SUSE-SU-2026:2643-1

SUSE-SU-2026:2643-1 · Security update for aws-iam-authenticator

Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.

Cette page présente une partie des faits des sources. Consultez les avis liés pour la description complète et les versions concernées.

This update for aws-iam-authenticator fixes the following issues - CVE-2022-1996: CORS bypass (bsc#1200528). - CVE-2022-2385: aws-iam-authenticator AccessKeyID validation bypass (bsc#1201395). - CVE-2024-39689: remove root certificates from `GLOBALTRUST` from the root store. - CVE-2025-47910: net/http: CrossOriginProtection bypass patterns are over-broad. - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265842). - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266651). Changes for aws-iam-authenticator: - Update to version 0.7.18 * Merge pull request (#1062) from CaidenBorrego/new-release * Creating new release for CVE mitigation * Merge pull request (#1057) from CaidenBorrego/caidenb-versionbump * Merge remote-tracking branch 'upstream/master' into caidenb-versionbump * Bump x/net and x/sys to remediate CVEs (bsc#1266651, CVE-2026-39821) - Update to 0.7.17 * Merge pull request #1051 from CaidenBorrego/caidenb-versionbump * bumping version from 0.7.16->0.7.17 * Merge pull request #1047 from CaidenBorrego/caidenb-reservedprefix-fix * fix: honor reservedPrefixConfig for ConfigMap and CRD backends * Merge pull request #1046 from CaidenBorrego/caidenb-gorunner-bump * fix: reject malformed mapping ARN in userIDStrict mode for dynamic files - Update to 0.7.16 * Merge pull request #1041 from ronaldngounou/rngounou/bump-go-1.26.3 * Pin GitHub Actions to full-length commit SHAs * fix: bump go version to 1.26.3 for CVEs - from version 0.7.15 * Merge pull request #1035 from Ganiredi/bump-version-0.7.15 * Bump version to 0.7.15 * Merge pull request #1030 from Ganiredi/1.36-k8s-deps * 1.36.0 dependency update - from version 0.7.14 * Merge pull request #1029 from CaidenBorrego/caidenb-gorunner-bump * Bump version to 0.7.14 * Bumping gorunner image tag in Dockerfile for CVE mitigation - from version 0.7.13 * Merge pull request #1020 from dheeraj-coding/master * feat: add manual dispatch function for create-release.yml * Merge pull request #1019 from dheeraj-coding/master * fix: create-release workflow failures * Merge pull request #1017 from Ganiredi/1.36-k8s-deps * Merge pull request #1018 from dheeraj-coding/master * fix: build failure due to stale gcb image by updating to latest * Release 0.7.13 * Merge pull request #1016 from Ganiredi/1.36-k8s-deps * Merge branch 'master' into 1.36-k8s-deps * Merge pull request #1013 from kubernetes-sigs/dependabot/go_modules/misc-dependencies-be00ae3611 * 1.36.rc release * Merge pull request #1015 from dheeraj-coding/master * fix: bump go version 1.26.2 for CVEs * chore(deps): Bump the misc-dependencies group across 3 directories with 6 updates (bsc#1265842, CVE-2026-33814) * Merge pull request #1011 from kubernetes-sigs/dependabot/go_modules/observability-dependencies-9e34dd3c34 * Merge pull request #1009 from kubernetes-sigs/dependabot/go_modules/misc-dependencies-b5e1eeb2d5 * Merge pull request #1004 from bryantbiggs/chore/fix-goreleaser-deprecations * Merge pull request #1010 from kubernetes-sigs/dependabot/go_modules/aws-dependencies-7118f1d525 * chore(deps): Bump the observability-dependencies group across 2 directories with 2 updates * chore(deps): Bump the aws-dependencies group across 2 directories with 6 updates * chore(deps): Bump the misc-dependencies group across 3 directories with 2 updates * Merge pull request #1008 from kubernetes-sigs/dependabot/go_modules/aws-dependencies-3ce7b5fcac * chore(deps): Bump the aws-dependencies group across 2 directories with 12 updates * Merge pull request #1006 from kubernetes-sigs/dependabot/go_modules/k8s-dependencies-09346e948b * chore(deps): Bump the k8s-dependencies group across 3 directories with 8 updates * Merge pull request #1005 from kubernetes-sigs/dependabot/go_modules/aws-dependencies-508cd0fd8e * chore(deps): Bump the aws-dependencies