Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2025-11065 (GCVE-0-2025-11065)
Vulnerability from cvelistv5 – Published: 2026-01-26 19:36 – Updated: 2026-01-26 19:36
VLAI?
EPSS
Title
Github.com/go-viper/mapstructure/v2: go-viper's mapstructure may leak sensitive information in logs in github.com/go-viper/mapstructure
Summary
A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.
Severity ?
5.3 (Medium)
CWE
- CWE-209 - Generation of Error Message Containing Sensitive Information
Assigner
References
| URL | Tags | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||
Impacted products
{
"containers": {
"cna": {
"affected": [
{
"collectionURL": "https://github.com/go-viper/mapstructure/",
"defaultStatus": "unaffected",
"packageName": "github.com/go-viper/mapstructure/v2",
"versions": [
{
"lessThan": "2.4.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_pipelines:1"
],
"defaultStatus": "affected",
"packageName": "openshift-pipelines-client",
"product": "OpenShift Pipelines",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:acm:2"
],
"defaultStatus": "affected",
"packageName": "rhacm2/acm-grafana-rhel9",
"product": "Red Hat Advanced Cluster Management for Kubernetes 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:acm:2"
],
"defaultStatus": "affected",
"packageName": "rhacm2/submariner-rhel9-operator",
"product": "Red Hat Advanced Cluster Management for Kubernetes 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:advanced_cluster_security:4"
],
"defaultStatus": "affected",
"packageName": "advanced-cluster-security/rhacs-central-db-rhel8",
"product": "Red Hat Advanced Cluster Security 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:advanced_cluster_security:4"
],
"defaultStatus": "affected",
"packageName": "advanced-cluster-security/rhacs-main-rhel8",
"product": "Red Hat Advanced Cluster Security 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:advanced_cluster_security:4"
],
"defaultStatus": "affected",
"packageName": "advanced-cluster-security/rhacs-rhel8-operator",
"product": "Red Hat Advanced Cluster Security 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:advanced_cluster_security:4"
],
"defaultStatus": "affected",
"packageName": "advanced-cluster-security/rhacs-roxctl-rhel8",
"product": "Red Hat Advanced Cluster Security 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:advanced_cluster_security:4"
],
"defaultStatus": "affected",
"packageName": "advanced-cluster-security/rhacs-scanner-v4-db-rhel8",
"product": "Red Hat Advanced Cluster Security 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:advanced_cluster_security:4"
],
"defaultStatus": "affected",
"packageName": "advanced-cluster-security/rhacs-scanner-v4-rhel8",
"product": "Red Hat Advanced Cluster Security 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:certifications:1::el8"
],
"defaultStatus": "affected",
"packageName": "redhat-certification-preflight",
"product": "Red Hat Certification for Red Hat Enterprise Linux 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:certifications:9"
],
"defaultStatus": "affected",
"packageName": "redhat-certification-preflight",
"product": "Red Hat Certification Program for Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "affected",
"packageName": "gvisor-tap-vsock",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "affected",
"packageName": "opentelemetry-collector",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:10"
],
"defaultStatus": "affected",
"packageName": "toolbox",
"product": "Red Hat Enterprise Linux 10",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "gvisor-tap-vsock",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "opentelemetry-collector",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/o:redhat:enterprise_linux:9"
],
"defaultStatus": "affected",
"packageName": "toolbox",
"product": "Red Hat Enterprise Linux 9",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-model-registry-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-rhel9-operator",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "affected",
"packageName": "microshift",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "affected",
"packageName": "openshift",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "affected",
"packageName": "openshift4/ose-helm-operator",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "affected",
"packageName": "openshift4/ose-helm-rhel9-operator",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift:4"
],
"defaultStatus": "affected",
"packageName": "podman",
"product": "Red Hat OpenShift Container Platform 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_devspaces:3"
],
"defaultStatus": "affected",
"packageName": "devspaces/traefik-rhel9",
"product": "Red Hat OpenShift Dev Spaces",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_devspaces:3"
],
"defaultStatus": "unaffected",
"packageName": "devspaces/udi-base-rhel9",
"product": "Red Hat OpenShift Dev Spaces",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_devspaces:3"
],
"defaultStatus": "unaffected",
"packageName": "devspaces/udi-rhel9",
"product": "Red Hat OpenShift Dev Spaces",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_distributed_tracing:3"
],
"defaultStatus": "affected",
"packageName": "rhosdt/opentelemetry-collector-rhel8",
"product": "Red Hat OpenShift distributed tracing 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_gitops:1"
],
"defaultStatus": "affected",
"packageName": "openshift-gitops-1/argocd-rhel8",
"product": "Red Hat OpenShift GitOps",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_gitops:1"
],
"defaultStatus": "affected",
"packageName": "openshift-gitops-1/argocd-rhel9",
"product": "Red Hat OpenShift GitOps",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:trusted_application_pipeline:1"
],
"defaultStatus": "affected",
"packageName": "rhtap-task-runner/rhtap-task-runner-rhel9",
"product": "Red Hat Trusted Application Pipeline",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:trusted_artifact_signer:1"
],
"defaultStatus": "affected",
"packageName": "rhtas/cosign-rhel9",
"product": "Red Hat Trusted Artifact Signer",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:trusted_artifact_signer:1"
],
"defaultStatus": "affected",
"packageName": "rhtas/fulcio-rhel9",
"product": "Red Hat Trusted Artifact Signer",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:trusted_artifact_signer:1"
],
"defaultStatus": "affected",
"packageName": "rhtas/gitsign-rhel9",
"product": "Red Hat Trusted Artifact Signer",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:trusted_artifact_signer:1"
],
"defaultStatus": "affected",
"packageName": "rhtas/rekor-backfill-redis-rhel9",
"product": "Red Hat Trusted Artifact Signer",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:trusted_artifact_signer:1"
],
"defaultStatus": "affected",
"packageName": "rhtas/rekor-cli-rhel9",
"product": "Red Hat Trusted Artifact Signer",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:trusted_artifact_signer:1"
],
"defaultStatus": "affected",
"packageName": "rhtas/rekor-server-rhel9",
"product": "Red Hat Trusted Artifact Signer",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:trusted_artifact_signer:1"
],
"defaultStatus": "affected",
"packageName": "rhtas/timestamp-authority-rhel9",
"product": "Red Hat Trusted Artifact Signer",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:zero_trust_workload_identity_manager:0"
],
"defaultStatus": "affected",
"packageName": "zero-trust-workload-identity-manager/spiffe-spire-agent-rhel9",
"product": "Zero Trust Workload Identity Manager - Tech Preview",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:zero_trust_workload_identity_manager:0"
],
"defaultStatus": "affected",
"packageName": "zero-trust-workload-identity-manager/spiffe-spire-oidc-discovery-provider-rhel9",
"product": "Zero Trust Workload Identity Manager - Tech Preview",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:zero_trust_workload_identity_manager:0"
],
"defaultStatus": "affected",
"packageName": "zero-trust-workload-identity-manager/spiffe-spire-server-rhel9",
"product": "Zero Trust Workload Identity Manager - Tech Preview",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:zero_trust_workload_identity_manager:0"
],
"defaultStatus": "affected",
"packageName": "zero-trust-workload-identity-manager/zero-trust-workload-identity-manager-rhel9",
"product": "Zero Trust Workload Identity Manager - Tech Preview",
"vendor": "Red Hat"
}
],
"datePublic": "2025-08-29T14:52:35.000Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Moderate"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-209",
"description": "Generation of Error Message Containing Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-01-26T19:36:28.900Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2025-11065"
},
{
"name": "RHBZ#2391829",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2391829"
},
{
"url": "https://github.com/go-viper/mapstructure/commit/742921c9ba2854d27baa64272487fc5075d2c39c"
},
{
"url": "https://github.com/go-viper/mapstructure/security/advisories/GHSA-2464-8j7c-4cjm"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-08-29T17:01:44.012814+00:00",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2025-08-29T14:52:35+00:00",
"value": "Made public."
}
],
"title": "Github.com/go-viper/mapstructure/v2: go-viper\u0027s mapstructure may leak sensitive information in logs in github.com/go-viper/mapstructure",
"workarounds": [
{
"lang": "en",
"value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."
}
],
"x_generator": {
"engine": "cvelib 1.8.0"
},
"x_redhatCweChain": "CWE-209: Generation of Error Message Containing Sensitive Information"
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2025-11065",
"datePublished": "2026-01-26T19:36:28.900Z",
"dateReserved": "2025-09-26T12:01:08.227Z",
"dateUpdated": "2026-01-26T19:36:28.900Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2025-11065\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2026-01-26T20:16:06.840\",\"lastModified\":\"2026-01-27T14:59:34.073\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"secalert@redhat.com\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.6,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"secalert@redhat.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-209\"}]}],\"references\":[{\"url\":\"https://access.redhat.com/security/cve/CVE-2025-11065\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2391829\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://github.com/go-viper/mapstructure/commit/742921c9ba2854d27baa64272487fc5075d2c39c\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://github.com/go-viper/mapstructure/security/advisories/GHSA-2464-8j7c-4cjm\",\"source\":\"secalert@redhat.com\"}]}}"
}
}
GHSA-2464-8J7C-4CJM
Vulnerability from github – Published: 2025-08-21 14:37 – Updated: 2026-01-27 21:01
VLAI?
Summary
go-viper's mapstructure May Leak Sensitive Information in Logs When Processing Malformed Data
Details
Summary
Use of this library in a security-critical context may result in leaking sensitive information, if used to process sensitive fields.
Details
OpenBao (and presumably HashiCorp Vault) have surfaced error messages from mapstructure as follows:
https://github.com/openbao/openbao/blob/98c3a59c040efca724353ca46ca79bd5cdbab920/sdk/framework/field_data.go#L43-L50
_, _, err := d.getPrimitive(field, schema)
if err != nil {
return fmt.Errorf("error converting input for field %q: %w", field, err)
}
where this calls mapstructure.WeakDecode(...): https://github.com/openbao/openbao/blob/98c3a59c040efca724353ca46ca79bd5cdbab920/sdk/framework/field_data.go#L181-L193
func (d *FieldData) getPrimitive(k string, schema *FieldSchema) (interface{}, bool, error) {
raw, ok := d.Raw[k]
if !ok {
return nil, false, nil
}
switch t := schema.Type; t {
case TypeBool:
var result bool
if err := mapstructure.WeakDecode(raw, &result); err != nil {
return nil, false, err
}
return result, true, nil
Notably, WeakDecode(...) eventually calls one of the decode helpers, which surfaces the original value via strconv helpers:
https://github.com/go-viper/mapstructure/blob/8c61ec1924fcfa522f9fc6b4618c672db61d1a38/mapstructure.go#L720-L727
https://github.com/go-viper/mapstructure/blob/8c61ec1924fcfa522f9fc6b4618c672db61d1a38/mapstructure.go#L791-L798
https://github.com/go-viper/mapstructure/blob/8c61ec1924fcfa522f9fc6b4618c672db61d1a38/decode_hooks.go#L180
& more. These are different code paths than are fixed in the previous iteration at https://github.com/go-viper/mapstructure/security/advisories/GHSA-fv92-fjc5-jj9h.
PoC
To reproduce with OpenBao:
$ podman run --pull=always -p 8300:8300 openbao/openbao:latest server -dev -dev-root-token-id=root -dev-listen-address=0.0.0.0:8300
and in a new tab:
$ BAO_TOKEN=root BAO_ADDR=http://localhost:8300 bao auth enable userpass
Success! Enabled userpass auth method at: userpass/
$ curl -X PUT -H "X-Vault-Request: true" -H "X-Vault-Token: root" -d '{"ttl":"asdf"}' "http://localhost:8200/v1/auth/userpass/users/asdf"
--> server logs:
2025-06-25T21:32:25.101-0500 [ERROR] core: failed to run existence check: error="error converting input for field \"ttl\": time: invalid duration \"asdf\""
Impact
This is an information disclosure bug with little mitigation. See https://discuss.hashicorp.com/t/hcsec-2025-09-vault-may-expose-sensitive-information-in-error-logs-when-processing-malformed-data-with-the-kv-v2-plugin/74717 for a previous version. That version was fixed, but this is in the second part of that error message (starting at '' expected a map, got 'string' -- when the field type is string and a map is provided, we see the above information leak -- the previous example had a map type field with a string value provided).
This was rated 4.5 Medium by HashiCorp in the past iteration.
Severity ?
