SUSE-SU-2026:2643-1

SUSE-SU-2026:2643-1 · Security update for aws-iam-authenticator

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

This update for aws-iam-authenticator fixes the following issues - CVE-2022-1996: CORS bypass (bsc#1200528). - CVE-2022-2385: aws-iam-authenticator AccessKeyID validation bypass (bsc#1201395). - CVE-2024-39689: remove root certificates from `GLOBALTRUST` from the root store. - CVE-2025-47910: net/http: CrossOriginProtection bypass patterns are over-broad. - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265842). - CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266651). Changes for aws-iam-authenticator: - Update to version 0.7.18 * Merge pull request (#1062) from CaidenBorrego/new-release * Creating new release for CVE mitigation * Merge pull request (#1057) from CaidenBorrego/caidenb-versionbump * Merge remote-tracking branch 'upstream/master' into caidenb-versionbump * Bump x/net and x/sys to remediate CVEs (bsc#1266651, CVE-2026-39821) - Update to 0.7.17 * Merge pull request #1051 from CaidenBorrego/caidenb-versionbump * bumping version from 0.7.16->0.7.17 * Merge pull request #1047 from CaidenBorrego/caidenb-reservedprefix-fix * fix: honor reservedPrefixConfig for ConfigMap and CRD backends * Merge pull request #1046 from CaidenBorrego/caidenb-gorunner-bump * fix: reject malformed mapping ARN in userIDStrict mode for dynamic files - Update to 0.7.16 * Merge pull request #1041 from ronaldngounou/rngounou/bump-go-1.26.3 * Pin GitHub Actions to full-length commit SHAs * fix: bump go version to 1.26.3 for CVEs - from version 0.7.15 * Merge pull request #1035 from Ganiredi/bump-version-0.7.15 * Bump version to 0.7.15 * Merge pull request #1030 from Ganiredi/1.36-k8s-deps * 1.36.0 dependency update - from version 0.7.14 * Merge pull request #1029 from CaidenBorrego/caidenb-gorunner-bump * Bump version to 0.7.14 * Bumping gorunner image tag in Dockerfile for CVE mitigation - from version 0.7.13 * Merge pull request #1020 from dheeraj-coding/master * feat: add manual dispatch function for create-release.yml * Merge pull request #1019 from dheeraj-coding/master * fix: create-release workflow failures * Merge pull request #1017 from Ganiredi/1.36-k8s-deps * Merge pull request #1018 from dheeraj-coding/master * fix: build failure due to stale gcb image by updating to latest * Release 0.7.13 * Merge pull request #1016 from Ganiredi/1.36-k8s-deps * Merge branch 'master' into 1.36-k8s-deps * Merge pull request #1013 from kubernetes-sigs/dependabot/go_modules/misc-dependencies-be00ae3611 * 1.36.rc release * Merge pull request #1015 from dheeraj-coding/master * fix: bump go version 1.26.2 for CVEs * chore(deps): Bump the misc-dependencies group across 3 directories with 6 updates (bsc#1265842, CVE-2026-33814) * Merge pull request #1011 from kubernetes-sigs/dependabot/go_modules/observability-dependencies-9e34dd3c34 * Merge pull request #1009 from kubernetes-sigs/dependabot/go_modules/misc-dependencies-b5e1eeb2d5 * Merge pull request #1004 from bryantbiggs/chore/fix-goreleaser-deprecations * Merge pull request #1010 from kubernetes-sigs/dependabot/go_modules/aws-dependencies-7118f1d525 * chore(deps): Bump the observability-dependencies group across 2 directories with 2 updates * chore(deps): Bump the aws-dependencies group across 2 directories with 6 updates * chore(deps): Bump the misc-dependencies group across 3 directories with 2 updates * Merge pull request #1008 from kubernetes-sigs/dependabot/go_modules/aws-dependencies-3ce7b5fcac * chore(deps): Bump the aws-dependencies group across 2 directories with 12 updates * Merge pull request #1006 from kubernetes-sigs/dependabot/go_modules/k8s-dependencies-09346e948b * chore(deps): Bump the k8s-dependencies group across 3 directories with 8 updates * Merge pull request #1005 from kubernetes-sigs/dependabot/go_modules/aws-dependencies-508cd0fd8e * chore(deps): Bump the aws-dependencies group across 2 directories with 15 updates * fix: