SUSE-SU-2025:20360-1
SUSE-SU-2025:20360-1 · Security update for docker
This page contains facts from public vulnerability sources. Check the original advisory before updating.
This update for docker fixes the following issues: Update to docker-buildx v0.22.0: - CVE-2025-0495: buildx: credential leakage to telemetry endpoints when credentials allowed to be set as attribute values in cache-to/cache-from configuration (bsc#1239765). - CVE-2025-22868: golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2 (bsc#1239185). - CVE-2025-22869: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (bsc#1239322). Bug fixes: - Fix unconditional container-selinux pull (bsc#1237367).
Fix available
- Published
- Updated
Stack: system
Affected products and versions
docker SUSE:Linux Micro 6.1
- Affected ranges
- ECOSYSTEM: < 27.5.1_ce-slfo.1.1_2.1
Update to 27.5.1_ce-slfo.1.1_2.1
Original sources
- https://www.suse.com/support/update/announcement/2025/suse-su-202520360-1/
- https://bugzilla.suse.com/1237367
- https://bugzilla.suse.com/1239185
- https://bugzilla.suse.com/1239322
- https://bugzilla.suse.com/1239765
- https://www.suse.com/security/cve/CVE-2025-0495
- https://www.suse.com/security/cve/CVE-2025-22868
- https://www.suse.com/security/cve/CVE-2025-22869
- https://osv.dev/vulnerability/SUSE-SU-2025:20360-1