5.3 (Medium)
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2.3.0"
},
"package": {
"ecosystem": "Go",
"name": "github.com/go-viper/mapstructure/v2"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.4.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-11065"
],
"database_specific": {
"cwe_ids": [
"CWE-117"
],
"github_reviewed": true,
"github_reviewed_at": "2025-08-21T14:37:19Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Summary\n\nUse of this library in a security-critical context may result in leaking sensitive information, if used to process sensitive fields.\n\n### Details\n\nOpenBao (and presumably HashiCorp Vault) have surfaced error messages from `mapstructure` as follows:\n\nhttps://github.com/openbao/openbao/blob/98c3a59c040efca724353ca46ca79bd5cdbab920/sdk/framework/field_data.go#L43-L50\n\n```go\n\t\t\t_, _, err := d.getPrimitive(field, schema)\n\t\t\tif err != nil {\n\t\t\t\treturn fmt.Errorf(\"error converting input for field %q: %w\", field, err)\n\t\t\t}\n```\n\nwhere this calls `mapstructure.WeakDecode(...)`: https://github.com/openbao/openbao/blob/98c3a59c040efca724353ca46ca79bd5cdbab920/sdk/framework/field_data.go#L181-L193\n\n```go\n\nfunc (d *FieldData) getPrimitive(k string, schema *FieldSchema) (interface{}, bool, error) {\n\traw, ok := d.Raw[k]\n\tif !ok {\n\t\treturn nil, false, nil\n\t}\n\n\tswitch t := schema.Type; t {\n\tcase TypeBool:\n\t\tvar result bool\n\t\tif err := mapstructure.WeakDecode(raw, \u0026result); err != nil {\n\t\t\treturn nil, false, err\n\t\t}\n\t\treturn result, true, nil\n```\n\nNotably, `WeakDecode(...)` eventually calls one of the decode helpers, which surfaces the original value via `strconv` helpers:\n\nhttps://github.com/go-viper/mapstructure/blob/8c61ec1924fcfa522f9fc6b4618c672db61d1a38/mapstructure.go#L720-L727\n\nhttps://github.com/go-viper/mapstructure/blob/8c61ec1924fcfa522f9fc6b4618c672db61d1a38/mapstructure.go#L791-L798\n\nhttps://github.com/go-viper/mapstructure/blob/8c61ec1924fcfa522f9fc6b4618c672db61d1a38/decode_hooks.go#L180\n\n\u0026 more. These are different code paths than are fixed in the previous iteration at https://github.com/go-viper/mapstructure/security/advisories/GHSA-fv92-fjc5-jj9h.\n\n### PoC\n\nTo reproduce with OpenBao:\n\n```\n$ podman run --pull=always -p 8300:8300 openbao/openbao:latest server -dev -dev-root-token-id=root -dev-listen-address=0.0.0.0:8300\n```\n\nand in a new tab:\n\n```\n$ BAO_TOKEN=root BAO_ADDR=http://localhost:8300 bao auth enable userpass\nSuccess! Enabled userpass auth method at: userpass/\n$ curl -X PUT -H \"X-Vault-Request: true\" -H \"X-Vault-Token: root\" -d \u0027{\"ttl\":\"asdf\"}\u0027 \"http://localhost:8200/v1/auth/userpass/users/asdf\"\n\n--\u003e server logs:\n\n2025-06-25T21:32:25.101-0500 [ERROR] core: failed to run existence check: error=\"error converting input for field \\\"ttl\\\": time: invalid duration \\\"asdf\\\"\"\n```\n\n### Impact\n\nThis is an information disclosure bug with little mitigation. See https://discuss.hashicorp.com/t/hcsec-2025-09-vault-may-expose-sensitive-information-in-error-logs-when-processing-malformed-data-with-the-kv-v2-plugin/74717 for a previous version. That version was fixed, but this is in the second part of that error message (starting at `\u0027\u0027 expected a map, got \u0027string\u0027` -- when the field type is `string` and a `map` is provided, we see the above information leak -- the previous example had a `map` type field with a `string` value provided).\n\nThis was rated 4.5 Medium by HashiCorp in the past iteration.",
"id": "GHSA-2464-8j7c-4cjm",
"modified": "2026-01-27T21:01:22Z",
"published": "2025-08-21T14:37:19Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/go-viper/mapstructure/security/advisories/GHSA-2464-8j7c-4cjm"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11065"
},
{
"type": "WEB",
"url": "https://github.com/go-viper/mapstructure/commit/742921c9ba2854d27baa64272487fc5075d2c39c"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2025-11065"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2391829"
},
{
"type": "PACKAGE",
"url": "https://github.com/go-viper/mapstructure"
},
{
"type": "WEB",
"url": "https://pkg.go.dev/vuln/GO-2025-3900"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "go-viper\u0027s mapstructure May Leak Sensitive Information in Logs When Processing Malformed Data"
}
GHSA-86RF-68F4-2CPH
Vulnerability from github – Published: 2026-01-26 21:30 – Updated: 2026-01-27 21:00
VLAI?
Summary
Duplicate Advisory: go-viper's mapstructure May Leak Sensitive Information in Logs When Processing Malformed Data
Details
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-2464-8j7c-4cjm. This link is maintained to preserve external references.
Original Description
A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.
Severity ?
5.3 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/go-viper/mapstructure/v2"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.4.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-117"
],
"github_reviewed": true,
"github_reviewed_at": "2026-01-27T21:00:31Z",
"nvd_published_at": "2026-01-26T20:16:06Z",
"severity": "MODERATE"
},
"details": "### Duplicate Advisory\nThis advisory has been withdrawn because it is a duplicate of GHSA-2464-8j7c-4cjm. This link is maintained to preserve external references.\n\n### Original Description\nA flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.",
"id": "GHSA-86rf-68f4-2cph",
"modified": "2026-01-27T21:00:31Z",
"published": "2026-01-26T21:30:36Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/go-viper/mapstructure/security/advisories/GHSA-2464-8j7c-4cjm"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11065"
},
{
"type": "WEB",
"url": "https://github.com/go-viper/mapstructure/commit/742921c9ba2854d27baa64272487fc5075d2c39c"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2025-11065"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2391829"
},
{
"type": "PACKAGE",
"url": "https://github.com/go-viper/mapstructure"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Duplicate Advisory: go-viper\u0027s mapstructure May Leak Sensitive Information in Logs When Processing Malformed Data",
"withdrawn": "2026-01-27T21:00:31Z"
}
OPENSUSE-SU-2025:20073-1
Vulnerability from csaf_opensuse - Published: 2025-11-20 17:26 - Updated: 2025-11-20 17:26Summary
Security update for alloy
Notes
Title of the patch
Security update for alloy
Description of the patch
This update for alloy fixes the following issues:
- CVE-2025-58058: Removed dependency on vulnerable github.com/ulikunitz/xz (bsc#1248960).
- CVE-2025-11065: Fixed sensitive information leak in logs (bsc#1250621).
Patchnames
openSUSE-Leap-16.0-47
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for alloy",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for alloy fixes the following issues:\n\n- CVE-2025-58058: Removed dependency on vulnerable github.com/ulikunitz/xz (bsc#1248960).\n- CVE-2025-11065: Fixed sensitive information leak in logs (bsc#1250621).\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-Leap-16.0-47",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2025_20073-1.json"
},
{
"category": "self",
"summary": "SUSE Bug 1248960",
"url": "https://bugzilla.suse.com/1248960"
},
{
"category": "self",
"summary": "SUSE Bug 1250621",
"url": "https://bugzilla.suse.com/1250621"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-11065 page",
"url": "https://www.suse.com/security/cve/CVE-2025-11065/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-58058 page",
"url": "https://www.suse.com/security/cve/CVE-2025-58058/"
}
],
"title": "Security update for alloy",
"tracking": {
"current_release_date": "2025-11-20T17:26:16Z",
"generator": {
"date": "2025-11-20T17:26:16Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2025:20073-1",
"initial_release_date": "2025-11-20T17:26:16Z",
"revision_history": [
{
"date": "2025-11-20T17:26:16Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "alloy-1.11.3-160000.1.1.aarch64",
"product": {
"name": "alloy-1.11.3-160000.1.1.aarch64",
"product_id": "alloy-1.11.3-160000.1.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "alloy-1.11.3-160000.1.1.ppc64le",
"product": {
"name": "alloy-1.11.3-160000.1.1.ppc64le",
"product_id": "alloy-1.11.3-160000.1.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "alloy-1.11.3-160000.1.1.s390x",
"product": {
"name": "alloy-1.11.3-160000.1.1.s390x",
"product_id": "alloy-1.11.3-160000.1.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "alloy-1.11.3-160000.1.1.x86_64",
"product": {
"name": "alloy-1.11.3-160000.1.1.x86_64",
"product_id": "alloy-1.11.3-160000.1.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Leap 16.0",
"product": {
"name": "openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0"
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "alloy-1.11.3-160000.1.1.aarch64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:alloy-1.11.3-160000.1.1.aarch64"
},
"product_reference": "alloy-1.11.3-160000.1.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "alloy-1.11.3-160000.1.1.ppc64le as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:alloy-1.11.3-160000.1.1.ppc64le"
},
"product_reference": "alloy-1.11.3-160000.1.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "alloy-1.11.3-160000.1.1.s390x as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:alloy-1.11.3-160000.1.1.s390x"
},
"product_reference": "alloy-1.11.3-160000.1.1.s390x",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "alloy-1.11.3-160000.1.1.x86_64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:alloy-1.11.3-160000.1.1.x86_64"
},
"product_reference": "alloy-1.11.3-160000.1.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 16.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-11065",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-11065"
}
],
"notes": [
{
"category": "general",
"text": "unknown",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:alloy-1.11.3-160000.1.1.aarch64",
"openSUSE Leap 16.0:alloy-1.11.3-160000.1.1.ppc64le",
"openSUSE Leap 16.0:alloy-1.11.3-160000.1.1.s390x",
"openSUSE Leap 16.0:alloy-1.11.3-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-11065",
"url": "https://www.suse.com/security/cve/CVE-2025-11065"
},
{
"category": "external",
"summary": "SUSE Bug 1250608 for CVE-2025-11065",
"url": "https://bugzilla.suse.com/1250608"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:alloy-1.11.3-160000.1.1.aarch64",
"openSUSE Leap 16.0:alloy-1.11.3-160000.1.1.ppc64le",
"openSUSE Leap 16.0:alloy-1.11.3-160000.1.1.s390x",
"openSUSE Leap 16.0:alloy-1.11.3-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:alloy-1.11.3-160000.1.1.aarch64",
"openSUSE Leap 16.0:alloy-1.11.3-160000.1.1.ppc64le",
"openSUSE Leap 16.0:alloy-1.11.3-160000.1.1.s390x",
"openSUSE Leap 16.0:alloy-1.11.3-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-11-20T17:26:16Z",
"details": "moderate"
}
],
"title": "CVE-2025-11065"
},
{
"cve": "CVE-2025-58058",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-58058"
}
],
"notes": [
{
"category": "general",
"text": "xz is a pure golang package for reading and writing xz-compressed files. Prior to version 0.5.14, it is possible to put data in front of an LZMA-encoded byte stream without detecting the situation while reading the header. This can lead to increased memory consumption because the current implementation allocates the full decoding buffer directly after reading the header. The LZMA header doesn\u0027t include a magic number or has a checksum to detect such an issue according to the specification. Note that the code recognizes the issue later while reading the stream, but at this time the memory allocation has already been done. This issue has been patched in version 0.5.14.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:alloy-1.11.3-160000.1.1.aarch64",
"openSUSE Leap 16.0:alloy-1.11.3-160000.1.1.ppc64le",
"openSUSE Leap 16.0:alloy-1.11.3-160000.1.1.s390x",
"openSUSE Leap 16.0:alloy-1.11.3-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-58058",
"url": "https://www.suse.com/security/cve/CVE-2025-58058"
},
{
"category": "external",
"summary": "SUSE Bug 1248889 for CVE-2025-58058",
"url": "https://bugzilla.suse.com/1248889"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:alloy-1.11.3-160000.1.1.aarch64",
"openSUSE Leap 16.0:alloy-1.11.3-160000.1.1.ppc64le",
"openSUSE Leap 16.0:alloy-1.11.3-160000.1.1.s390x",
"openSUSE Leap 16.0:alloy-1.11.3-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:alloy-1.11.3-160000.1.1.aarch64",
"openSUSE Leap 16.0:alloy-1.11.3-160000.1.1.ppc64le",
"openSUSE Leap 16.0:alloy-1.11.3-160000.1.1.s390x",
"openSUSE Leap 16.0:alloy-1.11.3-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-11-20T17:26:16Z",
"details": "moderate"
}
],
"title": "CVE-2025-58058"
}
]
}
OPENSUSE-SU-2025:15631-1
Vulnerability from csaf_opensuse - Published: 2025-10-14 00:00 - Updated: 2025-10-14 00:00Summary
alloy-1.11.2-2.1 on GA media
Notes
Title of the patch
alloy-1.11.2-2.1 on GA media
Description of the patch
These are all security issues fixed in the alloy-1.11.2-2.1 package on the GA media of openSUSE Tumbleweed.