update Makefile goreleaser target for v2 compatibility * fix: resolve goreleaser v2 deprecations - Update to version 0.7.12 * Update OWNERS in reviewers and approvers list * Release 0.7.12 * ci: add verify job to catch unrun gofmt and go mod tidy * chore(lint): harden linter config and fix coverage gaps * fix(lint): add revive and unparam linters with full compliance * ci: add unit test job, expand golangci config, add make update/verify * docs(e2e): fix Go version, remove non-existent make target, fix typo * docs(release): remove stale ECR image update instructions and fix asset version placeholders * fix: address code review findings in repo cleanup branch * docs: rewrite development.md as a practical local dev guide * chore: repo cleanup, developer experience improvements * chore: reduce binary size by 59% (80 MB -> 33 MB) * fix(lint): replace deprecated NewSimpleClientset and fix embedded field selector * fix(tests): address code review findings in integration test framework * fix(tests): address post-refactor issues and add go workspace * refactor(tests): remove k8s.io/kubernetes dependency from test modules * chore: update all dependencies to latest versions - Set GOWORK=off to make building with vendored dependencies work - Update to version 0.7.11 * Merge pull request #988 from dstdfx/bump-version * Bump version to 0.7.11 * Merge pull request #985 from dstdfx/bump-go-version-1.25.7 * Update go.mod for e2e/int tests * Update go.mod * Merge pull request #986 from ShiriNmi1520/master * Clarify README 'Run the server' deployment instructions * Bump go to 1.25.7 * Merge pull request #983 from eks-distro-pr-bot/eks-distro-pr-bot/go-version-bumps * Creating PR to update Go version to 1.25.6 - Update to version 0.7.10: * 1.35.0 dependency update * Creating PR to update Go version to 1.25.5 * chore(deps): Bump the observability-dependencies group across 2 directories with 1 update * chore(deps): Bump the misc-dependencies group across 3 directories with 13 updates * chore(deps): Bump the observability-dependencies group across 1 directory with 2 updates * chore(deps): Bump the misc-dependencies group across 3 directories with 27 updates * chore(deps): Bump the aws-dependencies group across 2 directories with 11 updates * chore(deps): Bump the misc-dependencies group across 2 directories with 17 updates - Update to version 0.7.9 * Creating PR to update Go version to 1.25.4 * chore(deps): Bump the aws-dependencies group across 2 directories with 13 updates * chore(deps): Bump golangci/golangci-lint-action in the actions group * chore(deps): Bump the observability-dependencies group across 3 directories with 2 updates * chore(deps): Bump sigs.k8s.io/apiserver-network-proxy/konnectivity-client * chore(deps): Bump the aws-dependencies group across 2 directories with 14 updates * bump golang version to 1.25.3 * Creating PR to update Go version to 1.25.3 * chore(deps): Bump github.com/onsi/ginkgo/v2 * chore(deps): Bump the observability-dependencies group across 3 directories with 1 update * chore(deps): Bump the misc-dependencies group across 3 directories with 11 updates * chore(deps): Bump the misc-dependencies group across 3 directories with 5 updates * chore(deps): Bump the aws-dependencies group across 2 directories with 3 updates - Update to version 0.7.8 * chore: Bump indirect Kubernetes dependencies to latest * chore: Bump Kubernetes dependencies to latest * Bump the misc-dependencies group across 3 directories with 18 updates * Bump the aws-dependencies group across 2 directories with 11 updates * Fix CVE-2025-47910 * Bump go.opentelemetry.io/auto/sdk * Bump the aws-dependencies group across 2 directories with 1 update * Bump the misc-dependencies group across 3 directories with 10 updates - from version 0.7.7 * add support for aws-eusc partition * chore: Commit changes from `make codegen` *

Fix available

Published

2026-06-26T08:35:05Z

Updated

2026-06-27T08:45:05.148057969Z

Stack: system

Check your server →