group across 2 directories with 15 updates * fix: update Makefile goreleaser target for v2 compatibility * fix: resolve goreleaser v2 deprecations - Update to version 0.7.12 * Update OWNERS in reviewers and approvers list * Release 0.7.12 * ci: add verify job to catch unrun gofmt and go mod tidy * chore(lint): harden linter config and fix coverage gaps * fix(lint): add revive and unparam linters with full compliance * ci: add unit test job, expand golangci config, add make update/verify * docs(e2e): fix Go version, remove non-existent make target, fix typo * docs(release): remove stale ECR image update instructions and fix asset version placeholders * fix: address code review findings in repo cleanup branch * docs: rewrite development.md as a practical local dev guide * chore: repo cleanup, developer experience improvements * chore: reduce binary size by 59% (80 MB -> 33 MB) * fix(lint): replace deprecated NewSimpleClientset and fix embedded field selector * fix(tests): address code review findings in integration test framework * fix(tests): address post-refactor issues and add go workspace * refactor(tests): remove k8s.io/kubernetes dependency from test modules * chore: update all dependencies to latest versions - Set GOWORK=off to make building with vendored dependencies work - Update to version 0.7.11 * Merge pull request #988 from dstdfx/bump-version * Bump version to 0.7.11 * Merge pull request #985 from dstdfx/bump-go-version-1.25.7 * Update go.mod for e2e/int tests * Update go.mod * Merge pull request #986 from ShiriNmi1520/master * Clarify README 'Run the server' deployment instructions * Bump go to 1.25.7 * Merge pull request #983 from eks-distro-pr-bot/eks-distro-pr-bot/go-version-bumps * Creating PR to update Go version to 1.25.6 - Update to version 0.7.10: * 1.35.0 dependency update * Creating PR to update Go version to 1.25.5 * chore(deps): Bump the observability-dependencies group across 2 directories with 1 update * chore(deps): Bump the misc-dependencies group across 3 directories with 13 updates * chore(deps): Bump the observability-dependencies group across 1 directory with 2 updates * chore(deps): Bump the misc-dependencies group across 3 directories with 27 updates * chore(deps): Bump the aws-dependencies group across 2 directories with 11 updates * chore(deps): Bump the misc-dependencies group across 2 directories with 17 updates - Update to version 0.7.9 * Creating PR to update Go version to 1.25.4 * chore(deps): Bump the aws-dependencies group across 2 directories with 13 updates * chore(deps): Bump golangci/golangci-lint-action in the actions group * chore(deps): Bump the observability-dependencies group across 3 directories with 2 updates * chore(deps): Bump sigs.k8s.io/apiserver-network-proxy/konnectivity-client * chore(deps): Bump the aws-dependencies group across 2 directories with 14 updates * bump golang version to 1.25.3 * Creating PR to update Go version to 1.25.3 * chore(deps): Bump github.com/onsi/ginkgo/v2 * chore(deps): Bump the observability-dependencies group across 3 directories with 1 update * chore(deps): Bump the misc-dependencies group across 3 directories with 11 updates * chore(deps): Bump the misc-dependencies group across 3 directories with 5 updates * chore(deps): Bump the aws-dependencies group across 2 directories with 3 updates - Update to version 0.7.8 * chore: Bump indirect Kubernetes dependencies to latest * chore: Bump Kubernetes dependencies to latest * Bump the misc-dependencies group across 3 directories with 18 updates * Bump the aws-dependencies group across 2 directories with 11 updates * Fix CVE-2025-47910 * Bump go.opentelemetry.io/auto/sdk * Bump the aws-dependencies group across 2 directories with 1 update * Bump the misc-dependencies group across 3 directories with 10 updates - from version 0.7.7 * add support for aws-eusc partition * chore: Commit changes from `make codegen` *

Correctif disponible

Publication

2026-06-26T08:35:05Z

Mise à jour

2026-06-27T08:45:05.148057969Z

Pile logicielle: system

Vérifiez votre serveur →