Patchnames
openSUSE-Tumbleweed-2025-15631
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "alloy-1.11.2-2.1 on GA media",
"title": "Title of the patch"
},
{
"category": "description",
"text": "These are all security issues fixed in the alloy-1.11.2-2.1 package on the GA media of openSUSE Tumbleweed.",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-Tumbleweed-2025-15631",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2025_15631-1.json"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-11065 page",
"url": "https://www.suse.com/security/cve/CVE-2025-11065/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-58058 page",
"url": "https://www.suse.com/security/cve/CVE-2025-58058/"
}
],
"title": "alloy-1.11.2-2.1 on GA media",
"tracking": {
"current_release_date": "2025-10-14T00:00:00Z",
"generator": {
"date": "2025-10-14T00:00:00Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2025:15631-1",
"initial_release_date": "2025-10-14T00:00:00Z",
"revision_history": [
{
"date": "2025-10-14T00:00:00Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "alloy-1.11.2-2.1.aarch64",
"product": {
"name": "alloy-1.11.2-2.1.aarch64",
"product_id": "alloy-1.11.2-2.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "alloy-1.11.2-2.1.ppc64le",
"product": {
"name": "alloy-1.11.2-2.1.ppc64le",
"product_id": "alloy-1.11.2-2.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "alloy-1.11.2-2.1.s390x",
"product": {
"name": "alloy-1.11.2-2.1.s390x",
"product_id": "alloy-1.11.2-2.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "alloy-1.11.2-2.1.x86_64",
"product": {
"name": "alloy-1.11.2-2.1.x86_64",
"product_id": "alloy-1.11.2-2.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Tumbleweed",
"product": {
"name": "openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:tumbleweed"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "alloy-1.11.2-2.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:alloy-1.11.2-2.1.aarch64"
},
"product_reference": "alloy-1.11.2-2.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "alloy-1.11.2-2.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:alloy-1.11.2-2.1.ppc64le"
},
"product_reference": "alloy-1.11.2-2.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "alloy-1.11.2-2.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:alloy-1.11.2-2.1.s390x"
},
"product_reference": "alloy-1.11.2-2.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "alloy-1.11.2-2.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:alloy-1.11.2-2.1.x86_64"
},
"product_reference": "alloy-1.11.2-2.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-11065",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-11065"
}
],
"notes": [
{
"category": "general",
"text": "unknown",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:alloy-1.11.2-2.1.aarch64",
"openSUSE Tumbleweed:alloy-1.11.2-2.1.ppc64le",
"openSUSE Tumbleweed:alloy-1.11.2-2.1.s390x",
"openSUSE Tumbleweed:alloy-1.11.2-2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-11065",
"url": "https://www.suse.com/security/cve/CVE-2025-11065"
},
{
"category": "external",
"summary": "SUSE Bug 1250608 for CVE-2025-11065",
"url": "https://bugzilla.suse.com/1250608"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:alloy-1.11.2-2.1.aarch64",
"openSUSE Tumbleweed:alloy-1.11.2-2.1.ppc64le",
"openSUSE Tumbleweed:alloy-1.11.2-2.1.s390x",
"openSUSE Tumbleweed:alloy-1.11.2-2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:alloy-1.11.2-2.1.aarch64",
"openSUSE Tumbleweed:alloy-1.11.2-2.1.ppc64le",
"openSUSE Tumbleweed:alloy-1.11.2-2.1.s390x",
"openSUSE Tumbleweed:alloy-1.11.2-2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-10-14T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2025-11065"
},
{
"cve": "CVE-2025-58058",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-58058"
}
],
"notes": [
{
"category": "general",
"text": "xz is a pure golang package for reading and writing xz-compressed files. Prior to version 0.5.14, it is possible to put data in front of an LZMA-encoded byte stream without detecting the situation while reading the header. This can lead to increased memory consumption because the current implementation allocates the full decoding buffer directly after reading the header. The LZMA header doesn\u0027t include a magic number or has a checksum to detect such an issue according to the specification. Note that the code recognizes the issue later while reading the stream, but at this time the memory allocation has already been done. This issue has been patched in version 0.5.14.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:alloy-1.11.2-2.1.aarch64",
"openSUSE Tumbleweed:alloy-1.11.2-2.1.ppc64le",
"openSUSE Tumbleweed:alloy-1.11.2-2.1.s390x",
"openSUSE Tumbleweed:alloy-1.11.2-2.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-58058",
"url": "https://www.suse.com/security/cve/CVE-2025-58058"
},
{
"category": "external",
"summary": "SUSE Bug 1248889 for CVE-2025-58058",
"url": "https://bugzilla.suse.com/1248889"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:alloy-1.11.2-2.1.aarch64",
"openSUSE Tumbleweed:alloy-1.11.2-2.1.ppc64le",
"openSUSE Tumbleweed:alloy-1.11.2-2.1.s390x",
"openSUSE Tumbleweed:alloy-1.11.2-2.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:alloy-1.11.2-2.1.aarch64",
"openSUSE Tumbleweed:alloy-1.11.2-2.1.ppc64le",
"openSUSE Tumbleweed:alloy-1.11.2-2.1.s390x",
"openSUSE Tumbleweed:alloy-1.11.2-2.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-10-14T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2025-58058"
}
]
}
OPENSUSE-SU-2025:15724-1
Vulnerability from csaf_opensuse - Published: 2025-11-10 00:00 - Updated: 2025-11-10 00:00Summary
trivy-0.67.2-1.1 on GA media
Notes
Title of the patch
trivy-0.67.2-1.1 on GA media
Description of the patch
These are all security issues fixed in the trivy-0.67.2-1.1 package on the GA media of openSUSE Tumbleweed.
Patchnames
openSUSE-Tumbleweed-2025-15724
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "trivy-0.67.2-1.1 on GA media",
"title": "Title of the patch"
},
{
"category": "description",
"text": "These are all security issues fixed in the trivy-0.67.2-1.1 package on the GA media of openSUSE Tumbleweed.",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-Tumbleweed-2025-15724",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2025_15724-1.json"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-11065 page",
"url": "https://www.suse.com/security/cve/CVE-2025-11065/"
}
],
"title": "trivy-0.67.2-1.1 on GA media",
"tracking": {
"current_release_date": "2025-11-10T00:00:00Z",
"generator": {
"date": "2025-11-10T00:00:00Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2025:15724-1",
"initial_release_date": "2025-11-10T00:00:00Z",
"revision_history": [
{
"date": "2025-11-10T00:00:00Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "trivy-0.67.2-1.1.aarch64",
"product": {
"name": "trivy-0.67.2-1.1.aarch64",
"product_id": "trivy-0.67.2-1.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "trivy-0.67.2-1.1.ppc64le",
"product": {
"name": "trivy-0.67.2-1.1.ppc64le",
"product_id": "trivy-0.67.2-1.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "trivy-0.67.2-1.1.s390x",
"product": {
"name": "trivy-0.67.2-1.1.s390x",
"product_id": "trivy-0.67.2-1.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "trivy-0.67.2-1.1.x86_64",
"product": {
"name": "trivy-0.67.2-1.1.x86_64",
"product_id": "trivy-0.67.2-1.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Tumbleweed",
"product": {
"name": "openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:tumbleweed"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "trivy-0.67.2-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:trivy-0.67.2-1.1.aarch64"
},
"product_reference": "trivy-0.67.2-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "trivy-0.67.2-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:trivy-0.67.2-1.1.ppc64le"
},
"product_reference": "trivy-0.67.2-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "trivy-0.67.2-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:trivy-0.67.2-1.1.s390x"
},
"product_reference": "trivy-0.67.2-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "trivy-0.67.2-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:trivy-0.67.2-1.1.x86_64"
},
"product_reference": "trivy-0.67.2-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-11065",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-11065"
}
],
"notes": [
{
"category": "general",
"text": "unknown",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:trivy-0.67.2-1.1.aarch64",
"openSUSE Tumbleweed:trivy-0.67.2-1.1.ppc64le",
"openSUSE Tumbleweed:trivy-0.67.2-1.1.s390x",
"openSUSE Tumbleweed:trivy-0.67.2-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-11065",
"url": "https://www.suse.com/security/cve/CVE-2025-11065"
},
{
"category": "external",
"summary": "SUSE Bug 1250608 for CVE-2025-11065",
"url": "https://bugzilla.suse.com/1250608"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:trivy-0.67.2-1.1.aarch64",
"openSUSE Tumbleweed:trivy-0.67.2-1.1.ppc64le",
"openSUSE Tumbleweed:trivy-0.67.2-1.1.s390x",
"openSUSE Tumbleweed:trivy-0.67.2-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:trivy-0.67.2-1.1.aarch64",
"openSUSE Tumbleweed:trivy-0.67.2-1.1.ppc64le",
"openSUSE Tumbleweed:trivy-0.67.2-1.1.s390x",
"openSUSE Tumbleweed:trivy-0.67.2-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-11-10T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2025-11065"
}
]
}
OPENSUSE-SU-2025:15610-1
Vulnerability from csaf_opensuse - Published: 2025-10-08 00:00 - Updated: 2025-10-08 00:00Summary
grafana-11.6.6-1.1 on GA media
Notes
Title of the patch
grafana-11.6.6-1.1 on GA media
Description of the patch
These are all security issues fixed in the grafana-11.6.6-1.1 package on the GA media of openSUSE Tumbleweed.
