypto & golang.org/x/net (#1006) - from version 20260615.00 * Add unit tests for ospatch_apt_upgrade.go (#938) - Update to version 20260611.00 * Add unit tests for policies/policies.go PART 5 (#998) - from version 20260610.00 * Add unit tests for policies/policies.go PART 4 (#997) - from version 20260609.02 * squash commits (#936) - from version 20260609.01 * Add unit tests for policies/policies.go PART 3 (#996) - from version 20260609.00 * Add unit tests for policies/policies.go PART 2 (#991) - from version 20260602.01 * Align format of dates and timestamp collected across Windows packages (#973) - from version 20260602.00 * Add unit tests for config/config,go (#979) - from version 20260528.00 * Bump github.com/containerd/containerd (#990) - from version 20260521.00 * Cover agentconfig functionality by unit tests (#925) - from version 20260520.04 * Add unit tests for policies/googet.go (#961) * Bump github.com/go-git/go-git/v5 (#987) - from version 20260520.02 * Add unit tests for policies/yum.go (#952) * Add unit tests for policies/apt.go PART 3 (#951) - from version 20260520.00 * Add unit tests for policies/zypper.go (#953) - from version 20260519.00 * Add unit tests for policies/policies.go PART 1 (#949) - from version 20260513.01 * Bump github.com/go-git/go-git/v5 (#981), this also updates golang.org/x/net to v0.53.0 (bsc#1265762, CVE-2026-33814) - from version 20260513.00 * upgrade a few packages (#980) - from version 20260512.02 * Add/improve unit tests for agentendpoint/exec_task.go (#933) - from version 20260512.01 * Cover google_update.go by unit tests (#941) - from version 20260512.00 * Change zone for arm64 builds because of stockout (#978) - Update to version 20260511.00 * switch to t2a-standard-2 on ARM package build (#977) - from version 20260505.03 * Cover zypper_patch by unit tests (#958) - from version 20260505.02 * Remove unused functions DisableAutoUpdates (#970) - from version 20260505.01 * Bump go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc (#966) - from version 20260505.00 * Upgrade a few dependencies across the repo (#968) + github.com/go-git/go-git/v5 5.16.2->5.18.0 (bsc#1264923, CVE-2026-41506) + github.com/go-jose/go-jose/v4 4.1.3->4.1.4 (bsc#1262926, CVE-2026-34986) + github.com/go-viper/mapstructure/v2 2.3.0->2.4.0 + go.opentelemetry.io/otel 1.40.0->1.41.0 + go.opentelemetry.io/otel/sdk 1.39.0->1.43.0 - from version 20260504.01 * bump github.com/docker/cli to 29.2.0 (#962) - from version 20260504.00 * Bump github.com/opencontainers/selinux (#960) - Update to version 20260428.00 * Add/improve unit tests for agentendpoint/agentendpoint.go (#930) - from version 20260427.03 * Cover config/file.go by unit tests (#935) - from version 20260422.01 * Cover patch_linux.go by unit tests (#932) - from version 20260422.00 * upgrade grpc package in main package and e2e tests (#959) (bsc#1260264, CVE-2026-33186) - from version 20260417.04 * Bump OSV-Scalibr version to v0.4.3 (#956) - from version 20260417.03 * Add unit tests for updates_linux.go (#937) - from version 20260417.02 * Add zone to CreateDisk step (#955) - from version 20260417.01 * Change disk type for deb11 (#954) - from version 20260417.00 * Add unit tests for policies/apt.go PART 1 (#950) - from version 20260410.02 * Add unit tests for packages/pty_linux.go (#943) - from version 20260410.01 * fix disk type for arm workflows (#948) - from version 20260410.00 * Change machine type for arm based workflows (#946) - Update to version 20260330.00 * bump timeouts for all workflows (#940) - from version 20260326.00 * Cover exec_resource.go by unit tests (#934) - from version 20260318.00 * Integrate OSConfig agent with ReportVmInventory (#923) - from version 20260313.02 * remove cacheonly flag from yum upgrade (#924) - from version 20260313.01 * conditions python version override (#927) - from version 20260313.00 * Fix presubmits by explicitly set python version for rpm based systems (#926) - from version 20260311.00 * Bump osconfig version (#922) - from version 20260309.02 * Extend OSV scalibr extractor (#921) - from version 20260309.01 * upgrade golang.org/x/crypto and it's transitive deps (#918) - from version 20260309.00 * Add purl to pkg info (#920) - from version 20260306.00 * Add 'Type' field to PkgInfo (#919) - from version 20260303.01 * Upgrade go.opentelemetry.io/otel/sdk (#913) - from version 20260303.00 * Bump github.com/vbatts/tar-split from 0.11.5 to 0.12.2 (#908) - from version 20260302.00 * Bump github.com/spdx/tools-golang from 0.5.3 to 0.5.7 (#906) - from version 20260126.00 * Bump go.opentelemetry.io/otel/sdk from 1.38.0 to 1.39.0 (#905) * Bump github.com/sirupsen/logrus (#894) - Update to version 20260119.00 * Bump cloud.google.com/go/storage from 1.56.0 to 1.58.0 (#899) - Update to version 20251230.00 * chore: Migrate gsutil usage to gcloud storage (#904) - from version 20251223.00 * fix e2e tests for report inventory (#903) - from version 20251222.01 * Revert "Bump cloud.google.com/go/longrunning from 0.6.3 to 0.7.0 (#882)" (#902) - from version 20251222.00 * Bump golang to the new versi

Correctif disponible

Publication

2026-06-22T09:09:04Z

Mise à jour

2026-06-26T18:24:10.461684090Z

Pile logicielle: system

Vérifiez votre serveur →