Patchnames
openSUSE-Tumbleweed-2025-15610
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "grafana-11.6.6-1.1 on GA media",
"title": "Title of the patch"
},
{
"category": "description",
"text": "These are all security issues fixed in the grafana-11.6.6-1.1 package on the GA media of openSUSE Tumbleweed.",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-Tumbleweed-2025-15610",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2025_15610-1.json"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-11065 page",
"url": "https://www.suse.com/security/cve/CVE-2025-11065/"
}
],
"title": "grafana-11.6.6-1.1 on GA media",
"tracking": {
"current_release_date": "2025-10-08T00:00:00Z",
"generator": {
"date": "2025-10-08T00:00:00Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2025:15610-1",
"initial_release_date": "2025-10-08T00:00:00Z",
"revision_history": [
{
"date": "2025-10-08T00:00:00Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "grafana-11.6.6-1.1.aarch64",
"product": {
"name": "grafana-11.6.6-1.1.aarch64",
"product_id": "grafana-11.6.6-1.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "grafana-11.6.6-1.1.ppc64le",
"product": {
"name": "grafana-11.6.6-1.1.ppc64le",
"product_id": "grafana-11.6.6-1.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "grafana-11.6.6-1.1.s390x",
"product": {
"name": "grafana-11.6.6-1.1.s390x",
"product_id": "grafana-11.6.6-1.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "grafana-11.6.6-1.1.x86_64",
"product": {
"name": "grafana-11.6.6-1.1.x86_64",
"product_id": "grafana-11.6.6-1.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Tumbleweed",
"product": {
"name": "openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:tumbleweed"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-11.6.6-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:grafana-11.6.6-1.1.aarch64"
},
"product_reference": "grafana-11.6.6-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-11.6.6-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:grafana-11.6.6-1.1.ppc64le"
},
"product_reference": "grafana-11.6.6-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-11.6.6-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:grafana-11.6.6-1.1.s390x"
},
"product_reference": "grafana-11.6.6-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-11.6.6-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:grafana-11.6.6-1.1.x86_64"
},
"product_reference": "grafana-11.6.6-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-11065",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-11065"
}
],
"notes": [
{
"category": "general",
"text": "unknown",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:grafana-11.6.6-1.1.aarch64",
"openSUSE Tumbleweed:grafana-11.6.6-1.1.ppc64le",
"openSUSE Tumbleweed:grafana-11.6.6-1.1.s390x",
"openSUSE Tumbleweed:grafana-11.6.6-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-11065",
"url": "https://www.suse.com/security/cve/CVE-2025-11065"
},
{
"category": "external",
"summary": "SUSE Bug 1250608 for CVE-2025-11065",
"url": "https://bugzilla.suse.com/1250608"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:grafana-11.6.6-1.1.aarch64",
"openSUSE Tumbleweed:grafana-11.6.6-1.1.ppc64le",
"openSUSE Tumbleweed:grafana-11.6.6-1.1.s390x",
"openSUSE Tumbleweed:grafana-11.6.6-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:grafana-11.6.6-1.1.aarch64",
"openSUSE Tumbleweed:grafana-11.6.6-1.1.ppc64le",
"openSUSE Tumbleweed:grafana-11.6.6-1.1.s390x",
"openSUSE Tumbleweed:grafana-11.6.6-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-10-08T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2025-11065"
}
]
}
OPENSUSE-SU-2025:20117-1
Vulnerability from csaf_opensuse - Published: 2025-11-27 12:27 - Updated: 2025-11-27 12:27Summary
Security update for trivy
Notes
Title of the patch
Security update for trivy
Description of the patch
This update for trivy fixes the following issues:
Changes in trivy:
Update to version 0.67.2 (bsc#1250625, CVE-2025-11065, bsc#1248897, CVE-2025-58058):
* fix: Use `fetch-level: 1` to check out trivy-repo in the release workflow [backport: release/v0.67] (#9638)
* fix: restore compatibility for google.protobuf.Value [backport: release/v0.67] (#9631)
* fix: using SrcVersion instead of Version for echo detector [backport: release/v0.67] (#9629)
* fix: add `buildInfo` for `BlobInfo` in `rpc` package [backport: release/v0.67] (#9615)
* fix(vex): don't use reused BOM [backport: release/v0.67] (#9612)
* fix(vex): don't suppress vulns for packages with infinity loop (#9465)
* fix(aws): use `BuildableClient` insead of `xhttp.Client` (#9436)
* refactor(misconf): replace github.com/liamg/memoryfs with internal mapfs and testing/fstest (#9282)
* docs: clarify inline ignore limitations for resource-less checks (#9537)
* fix(k8s): disable parallel traversal with fs cache for k8s images (#9534)
* fix(misconf): handle tofu files in module detection (#9486)
* feat(seal): add seal support (#9370)
* docs: fix modules path and update code example (#9539)
* fix: close file descriptors and pipes on error paths (#9536)
* feat: add documentation URL for database lock errors (#9531)
* fix(db): Dowload database when missing but metadata still exists (#9393)
* feat(cloudformation): support default values and list results in Fn::FindInMap (#9515)
* fix(misconf): unmark cty values before access (#9495)
* feat(cli): change --list-all-pkgs default to true (#9510)
* fix(nodejs): parse workspaces as objects for package-lock.json files (#9518)
* refactor(fs): use underlyingPath to determine virtual files more reliably (#9302)
* refactor: remove google/wire dependency and implement manual DI (#9509)
* chore(deps): bump the aws group with 6 updates (#9481)
* chore(deps): bump the common group across 1 directory with 24 updates (#9507)
* fix(misconf): wrap legacy ENV values in quotes to preserve spaces (#9497)
* docs: move info about `detection priority` into coverage section (#9469)
* feat(sbom): added support for CoreOS (#9448)
* fix(misconf): strip build metadata suffixes from image history (#9498)
* feat(cyclonedx): preserve SBOM structure when scanning SBOM files with vulnerability updates (#9439)
* docs: Fix typo in terraform docs (#9492)
* feat(redhat): add os-release detection for RHEL-based images (#9458)
* ci(deps): add 3-day cooldown period for Dependabot updates (#9475)
* refactor: migrate from go-json-experiment to encoding/json/v2 (#9422)
* fix(vuln): compare `nuget` package names in lower case (#9456)
* chore: Update release flow to include chocolatey (#9460)
* docs: document eol supportability (#9434)
* docs(report): add nuanses about secret/license scanner in summary table (#9442)
* ci: use environment variables in GitHub Actions for improved security (#9433)
* chore: bump Go to 1.24.7 (#9435)
* fix(nodejs): use snapshot string as `Package.ID` for pnpm packages (#9330)
* ci(helm): bump Trivy version to 0.66.0 for Trivy Helm Chart 0.18.0 (#9425)
Update to version 0.66.0 (bsc#1248937, CVE-2025-58058):
* chore(deps): bump the aws group with 7 updates (#9419)
* refactor(secret): clarify secret scanner messages (#9409)
* fix(cyclonedx): handle multiple license types (#9378)
* fix(repo): sanitize git repo URL before inserting into report metadata (#9391)
* test: add HTTP basic authentication to git test server (#9407)
* fix(sbom): add support for `file` component type of `CycloneDX` (#9372)
* fix(misconf): ensure module source is known (#9404)
* ci: migrate GitHub Actions from version tags to SHA pinning (#9405)
* fix: create temp file under composite fs dir (#9387)
* chore(deps): bump github.com/ulikunitz/xz from 0.5.12 to 0.5.14 (#9403)
* refactor: switch to stable azcontainerregistry SDK package (#9319)
* chore(deps): bump the common group with 7 updates (#9382)
* refactor(misconf): migrate from custom Azure JSON parser (#9222)
* fix(repo): preserve RepoMetadata on FS cache hit (#9389)
* refactor(misconf): use atomic.Int32 (#9385)
* chore(deps): bump the aws group with 6 updates (#9383)
* docs: Fix broken link to "Built-in Checks" (#9375)
* fix(plugin): don't remove plugins when updating index.yaml file (#9358)
* fix: persistent flag option typo (#9374)
* chore(deps): bump the common group across 1 directory with 26 updates (#9347)
* fix(image): use standardized HTTP client for ECR authentication (#9322)
* refactor: export `systemFileFiltering` Post Handler (#9359)
* docs: update links to Semaphore pages (#9352)
* fix(conda): memory leak by adding closure method for `package.json` file (#9349)
* feat: add timeout handling for cache database operations (#9307)
* fix(misconf): use correct field log_bucket instead of target_bucket in gcp bucket (#9296)
* fix(misconf): ensure ignore rules respect subdirectory chart paths (#9324)
* chore(deps): bump alpine from 3.21.4 to 3.22.1 (#9301)
* feat(terraform): use .terraform cache for remote modules in plan scanning (#9277)
* chore: fix some function names in comment (#9314)
* chore(deps): bump the aws group with 7 updates (#9311)
* docs: add explanation for how to use non-system certificates (#9081)
* chore(deps): bump the github-actions group across 1 directory with 2 updates (#8962)
* fix(misconf): preserve original paths of remote submodules from .terraform (#9294)
* refactor(terraform): make Scan method of Terraform plan scanner private (#9272)
* fix: suppress debug log for context cancellation errors (#9298)
* feat(secret): implement streaming secret scanner with byte offset tracking (#9264)
* fix(python): impove package name normalization (#9290)
* feat(misconf): added audit config attribute (#9249)
* refactor(misconf): decouple input fs and track extracted files with fs references (#9281)
* test(misconf): remove BenchmarkCalculate using outdated check metadata (#9291)
* refactor: simplify Detect function signature (#9280)
* ci(helm): bump Trivy version to 0.65.0 for Trivy Helm Chart 0.17.0 (#9288)
* fix(fs): avoid shadowing errors in file.glob (#9286)
* test(misconf): move terraform scan tests to integration tests (#9271)
* test(misconf): drop gcp iam test covered by another case (#9285)
* chore(deps): bump to alpine from `3.21.3` to `3.21.4` (#9283)
Update to version 0.65.0:
* fix(cli): ensure correct command is picked by telemetry (#9260)
* feat(flag): add schema validation for `--server` flag (#9270)
* chore(deps): bump github.com/docker/docker from 28.3.2+incompatible to 28.3.3+incompatible (#9274)
* ci: skip undefined labels in discussion triage action (#9175)
* feat(repo): add git repository metadata to reports (#9252)
* fix(license): handle WITH operator for `LaxSplitLicenses` (#9232)
* chore: add modernize tool integration for code modernization (#9251)
* fix(secret): add UTF-8 validation in secret scanner to prevent protobuf marshalling errors (#9253)
* chore: implement process-safe temp file cleanup (#9241)
* fix: prevent graceful shutdown message on normal exit (#9244)
* fix(misconf): correctly parse empty port ranges in google_compute_firewall (#9237)
* feat: add graceful shutdown with signal handling (#9242)
* chore: update template URL for brew formula (#9221)
* test: add end-to-end testing framework with image scan and proxy tests (#9231)
* refactor(db): use `Getter` interface with `GetParams` for trivy-db sources (#9239)
* ci: specify repository for `gh cache delete` in canary worklfow (#9240)
* ci: remove invalid `--confirm` flag from `gh cache delete` command in canary builds (#9236)
* fix(misconf): fix log bucket in schema (#9235)
* chore(deps): bump the common group across 1 directory with 24 updates (#9228)
* ci: move runner.os context from job-level env to step-level in canary workflow (#9233)
* chore(deps): bump up Trivy-kubernetes to v0.9.1 (#9214)
* feat(misconf): added logging and versioning to the gcp storage bucket (#9226)
* fix(server): add HTTP transport setup to server mode (#9217)
* chore: update the rpm download Update (#9202)
* feat(alma): add AlmaLinux 10 support (#9207)
* fix(nodejs): don't use prerelease logic for compare npm constraints (#9208)
* fix(rootio): fix severity selection (#9181)
* fix(sbom): merge in-graph and out-of-graph OS packages in scan results (#9194)
* fix(cli): panic: attempt to get os.Args[1] when len(os.Args) < 2 (#9206)
* fix(misconf): correctly adapt azure storage account (#9138)
* feat(misconf): add private ip google access attribute to subnetwork (#9199)
* feat(report): add CVSS vectors in sarif report (#9157)
* fix(terraform): `for_each` on a map returns a resource for every key (#9156)
* fix: supporting .egg-info/METADATA in python.Packaging analyzer (#9151)
* chore: migrate protoc setup from Docker to buf CLI (#9184)
* ci: delete cache after artifacts upload in canary workflow (#9177)
* refactor: remove aws flag helper message (#9080)
* ci: use gh pr view to get PR number for forked repositories in auto-ready workflow (#9183)
* ci: add auto-ready-for-review workflow (#9179)
* feat(image): add Docker context resolution (#9166)
* ci: optimize golangci-lint performance with cache-based strategy (#9173)
* feat: add HTTP request/response tracing support (#9125)
* fix(aws): update amazon linux 2 EOL date (#9176)
* chore: Update release workflow to trigger version updates (#9162)
* chore(deps): bump helm.sh/helm/v3 from 3.18.3 to 3.18.4 (#9164)
* fix: also check `filepath` when removing duplicate packages (#9142)
* chore: add debug log to show image source location (#9163)
* docs: add section on customizing default check data (#9114)
* chore(deps): bump the common group across 1 directory with 9 updates (#9153)
* docs: partners page content updates (#9149)
* chore(license): add missed spdx exceptions: (#9147)
* docs: trivy partners page updates (#9133)
* fix: migrate from `*.list` to `*.md5sums` files for `dpkg` (#9131)
* ci(helm): bump Trivy version to 0.64.1 for Trivy Helm Chart 0.16.1 (#9135)
* feat(sbom): add SHA-512 hash support for CycloneDX SBOM (#9126)
* fix(misconf): skip rewriting expr if attr is nil (#9113)
* fix(license): add missed `GFDL-NIV-1.1` and `GFDL-NIV-1.2` into Trivy mapping (#9116)
* fix(cli): Add more non-sensitive flags to telemetry (#9110)
* fix(alma): parse epochs from rpmqa file (#9101)
* fix(rootio): check full version to detect `root.io` packages (#9117)
* chore: drop FreeBSD 32-bit support (#9102)
* fix(sbom): use correct field for licenses in CycloneDX reports (#9057)
* fix(secret): fix line numbers for multiple-line secrets (#9104)
* feat(license): observe pkg types option in license scanner (#9091)
* ci(helm): bump Trivy version to 0.64.0 for Trivy Helm Chart 0.16.0 (#9107)
- (CVE-2025-53547, bsc#1246151)
- Update to version 0.64.1 (bsc#1243633, CVE-2025-47291,
(bsc#1246730, CVE-2025-46569):
* fix(misconf): skip rewriting expr if attr is nil [backport: release/v0.64] (#9127)
* fix(cli): Add more non-sensitive flags to telemetry [backport: release/v0.64] (#9124)
* fix(rootio): check full version to detect `root.io` packages [backport: release/v0.64] (#9120)
* fix(alma): parse epochs from rpmqa file [backport: release/v0.64] (#9119)
* docs(python): fix type with METADATA file name (#9090)
* feat: reject unsupported artifact types in remote image retrieval (#9052)
* chore(deps): bump github.com/go-viper/mapstructure/v2 from 2.2.1 to 2.3.0 (#9088)
* refactor(misconf): rewrite Rego module filtering using functional filters (#9061)
* feat(terraform): add partial evaluation for policy templates (#8967)
* feat(vuln): add Root.io support for container image scanning (#9073)
* feat(sbom): add manufacturer field to CycloneDX tools metadata (#9019)
* fix(cli): add some values to the telemetry call (#9056)
* feat(ubuntu): add end of life date for Ubuntu 25.04 (#9077)
* refactor: centralize HTTP transport configuration (#9058)
* test: include integration tests in linting and fix all issues (#9060)
* chore(deps): bump the common group across 1 directory with 26 updates (#9063)
* feat(java): dereference all maven settings.xml env placeholders (#9024)
* fix(misconf): reduce log noise on incompatible check (#9029)
* fix(misconf): .Config.User always takes precedence over USER in .History (#9050)
* chore(deps): update Docker to v28.2.2 and fix compatibility issues (#9037)
* docs(misconf): simplify misconfiguration docs (#9030)
* fix(misconf): move disabled checks filtering after analyzer scan (#9002)
* docs: add PR review policy for maintainers (#9032)
* fix(sbom): remove unnecessary OS detection check in SBOM decoding (#9034)
* test: improve and extend tests for iac/adapters/arm (#9028)
* chore: bump up Go version to 1.24.4 (#9031)
* feat(cli): add version constraints to annoucements (#9023)
* fix(misconf): correct Azure value-to-time conversion in AsTimeValue (#9015)
* feat(ubuntu): add eol date for 20.04-ESM (#8981)
* fix(report): don't panic when report contains vulns, but doesn't contain packages for `table` format (#8549)
* fix(nodejs): correctly parse `packages` array of `bun.lock` file (#8998)
* refactor: use strings.SplitSeq instead of strings.Split in for-loop (#8983)
* docs: change --disable-metrics to --disable-telemetry in example (#8999) (#9003)
* feat(misconf): add OpenTofu file extension support (#8747)
* refactor(misconf): set Trivy version by default in Rego scanner (#9001)
* docs: fix assets with versioning (#8996)
* docs: add partners page (#8988)
* chore(alpine): add EOL date for Alpine 3.22 (#8992)
* fix: don't show corrupted trivy-db warning for first run (#8991)
* Update installation.md (#8979)
* feat(misconf): normalize CreatedBy for buildah and legacy docker builder (#8953)
* chore(k8s): update comments with deprecated command format (#8964)
* chore: fix errors and typos in docs (#8963)
* fix: Add missing version check flags (#8951)
* feat(redhat): Add EOL date for RHEL 10. (#8910)
* fix: Correctly check for semver versions for trivy version check (#8948)
* refactor(server): change custom advisory and vulnerability data types fr… (#8923)
* ci(helm): bump Trivy version to 0.63.0 for Trivy Helm Chart 0.15.0 (#8946)
* fix(misconf): use argument value in WithIncludeDeprecatedChecks (#8942)
* chore(deps): Bump trivy-checks (#8934)
* fix(julia): add `Relationship` field support (#8939)
* feat(minimos): Add support for MinimOS (#8792)
* feat(alpine): add maintainer field extraction for APK packages (#8930)
* feat(echo): Add Echo Support (#8833)
* fix(redhat): Also try to find buildinfo in root layer (layer 0) (#8924)
* fix(wolfi): support new APK database location (#8937)
* feat(k8s): get components from namespaced resources (#8918)
* refactor(cloudformation): remove unused ScanFile method from Scanner (#8927)
* refactor(terraform): remove result sorting from scanner (#8928)
* feat(misconf): Add support for `Minimum Trivy Version` (#8880)
* docs: improve skipping files documentation (#8749)
* feat(cli): Add available version checking (#8553)
* feat(nodejs): add a bun.lock analyzer (#8897)
* feat: terraform parser option to set current working directory (#8909)
* perf(secret): only match secrets of meaningful length, allow example strings to not be matched (#8602)
* feat(misconf): export raw Terraform data to Rego (#8741)
* refactor(terraform): simplify AllReferences method signature in Attribute (#8906)
* fix: check post-analyzers for StaticPaths (#8904)
* feat: add Bottlerocket OS package analyzer (#8653)
* feat(license): improve work text licenses with custom classification (#8888)
* chore(deps): bump github.com/containerd/containerd/v2 from 2.1.0 to 2.1.1 (#8901)
* chore(deps): bump the common group across 1 directory with 9 updates (#8887)
* refactor(license): simplify compound license scanning (#8896)
* feat(license): Support compound licenses (licenses using SPDX operators) (#8816)
* fix(k8s): use in-memory cache backend during misconfig scanning (#8873)
* feat(nodejs): add bun.lock parser (#8851)
* feat(license): improve work with custom classification of licenses from config file (#8861)
* fix(cli): disable `--skip-dir` and `--skip-files` flags for `sbom` command (#8886)
* fix: julia parser panicing (#8883)
* refactor(db): change logic to detect wrong DB (#8864)
* fix(cli): don't use allow values for `--compliance` flag (#8881)
* docs(misconf): Reorganize misconfiguration scan pages (#8206)
* fix(server): add missed Relationship field for `rpc` (#8872)
* feat: add JSONC support for comments and trailing commas (#8862)
* fix(vex): use `lo.IsNil` to check `VEX` from OCI artifact (#8858)
* feat(go): support license scanning in both GOPATH and vendor (#8843)
* fix(redhat): save contentSets for OS packages in fs/vm modes (#8820)
* fix: filter all files when processing files installed from package managers (#8842)
* feat(misconf): add misconfiguration location to junit template (#8793)
* docs(vuln): remove OSV for Python from data sources (#8841)
* chore: add an issue template for maintainers (#8838)
* chore: enable staticcheck (#8815)
* ci(helm): bump Trivy version to 0.62.1 for Trivy Helm Chart 0.14.1 (#8836)
* feat(license): scan vendor directory for license for go.mod files (#8689)
* docs(java): Update info about dev deps in gradle lock (#8830)
* chore(deps): bump golang.org/x/sync from 0.13.0 to 0.14.0 in the common group (#8822)
* fix(java): exclude dev dependencies in gradle lockfile (#8803)
* fix: octalLiteral from go-critic (#8811)
* fix(redhat): trim invalid suffix from content_sets in manifest parsing (#8818)
* chore(deps): bump the common group across 1 directory with 10 updates (#8817)
* fix: use-any from revive (#8810)
* fix: more revive rules (#8814)
* docs: change in java.md: fix the Trity -to-> Trivy typo (#8813)
* fix(misconf): check if for-each is known when expanding dyn block (#8808)
* ci(helm): bump Trivy version to 0.62.0 for Trivy Helm Chart 0.14.0 (#8802)
- Update to version 0.62.1 (bsc#1239225, CVE-2025-22868,
bsc#1241724, CVE-2025-22872):
* chore(deps): bump the common group across 1 directory with 10 updates [backport: release/v0.62] (#8831)
* fix(misconf): check if for-each is known when expanding dyn block [backport: release/v0.62] (#8826)
* fix(redhat): trim invalid suffix from content_sets in manifest parsing [backport: release/v0.62] (#8824)
* feat(nodejs): add root and workspace for `yarn` packages (#8535)
* fix: unused-parameter rule from revive (#8794)
* chore(deps): Update trivy-checks (#8798)
* fix: early-return, indent-error-flow and superfluous-else rules from revive (#8796)
* fix(k8s): remove using `last-applied-configuration` (#8791)
* refactor(misconf): remove unused methods from providers (#8781)
* refactor(misconf): remove unused methods from iac types (#8782)
* fix(misconf): filter null nodes when parsing json manifest (#8785)
* fix: testifylint last issues (#8768)
* fix(misconf): perform operations on attribute safely (#8774)
* refactor(ubuntu): update time handling for fixing time (#8780)
* chore(deps): bump golangci-lint to v2.1.2 (#8766)
* feat(image): save layers metadata into report (#8394)
* feat(misconf): convert AWS managed policy to document (#8757)
* chore(deps): bump the docker group across 1 directory with 3 updates (#8762)
* ci(helm): bump Trivy version to 0.61.1 for Trivy Helm Chart 0.13.1 (#8753)
* ci(helm): create a helm branch for patches from main (#8673)
* fix(terraform): hcl object expressions to return references (#8271)
* chore(terraform): option to pass in instanced logger (#8738)
* ci: use `Skitionek/notify-microsoft-teams` instead of `aquasecurity` fork (#8740)
* chore(terraform): remove os.OpenPath call from terraform file functions (#8737)
* chore(deps): bump the common group across 1 directory with 23 updates (#8733)
* feat(rust): add root and workspace relationships/package for `cargo` lock files (#8676)
* refactor(misconf): remove module outputs from parser.EvaluateAll (#8587)
* fix(misconf): populate context correctly for module instances (#8656)
* fix(misconf): check if metadata is not nil (#8647)
* refactor(misconf): switch to x/json (#8719)
* fix(report): clean buffer after flushing (#8725)
* ci: improve PR title validation workflow (#8720)
* refactor(flag): improve flag system architecture and extensibility (#8718)
* fix(terraform): `evaluateStep` to correctly set `EvalContext` for multiple instances of blocks (#8555)
* refactor: migrate from `github.com/aquasecurity/jfather` to `github.com/go-json-experiment/json` (#8591)
* feat(misconf): support auto_provisioning_defaults in google_container_cluster (#8705)
* ci: use `github.event.pull_request.user.login` for release PR check workflow (#8702)
* refactor: add hook interface for extended functionality (#8585)
* fix(misconf): add missing variable as unknown (#8683)
* docs: Update maintainer docs (#8674)
* ci(vuln): reduce github action script injection attack risk (#8610)
* fix(secret): ignore .dist-info directories during secret scanning (#8646)
* fix(server): fix redis key when trying to delete blob (#8649)
* chore(deps): bump the testcontainers group with 2 updates (#8650)
* test: use `aquasecurity` repository for test images (#8677)
* chore(deps): bump the aws group across 1 directory with 5 updates (#8652)
* fix(k8s): skip passed misconfigs for the summary report (#8684)
* fix(k8s): correct compare artifact versions (#8682)
* chore: update Docker lib (#8681)
* refactor(misconf): remove unused terraform attribute methods (#8657)
* feat(misconf): add option to pass Rego scanner to IaC scanner (#8369)
* chore: typo fix to replace `rego` with `repo` on the RepoFlagGroup options error output (#8643)
* docs: Add info about helm charts release (#8640)
* ci(helm): bump Trivy version to 0.61.0 for Trivy Helm Chart 0.13.0 (#8638)
Update to version 0.61.1 (bsc#1239385, CVE-2025-22869, bsc#1240466, CVE-2025-30204):
* fix(k8s): skip passed misconfigs for the summary report [backport: release/v0.61] (#8748)
* fix(k8s): correct compare artifact versions [backport: release/v0.61] (#8699)
* test: use `aquasecurity` repository for test images [backport: release/v0.61] (#8698)
* fix(misconf): Improve logging for unsupported checks (#8634)
* feat(k8s): add support for controllers (#8614)
* fix(debian): don't include empty licenses for `dpkgs` (#8623)
* fix(misconf): Check values wholly prior to evalution (#8604)
* chore(deps): Bump trivy-checks (#8619)
* fix(k8s): show report for `--report all` (#8613)
* chore(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.1 to 4.5.2 (#8597)
* refactor: rename scanner to service (#8584)
* fix(misconf): do not skip loading documents from subdirectories (#8526)
* refactor(misconf): get a block or attribute without calling HasChild (#8586)
* fix(misconf): identify the chart file exactly by name (#8590)
* test: use table-driven tests in Helm scanner tests (#8592)
* refactor(misconf): Simplify misconfig checks bundle parsing (#8533)
* chore(deps): bump the common group across 1 directory with 10 updates (#8566)
* fix(misconf): do not use cty.NilVal for non-nil values (#8567)
* docs(cli): improve flag value display format (#8560)
* fix(misconf): set default values for AWS::EKS::Cluster.ResourcesVpcConfig (#8548)
* docs: remove slack (#8565)
* fix: use `--file-patterns` flag for all post analyzers (#7365)
* docs(python): Mention pip-compile (#8484)
* feat(misconf): adapt aws_opensearch_domain (#8550)
* feat(misconf): adapt AWS::EC2::VPC (#8534)
* docs: fix a broken link (#8546)
* fix(fs): check postAnalyzers for StaticPaths (#8543)
* refactor(misconf): remove unused methods for ec2.Instance (#8536)
* feat(misconf): adapt aws_default_security_group (#8538)
* feat(fs): optimize scanning performance by direct file access for known paths (#8525)
* feat(misconf): adapt AWS::DynamoDB::Table (#8529)
* style: Fix MD syntax in self-hosting.md (#8523)
* perf(misconf): retrieve check metadata from annotations once (#8478)
* feat(misconf): Add support for aws_ami (#8499)
* fix(misconf): skip Azure CreateUiDefinition (#8503)
* refactor(misconf): use OPA v1 (#8518)
* fix(misconf): add ephemeral block type to config schema (#8513)
* perf(misconf): parse input for Rego once (#8483)
* feat: replace TinyGo with standard Go for WebAssembly modules (#8496)
* chore: replace deprecated tenv linter with usetesting (#8504)
* fix(spdx): save text licenses into `otherLicenses` without normalize (#8502)
* chore(deps): bump the common group across 1 directory with 13 updates (#8491)
* chore: use go.mod for managing Go tools (#8493)
* ci(helm): bump Trivy version to 0.60.0 for Trivy Helm Chart 0.12.0 (#8494)
* fix(sbom): improve logic for binding direct dependency to parent component (#8489)
* chore(deps): remove missed replace of `trivy-db` (#8492)
* chore(deps): bump alpine from 3.21.0 to 3.21.3 in the docker group across 1 directory (#8490)
* chore(deps): update Go to 1.24 and switch to go-version-file (#8388)
* docs: add abbreviation list (#8453)
* chore(terraform): assign *terraform.Module 'parent' field (#8444)
* feat: add report summary table (#8177)
* chore(deps): bump the github-actions group with 3 updates (#8473)
* refactor(vex): improve SBOM reference handling with project standards (#8457)
* ci: update GitHub Actions cache to v4 (#8475)
* feat: add `--vuln-severity-source` flag (#8269)
* fix(os): add mapping OS aliases (#8466)
* chore(deps): bump the aws group across 1 directory with 7 updates (#8468)
* chore(deps): Bump trivy-checks to v1.7.1 (#8467)
* refactor(report): write tables after rendering all results (#8357)
* docs: update VEX documentation index page (#8458)
* fix(db): fix case when 2 trivy-db were copied at the same time (#8452)
* feat(misconf): render causes for Terraform (#8360)
* fix(misconf): fix incorrect k8s locations due to JSON to YAML conversion (#8073)
* feat(cyclonedx): Add initial support for loading external VEX files from SBOM references (#8254)
* chore(deps): update go-rustaudit location (#8450)
* fix: update all documentation links (#8045)
* chore(deps): bump github.com/go-jose/go-jose/v4 from 4.0.4 to 4.0.5 (#8443)
* chore(deps): bump the common group with 6 updates (#8411)
* fix(k8s): add missed option `PkgRelationships` (#8442)
* fix(sbom): add SBOM file's filePath as Application FilePath if we can't detect its path (#8346)
* feat(go): fix parsing main module version for go >= 1.24 (#8433)
* refactor(misconf): make Rego scanner independent of config type (#7517)
* fix(image): disable AVD-DS-0007 for history scanning (#8366)
* fix(server): secrets inspectation for the config analyzer in client server mode (#8418)
* chore: remove mockery (#8417)
* test(server): replace mock driver with memory cache in server tests (#8416)
* test: replace mock with memory cache and fix non-deterministic tests (#8410)
* test: replace mock with memory cache in scanner tests (#8413)
* test: use memory cache (#8403)
* fix(spdx): init `pkgFilePaths` map for all formats (#8380)
* chore(deps): bump the common group across 1 directory with 11 updates (#8381)
* docs: correct Ruby documentation (#8402)
* chore: bump `mockery` to update v2.52.2 version and rebuild mock files (#8390)
* fix: don't use `scope` for `trivy registry login` command (#8393)
* fix(go): merge nested flags into string for ldflags for Go binaries (#8368)
* chore(terraform): export module path on terraform modules (#8374)
* fix(terraform): apply parser options to submodule parsing (#8377)
* docs: Fix typos in documentation (#8361)
* docs: fix navigate links (#8336)
* ci(helm): bump Trivy version to 0.59.1 for Trivy Helm Chart 0.11.1 (#8354)
* ci(spdx): add `aqua-installer` step to fix `mage` error (#8353)
* chore: remove debug prints (#8347)
* fix(misconf): do not log scanners when misconfig scanning is disabled (#8345)
* fix(report): remove html escaping for `shortDescription` and `fullDescription` fields for sarif reports (#8344)
* chore(deps): bump Go to `v1.23.5` (#8341)
* fix(python): add `poetry` v2 support (#8323)
* chore(deps): bump the github-actions group across 1 directory with 4 updates (#8331)
* fix(misconf): ecs include enhanced for container insights (#8326)
* fix(sbom): preserve OS packages from multiple SBOMs (#8325)
* ci(helm): bump Trivy version to 0.59.0 for Trivy Helm Chart 0.11.0 (#8311)
* (bsc#1237618, CVE-2025-27144)
Update to version 0.59.1:
* fix(misconf): do not log scanners when misconfig scanning is disabled [backport: release/v0.59] (#8349)
* chore(deps): bump Go to `v1.23.5` [backport: release/v0.59] (#8343)
* fix(python): add `poetry` v2 support [backport: release/v0.59] (#8335)
* fix(sbom): preserve OS packages from multiple SBOMs [backport: release/v0.59] (#8333)
Update to version 0.59.0:
* feat(image): return error early if total size of layers exceeds limit (#8294)
* chore(deps): Bump trivy-checks (#8310)
* chore(terraform): add accessors to underlying raw hcl values (#8306)
* fix: improve conversion of image config to Dockerfile (#8308)
* docs: replace short codes with Unicode emojis (#8296)
* feat(k8s): improve artifact selections for specific namespaces (#8248)
* chore: update code owners (#8303)
* fix(misconf): handle heredocs in dockerfile instructions (#8284)
* fix: de-duplicate same `dpkg` packages with different filePaths from different layers (#8298)
* chore(deps): bump the aws group with 7 updates (#8299)
* chore(deps): bump the common group with 12 updates (#8301)
* chore: enable int-conversion from perfsprint (#8194)
* feat(fs): use git commit hash as cache key for clean repositories (#8278)
* fix(spdx): use the `hasExtractedLicensingInfos` field for licenses that are not listed in the SPDX (#8077)
* chore: use require.ErrorContains when possible (#8291)
* feat(image): prevent scanning oversized container images (#8178)
* chore(deps): use aqua forks for `github.com/liamg/jfather` and `github.com/liamg/iamgo` (#8289)
* fix(fs): fix cache key generation to use UUID (#8275)
* fix(misconf): correctly handle all YAML tags in K8S templates (#8259)
* feat: add support for registry mirrors (#8244)
* chore(deps): bump the common group across 1 directory with 29 updates (#8261)
* refactor(license): improve license expression normalization (#8257)
* feat(misconf): support for ignoring by inline comments for Dockerfile (#8115)
* feat: add a examples field to check metadata (#8068)
* chore(deps): bump alpine from 3.20.0 to 3.21.0 in the docker group across 1 directory (#8196)
* ci: add workflow to restrict direct PRs to release branches (#8240)
* fix(suse): SUSE - update OSType constants and references for compatility (#8236)
* ci: fix path to main dir for canary builds (#8231)
* chore(secret): add reported issues related to secrets in junit template (#8193)
* refactor: use trivy-checks/pkg/specs package (#8226)
* ci(helm): bump Trivy version to 0.58.1 for Trivy Helm Chart 0.10.0 (#8170)
* fix(misconf): allow null values only for tf variables (#8112)
* feat(misconf): support for ignoring by inline comments for Helm (#8138)
* fix(redhat): check `usr/share/buildinfo/` dir to detect content sets (#8222)
* chore(alpine): add EOL date for Alpine 3.21 (#8221)
* fix: CVE-2025-21613 and CVE-2025-21614 : go-git: argument injection via the URL field (#8207)
* fix(misconf): disable git terminal prompt on tf module load (#8026)
* chore: remove aws iam related scripts (#8179)
* docs: Updated JSON schema version 2 in the trivy documentation (#8188)
* refactor(python): use once + debug for `License acquired from METADATA...` logs (#8175)
* refactor: use slices package instead of custom function (#8172)
* chore(deps): bump the common group with 6 updates (#8162)
* feat(python): add support for uv dev and optional dependencies (#8134)
* feat(python): add support for poetry dev dependencies (#8152)
* fix(sbom): attach nested packages to Application (#8144)
* docs(vex): use debian minor version in examples (#8166)
* refactor: add generic Set implementation (#8149)
* chore(deps): bump the aws group across 1 directory with 6 updates (#8163)
* fix(python): skip dev group's deps for poetry (#8106)
* fix(sbom): use root package for `unknown` dependencies (if exists) (#8104)
* chore(deps): bump `golang.org/x/net` from `v0.32.0` to `v0.33.0` (#8140)
* chore(vex): suppress CVE-2024-45338 (#8137)
* feat(python): add support for uv (#8080)
* chore(deps): bump the docker group across 1 directory with 3 updates (#8127)
* chore(deps): bump the common group across 1 directory with 14 updates (#8126)
* chore: bump go to 1.23.4 (#8123)
* test: set dummy value for NUGET_PACKAGES (#8107)
* chore(deps): bump `github.com/CycloneDX/cyclonedx-go` from `v0.9.1` to `v0.9.2` (#8105)
* chore(deps): bump golang.org/x/crypto from 0.30.0 to 0.31.0 (#8103)
* fix: wasm module test (#8099)
* fix: CVE-2024-45337: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass (#8088)
* chore(vex): suppress CVE-2024-45337 (#8101)
* fix(license): always trim leading and trailing spaces for licenses (#8095)
* fix(sbom): scan results of SBOMs generated from container images are missing layers (#7635)
* fix(redhat): correct rewriting of recommendations for the same vulnerability (#8063)
* fix: enable err-error and errorf rules from perfsprint linter (#7859)
* chore(deps): bump the aws group across 1 directory with 6 updates (#8074)
* perf: avoid heap allocation in applier findPackage (#7883)
* fix: Updated twitter icon (#7772)
* docs(k8s): add a note about multi-container pods (#7815)
* feat: add `--distro` flag to manually specify OS distribution for vulnerability scanning (#8070)
* fix(oracle): add architectures support for advisories (#4809)
* fix: handle `BLOW_UNKNOWN` error to download DBs (#8060)
* feat(misconf): generate placeholders for random provider resources (#8051)
* fix(sbom): fix wrong overwriting of applications obtained from different sbom files but having same app type (#8052)
* fix(flag): skip hidden flags for `--generate-default-config` command (#8046)
* fix(java): correctly overwrite version from depManagement if dependency uses `project.*` props (#8050)
* feat(nodejs): respect peer dependencies for dependency tree (#7989)
* ci(helm): bump Trivy version to 0.58.0 for Trivy Helm Chart 0.10.0 (#8038)
* fix: respect GITHUB_TOKEN to download artifacts from GHCR (#7580)
* chore(deps): bump github.com/moby/buildkit from 0.17.2 to 0.18.0 in the docker group (#8029)
* fix(misconf): use log instead of fmt for logging (#8033)
* docs: add commercial content (#8030)
- Update to version 0.58.2 (
bsc#1234512, CVE-2024-45337,
bsc#1235265, CVE-2024-45338,
bsc#1232948, CVE-2024-51744):
* fix(misconf): allow null values only for tf variables [backport: release/v0.58] (#8238)
* fix(suse): SUSE - update OSType constants and references for compatility [backport: release/v0.58] (#8237)
* fix: CVE-2025-21613 and CVE-2025-21614 : go-git: argument injection via the URL field [backport: release/v0.58] (#8215)
* fix(sbom): attach nested packages to Application [backport: release/v0.58] (#8168)
* fix(python): skip dev group's deps for poetry [backport: release/v0.58] (#8158)
* fix(sbom): use root package for `unknown` dependencies (if exists) [backport: release/v0.58] (#8156)
* chore(deps): bump `golang.org/x/net` from `v0.32.0` to `v0.33.0` [backport: release/v0.58] (#8142)
* chore(deps): bump `github.com/CycloneDX/cyclonedx-go` from `v0.9.1` to `v0.9.2` [backport: release/v0.58] (#8136)
* fix(redhat): correct rewriting of recommendations for the same vulnerability [backport: release/v0.58] (#8135)
* fix(oracle): add architectures support for advisories [backport: release/v0.58] (#8125)
* fix(sbom): fix wrong overwriting of applications obtained from different sbom files but having same app type [backport: release/v0.58] (#8124)
* chore(deps): bump golang.org/x/crypto from 0.30.0 to 0.31.0 [backport: release/v0.58] (#8122)
* fix: handle `BLOW_UNKNOWN` error to download DBs [backport: release/v0.58] (#8121)
* fix(java): correctly overwrite version from depManagement if dependency uses `project.*` props [backport: release/v0.58] (#8119)
* fix(misconf): wrap AWS EnvVar to iac types (#7407)
* chore(deps): Upgrade trivy-checks (#8018)
* refactor(misconf): Remove unused options (#7896)
* docs: add terminology page to explain Trivy concepts (#7996)
* feat: add `workspaceRelationship` (#7889)
* refactor(sbom): simplify relationship generation (#7985)
* chore: remove Go checks (#7907)
* docs: improve databases documentation (#7732)
* refactor: remove support for custom Terraform checks (#7901)
* docs: fix dead links (#7998)
* docs: drop AWS account scanning (#7997)
* fix(aws): change CPU and Memory type of ContainerDefinition to a string (#7995)
* fix(cli): Handle empty ignore files more gracefully (#7962)
* fix(misconf): load full Terraform module (#7925)
* fix(misconf): properly resolve local Terraform cache (#7983)
* refactor(k8s): add v prefix for Go packages (#7839)
* test: replace Go checks with Rego (#7867)
* feat(misconf): log causes of HCL file parsing errors (#7634)
* chore(deps): bump the aws group across 1 directory with 7 updates (#7991)
* chore(deps): bump github.com/moby/buildkit from 0.17.0 to 0.17.2 in the docker group across 1 directory (#7990)
* chore(deps): update csaf module dependency from csaf-poc to gocsaf (#7992)
* chore: downgrade the failed block expand message to debug (#7964)
* fix(misconf): do not erase variable type for child modules (#7941)
* feat(go): construct dependencies of `go.mod` main module in the parser (#7977)
* feat(go): construct dependencies in the parser (#7973)
* feat: add cvss v4 score and vector in scan response (#7968)
* docs: add `overview` page for `others` (#7972)
* fix(sbom): Fixes for Programming Language Vulnerabilities and SBOM Package Maintainer Details (#7871)
* feat(suse): Align SUSE/OpenSUSE OS Identifiers (#7965)
* chore(deps): bump the common group with 4 updates (#7949)
* feat(oracle): add `flavors` support (#7858)
* fix(misconf): Update trivy-checks default repo to `mirror.gcr.io` (#7953)
* chore(deps): Bump up trivy-checks to v1.3.0 (#7959)
* fix(k8s): check all results for vulnerabilities (#7946)
* ci(helm): bump Trivy version to 0.57.1 for Trivy Helm Chart 0.9.0 (#7945)
* feat(secret): Add built-in secrets rules for Private Packagist (#7826)
* docs: Fix broken links (#7900)
* docs: fix mistakes/typos (#7942)
* feat: Update registry fallbacks (#7679)
* fix(alpine): add `UID` for removed packages (#7887)
* chore(deps): bump the aws group with 6 updates (#7902)
* chore(deps): bump the common group with 6 updates (#7904)
* fix(debian): infinite loop (#7928)
* fix(redhat): don't return error if `root/buildinfo/content_manifests/` contains files that are not `contentSets` files (#7912)
* docs: add note about temporary podman socket (#7921)
* docs: combine trivy.dev into trivy docs (#7884)
* test: change branch in spdx schema link to check in integration tests (#7935)
* docs: add Headlamp to the Trivy Ecosystem page (#7916)
* fix(report): handle `git@github.com` schema for misconfigs in `sarif` report (#7898)
* chore(k8s): enhance k8s scan log (#6997)
* fix(terraform): set null value as fallback for missing variables (#7669)
* fix(misconf): handle null properties in CloudFormation templates (#7813)
* fix(fs): add missing defered Cleanup() call to post analyzer fs (#7882)
* chore(deps): bump the common group across 1 directory with 20 updates (#7876)
* chore: bump containerd to v2.0.0 (#7875)
* fix: Improve version comparisons when build identifiers are present (#7873)
* feat(k8s): add default commands for unknown platform (#7863)
* chore(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.0 to 4.5.1 (#7868)
* refactor(secret): optimize performance by moving ToLower operation outside loop (#7862)
* test: save `containerd` image into archive and use in tests (#7816)
* chore(deps): bump the github-actions group across 1 directory with 2 updates (#7854)
* chore: bump golangci-lint to v1.61.0 (#7853)
Update to version 0.57.1:
* feat: Update registry fallbacks [backport: release/v0.57] (#7944)
* fix(redhat): don't return error if `root/buildinfo/content_manifests/` contains files that are not `contentSets` files [backport: release/v0.57] (#7939)
* test: change branch in spdx schema link to check in integration tests [backport: release/v0.57] (#7940)
* release: v0.57.0 [main] (#7710)
* chore: lint `errors.Join` (#7845)
* feat(db): append errors (#7843)
* docs(java): add info about supported scopes (#7842)
* docs: add example of creating whitelist of checks (#7821)
* chore(deps): Bump trivy-checks (#7819)
* fix(go): Do not trim v prefix from versions in Go Mod Analyzer (#7733)
* fix(k8s): skip resources without misconfigs (#7797)
* fix(sbom): use `Annotation` instead of `AttributionTexts` for `SPDX` formats (#7811)
* fix(cli): add config name to skip-policy-update alias (#7820)
* fix(helm): properly handle multiple archived dependencies (#7782)
* refactor(misconf): Deprecate `EXCEPTIONS` for misconfiguration scanning (#7776)
* fix(k8s)!: support k8s multi container (#7444)
* fix(k8s): support kubernetes v1.31 (#7810)
* docs: add Windows install instructions (#7800)
* ci(helm): auto public Helm chart after PR merged (#7526)
* feat: add end of life date for Ubuntu 24.10 (#7787)
* feat(report): update gitlab template to populate operating_system value (#7735)
* feat(misconf): Show misconfig ID in output (#7762)
* feat(misconf): export unresolvable field of IaC types to Rego (#7765)
* refactor(k8s): scan config files as a folder (#7690)
* fix(license): fix license normalization for Universal Permissive License (#7766)
* fix: enable usestdlibvars linter (#7770)
* fix(misconf): properly expand dynamic blocks (#7612)
* feat(cyclonedx): add file checksums to `CycloneDX` reports (#7507)
* fix(misconf): fix for Azure Storage Account network acls adaptation (#7602)
* refactor(misconf): simplify k8s scanner (#7717)
* feat(parser): ignore white space in pom.xml files (#7747)
* test: use forked images (#7755)
* fix(java): correctly inherit `version` and `scope` from upper/root `depManagement` and `dependencies` into parents (#7541)
* fix(misconf): check if property is not nil before conversion (#7578)
* fix(misconf): change default ACL of digitalocean_spaces_bucket to private (#7577)
* feat(misconf): ssl_mode support for GCP SQL DB instance (#7564)
* test: define constants for test images (#7739)
* docs: add note about disabled DS016 check (#7724)
* feat(misconf): public network support for Azure Storage Account (#7601)
* feat(cli): rename `trivy auth` to `trivy registry` (#7727)
* docs: apt-transport-https is a transitional package (#7678)
* refactor(misconf): introduce generic scanner (#7515)
* fix(cli): `clean --all` deletes only relevant dirs (#7704)
* feat(cli): add `trivy auth` (#7664)
* fix(sbom): add options for DBs in private registries (#7660)
* docs(report): fix reporting doc format (#7671)
* fix(repo): `git clone` output to Stderr (#7561)
* fix(redhat): include arch in PURL qualifiers (#7654)
* fix(report): Fix invalid URI in SARIF report (#7645)
* docs(report): Improve SARIF reporting doc (#7655)
* fix(db): fix javadb downloading error handling (#7642)
* feat(cli): error out when ignore file cannot be found (#7624)
Update to version 0.56.2:
* fix(redhat): include arch in PURL qualifiers [backport: release/v0.56] (#7702)
* fix(sbom): add options for DBs in private registries [backport: release/v0.56] (#7691)
- Update to version 0.51.1 (bsc#1227010, CVE-2024-3817):
Patchnames
openSUSE-Leap-16.0-packagehub-33
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for trivy",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for trivy fixes the following issues:\n\nChanges in trivy:\n\nUpdate to version 0.67.2 (bsc#1250625, CVE-2025-11065, bsc#1248897, CVE-2025-58058):\n\n * fix: Use `fetch-level: 1` to check out trivy-repo in the release workflow [backport: release/v0.67] (#9638)\n * fix: restore compatibility for google.protobuf.Value [backport: release/v0.67] (#9631)\n * fix: using SrcVersion instead of Version for echo detector [backport: release/v0.67] (#9629)\n * fix: add `buildInfo` for `BlobInfo` in `rpc` package [backport: release/v0.67] (#9615)\n * fix(vex): don\u0027t use reused BOM [backport: release/v0.67] (#9612)\n * fix(vex): don\u0027t suppress vulns for packages with infinity loop (#9465)\n * fix(aws): use `BuildableClient` insead of `xhttp.Client` (#9436)\n * refactor(misconf): replace github.com/liamg/memoryfs with internal mapfs and testing/fstest (#9282)\n * docs: clarify inline ignore limitations for resource-less checks (#9537)\n * fix(k8s): disable parallel traversal with fs cache for k8s images (#9534)\n * fix(misconf): handle tofu files in module detection (#9486)\n * feat(seal): add seal support (#9370)\n * docs: fix modules path and update code example (#9539)\n * fix: close file descriptors and pipes on error paths (#9536)\n * feat: add documentation URL for database lock errors (#9531)\n * fix(db): Dowload database when missing but metadata still exists (#9393)\n * feat(cloudformation): support default values and list results in Fn::FindInMap (#9515)\n * fix(misconf): unmark cty values before access (#9495)\n * feat(cli): change --list-all-pkgs default to true (#9510)\n * fix(nodejs): parse workspaces as objects for package-lock.json files (#9518)\n * refactor(fs): use underlyingPath to determine virtual files more reliably (#9302)\n * refactor: remove google/wire dependency and implement manual DI (#9509)\n * chore(deps): bump the aws group with 6 updates (#9481)\n * chore(deps): bump the common group across 1 directory with 24 updates (#9507)\n * fix(misconf): wrap legacy ENV values in quotes to preserve spaces (#9497)\n * docs: move info about `detection priority` into coverage section (#9469)\n * feat(sbom): added support for CoreOS (#9448)\n * fix(misconf): strip build metadata suffixes from image history (#9498)\n * feat(cyclonedx): preserve SBOM structure when scanning SBOM files with vulnerability updates (#9439)\n * docs: Fix typo in terraform docs (#9492)\n * feat(redhat): add os-release detection for RHEL-based images (#9458)\n * ci(deps): add 3-day cooldown period for Dependabot updates (#9475)\n * refactor: migrate from go-json-experiment to encoding/json/v2 (#9422)\n * fix(vuln): compare `nuget` package names in lower case (#9456)\n * chore: Update release flow to include chocolatey (#9460)\n * docs: document eol supportability (#9434)\n * docs(report): add nuanses about secret/license scanner in summary table (#9442)\n * ci: use environment variables in GitHub Actions for improved security (#9433)\n * chore: bump Go to 1.24.7 (#9435)\n * fix(nodejs): use snapshot string as `Package.ID` for pnpm packages (#9330)\n * ci(helm): bump Trivy version to 0.66.0 for Trivy Helm Chart 0.18.0 (#9425)\n\nUpdate to version 0.66.0 (bsc#1248937, CVE-2025-58058):\n\n * chore(deps): bump the aws group with 7 updates (#9419)\n * refactor(secret): clarify secret scanner messages (#9409)\n * fix(cyclonedx): handle multiple license types (#9378)\n * fix(repo): sanitize git repo URL before inserting into report metadata (#9391)\n * test: add HTTP basic authentication to git test server (#9407)\n * fix(sbom): add support for `file` component type of `CycloneDX` (#9372)\n * fix(misconf): ensure module source is known (#9404)\n * ci: migrate GitHub Actions from version tags to SHA pinning (#9405)\n * fix: create temp file under composite fs dir (#9387)\n * chore(deps): bump github.com/ulikunitz/xz from 0.5.12 to 0.5.14 (#9403)\n * refactor: switch to stable azcontainerregistry SDK package (#9319)\n * chore(deps): bump the common group with 7 updates (#9382)\n * refactor(misconf): migrate from custom Azure JSON parser (#9222)\n * fix(repo): preserve RepoMetadata on FS cache hit (#9389)\n * refactor(misconf): use atomic.Int32 (#9385)\n * chore(deps): bump the aws group with 6 updates (#9383)\n * docs: Fix broken link to \"Built-in Checks\" (#9375)\n * fix(plugin): don\u0027t remove plugins when updating index.yaml file (#9358)\n * fix: persistent flag option typo (#9374)\n * chore(deps): bump the common group across 1 directory with 26 updates (#9347)\n * fix(image): use standardized HTTP client for ECR authentication (#9322)\n * refactor: export `systemFileFiltering` Post Handler (#9359)\n * docs: update links to Semaphore pages (#9352)\n * fix(conda): memory leak by adding closure method for `package.json` file (#9349)\n * feat: add timeout handling for cache database operations (#9307)\n * fix(misconf): use correct field log_bucket instead of target_bucket in gcp bucket (#9296)\n * fix(misconf): ensure ignore rules respect subdirectory chart paths (#9324)\n * chore(deps): bump alpine from 3.21.4 to 3.22.1 (#9301)\n * feat(terraform): use .terraform cache for remote modules in plan scanning (#9277)\n * chore: fix some function names in comment (#9314)\n * chore(deps): bump the aws group with 7 updates (#9311)\n * docs: add explanation for how to use non-system certificates (#9081)\n * chore(deps): bump the github-actions group across 1 directory with 2 updates (#8962)\n * fix(misconf): preserve original paths of remote submodules from .terraform (#9294)\n * refactor(terraform): make Scan method of Terraform plan scanner private (#9272)\n * fix: suppress debug log for context cancellation errors (#9298)\n * feat(secret): implement streaming secret scanner with byte offset tracking (#9264)\n * fix(python): impove package name normalization (#9290)\n * feat(misconf): added audit config attribute (#9249)\n * refactor(misconf): decouple input fs and track extracted files with fs references (#9281)\n * test(misconf): remove BenchmarkCalculate using outdated check metadata (#9291)\n * refactor: simplify Detect function signature (#9280)\n * ci(helm): bump Trivy version to 0.65.0 for Trivy Helm Chart 0.17.0 (#9288)\n * fix(fs): avoid shadowing errors in file.glob (#9286)\n * test(misconf): move terraform scan tests to integration tests (#9271)\n * test(misconf): drop gcp iam test covered by another case (#9285)\n * chore(deps): bump to alpine from `3.21.3` to `3.21.4` (#9283)\n\nUpdate to version 0.65.0:\n\n * fix(cli): ensure correct command is picked by telemetry (#9260)\n * feat(flag): add schema validation for `--server` flag (#9270)\n * chore(deps): bump github.com/docker/docker from 28.3.2+incompatible to 28.3.3+incompatible (#9274)\n * ci: skip undefined labels in discussion triage action (#9175)\n * feat(repo): add git repository metadata to reports (#9252)\n * fix(license): handle WITH operator for `LaxSplitLicenses` (#9232)\n * chore: add modernize tool integration for code modernization (#9251)\n * fix(secret): add UTF-8 validation in secret scanner to prevent protobuf marshalling errors (#9253)\n * chore: implement process-safe temp file cleanup (#9241)\n * fix: prevent graceful shutdown message on normal exit (#9244)\n * fix(misconf): correctly parse empty port ranges in google_compute_firewall (#9237)\n * feat: add graceful shutdown with signal handling (#9242)\n * chore: update template URL for brew formula (#9221)\n * test: add end-to-end testing framework with image scan and proxy tests (#9231)\n * refactor(db): use `Getter` interface with `GetParams` for trivy-db sources (#9239)\n * ci: specify repository for `gh cache delete` in canary worklfow (#9240)\n * ci: remove invalid `--confirm` flag from `gh cache delete` command in canary builds (#9236)\n * fix(misconf): fix log bucket in schema (#9235)\n * chore(deps): bump the common group across 1 directory with 24 updates (#9228)\n * ci: move runner.os context from job-level env to step-level in canary workflow (#9233)\n * chore(deps): bump up Trivy-kubernetes to v0.9.1 (#9214)\n * feat(misconf): added logging and versioning to the gcp storage bucket (#9226)\n * fix(server): add HTTP transport setup to server mode (#9217)\n * chore: update the rpm download Update (#9202)\n * feat(alma): add AlmaLinux 10 support (#9207)\n * fix(nodejs): don\u0027t use prerelease logic for compare npm constraints (#9208)\n * fix(rootio): fix severity selection (#9181)\n * fix(sbom): merge in-graph and out-of-graph OS packages in scan results (#9194)\n * fix(cli): panic: attempt to get os.Args[1] when len(os.Args) \u003c 2 (#9206)\n * fix(misconf): correctly adapt azure storage account (#9138)\n * feat(misconf): add private ip google access attribute to subnetwork (#9199)\n * feat(report): add CVSS vectors in sarif report (#9157)\n * fix(terraform): `for_each` on a map returns a resource for every key (#9156)\n * fix: supporting .egg-info/METADATA in python.Packaging analyzer (#9151)\n * chore: migrate protoc setup from Docker to buf CLI (#9184)\n * ci: delete cache after artifacts upload in canary workflow (#9177)\n * refactor: remove aws flag helper message (#9080)\n * ci: use gh pr view to get PR number for forked repositories in auto-ready workflow (#9183)\n * ci: add auto-ready-for-review workflow (#9179)\n * feat(image): add Docker context resolution (#9166)\n * ci: optimize golangci-lint performance with cache-based strategy (#9173)\n * feat: add HTTP request/response tracing support (#9125)\n * fix(aws): update amazon linux 2 EOL date (#9176)\n * chore: Update release workflow to trigger version updates (#9162)\n * chore(deps): bump helm.sh/helm/v3 from 3.18.3 to 3.18.4 (#9164)\n * fix: also check `filepath` when removing duplicate packages (#9142)\n * chore: add debug log to show image source location (#9163)\n * docs: add section on customizing default check data (#9114)\n * chore(deps): bump the common group across 1 directory with 9 updates (#9153)\n * docs: partners page content updates (#9149)\n * chore(license): add missed spdx exceptions: (#9147)\n * docs: trivy partners page updates (#9133)\n * fix: migrate from `*.list` to `*.md5sums` files for `dpkg` (#9131)\n * ci(helm): bump Trivy version to 0.64.1 for Trivy Helm Chart 0.16.1 (#9135)\n * feat(sbom): add SHA-512 hash support for CycloneDX SBOM (#9126)\n * fix(misconf): skip rewriting expr if attr is nil (#9113)\n * fix(license): add missed `GFDL-NIV-1.1` and `GFDL-NIV-1.2` into Trivy mapping (#9116)\n * fix(cli): Add more non-sensitive flags to telemetry (#9110)\n * fix(alma): parse epochs from rpmqa file (#9101)\n * fix(rootio): check full version to detect `root.io` packages (#9117)\n * chore: drop FreeBSD 32-bit support (#9102)\n * fix(sbom): use correct field for licenses in CycloneDX reports (#9057)\n * fix(secret): fix line numbers for multiple-line secrets (#9104)\n * feat(license): observe pkg types option in license scanner (#9091)\n * ci(helm): bump Trivy version to 0.64.0 for Trivy Helm Chart 0.16.0 (#9107)\n- (CVE-2025-53547, bsc#1246151)\n\n- Update to version 0.64.1 (bsc#1243633, CVE-2025-47291,\n (bsc#1246730, CVE-2025-46569):\n\n * fix(misconf): skip rewriting expr if attr is nil [backport: release/v0.64] (#9127)\n * fix(cli): Add more non-sensitive flags to telemetry [backport: release/v0.64] (#9124)\n * fix(rootio): check full version to detect `root.io` packages [backport: release/v0.64] (#9120)\n * fix(alma): parse epochs from rpmqa file [backport: release/v0.64] (#9119)\n * docs(python): fix type with METADATA file name (#9090)\n * feat: reject unsupported artifact types in remote image retrieval (#9052)\n * chore(deps): bump github.com/go-viper/mapstructure/v2 from 2.2.1 to 2.3.0 (#9088)\n * refactor(misconf): rewrite Rego module filtering using functional filters (#9061)\n * feat(terraform): add partial evaluation for policy templates (#8967)\n * feat(vuln): add Root.io support for container image scanning (#9073)\n * feat(sbom): add manufacturer field to CycloneDX tools metadata (#9019)\n * fix(cli): add some values to the telemetry call (#9056)\n * feat(ubuntu): add end of life date for Ubuntu 25.04 (#9077)\n * refactor: centralize HTTP transport configuration (#9058)\n * test: include integration tests in linting and fix all issues (#9060)\n * chore(deps): bump the common group across 1 directory with 26 updates (#9063)\n * feat(java): dereference all maven settings.xml env placeholders (#9024)\n * fix(misconf): reduce log noise on incompatible check (#9029)\n * fix(misconf): .Config.User always takes precedence over USER in .History (#9050)\n * chore(deps): update Docker to v28.2.2 and fix compatibility issues (#9037)\n * docs(misconf): simplify misconfiguration docs (#9030)\n * fix(misconf): move disabled checks filtering after analyzer scan (#9002)\n * docs: add PR review policy for maintainers (#9032)\n * fix(sbom): remove unnecessary OS detection check in SBOM decoding (#9034)\n * test: improve and extend tests for iac/adapters/arm (#9028)\n * chore: bump up Go version to 1.24.4 (#9031)\n * feat(cli): add version constraints to annoucements (#9023)\n * fix(misconf): correct Azure value-to-time conversion in AsTimeValue (#9015)\n * feat(ubuntu): add eol date for 20.04-ESM (#8981)\n * fix(report): don\u0027t panic when report contains vulns, but doesn\u0027t contain packages for `table` format (#8549)\n * fix(nodejs): correctly parse `packages` array of `bun.lock` file (#8998)\n * refactor: use strings.SplitSeq instead of strings.Split in for-loop (#8983)\n * docs: change --disable-metrics to --disable-telemetry in example (#8999) (#9003)\n * feat(misconf): add OpenTofu file extension support (#8747)\n * refactor(misconf): set Trivy version by default in Rego scanner (#9001)\n * docs: fix assets with versioning (#8996)\n * docs: add partners page (#8988)\n * chore(alpine): add EOL date for Alpine 3.22 (#8992)\n * fix: don\u0027t show corrupted trivy-db warning for first run (#8991)\n * Update installation.md (#8979)\n * feat(misconf): normalize CreatedBy for buildah and legacy docker builder (#8953)\n * chore(k8s): update comments with deprecated command format (#8964)\n * chore: fix errors and typos in docs (#8963)\n * fix: Add missing version check flags (#8951)\n * feat(redhat): Add EOL date for RHEL 10. (#8910)\n * fix: Correctly check for semver versions for trivy version check (#8948)\n * refactor(server): change custom advisory and vulnerability data types fr\u2026 (#8923)\n * ci(helm): bump Trivy version to 0.63.0 for Trivy Helm Chart 0.15.0 (#8946)\n * fix(misconf): use argument value in WithIncludeDeprecatedChecks (#8942)\n * chore(deps): Bump trivy-checks (#8934)\n * fix(julia): add `Relationship` field support (#8939)\n * feat(minimos): Add support for MinimOS (#8792)\n * feat(alpine): add maintainer field extraction for APK packages (#8930)\n * feat(echo): Add Echo Support (#8833)\n * fix(redhat): Also try to find buildinfo in root layer (layer 0) (#8924)\n * fix(wolfi): support new APK database location (#8937)\n * feat(k8s): get components from namespaced resources (#8918)\n * refactor(cloudformation): remove unused ScanFile method from Scanner (#8927)\n * refactor(terraform): remove result sorting from scanner (#8928)\n * feat(misconf): Add support for `Minimum Trivy Version` (#8880)\n * docs: improve skipping files documentation (#8749)\n * feat(cli): Add available version checking (#8553)\n * feat(nodejs): add a bun.lock analyzer (#8897)\n * feat: terraform parser option to set current working directory (#8909)\n * perf(secret): only match secrets of meaningful length, allow example strings to not be matched (#8602)\n * feat(misconf): export raw Terraform data to Rego (#8741)\n * refactor(terraform): simplify AllReferences method signature in Attribute (#8906)\n * fix: check post-analyzers for StaticPaths (#8904)\n * feat: add Bottlerocket OS package analyzer (#8653)\n * feat(license): improve work text licenses with custom classification (#8888)\n * chore(deps): bump github.com/containerd/containerd/v2 from 2.1.0 to 2.1.1 (#8901)\n * chore(deps): bump the common group across 1 directory with 9 updates (#8887)\n * refactor(license): simplify compound license scanning (#8896)\n * feat(license): Support compound licenses (licenses using SPDX operators) (#8816)\n * fix(k8s): use in-memory cache backend during misconfig scanning (#8873)\n * feat(nodejs): add bun.lock parser (#8851)\n * feat(license): improve work with custom classification of licenses from config file (#8861)\n * fix(cli): disable `--skip-dir` and `--skip-files` flags for `sbom` command (#8886)\n * fix: julia parser panicing (#8883)\n * refactor(db): change logic to detect wrong DB (#8864)\n * fix(cli): don\u0027t use allow values for `--compliance` flag (#8881)\n * docs(misconf): Reorganize misconfiguration scan pages (#8206)\n * fix(server): add missed Relationship field for `rpc` (#8872)\n * feat: add JSONC support for comments and trailing commas (#8862)\n * fix(vex): use `lo.IsNil` to check `VEX` from OCI artifact (#8858)\n * feat(go): support license scanning in both GOPATH and vendor (#8843)\n * fix(redhat): save contentSets for OS packages in fs/vm modes (#8820)\n * fix: filter all files when processing files installed from package managers (#8842)\n * feat(misconf): add misconfiguration location to junit template (#8793)\n * docs(vuln): remove OSV for Python from data sources (#8841)\n * chore: add an issue template for maintainers (#8838)\n * chore: enable staticcheck (#8815)\n * ci(helm): bump Trivy version to 0.62.1 for Trivy Helm Chart 0.14.1 (#8836)\n * feat(license): scan vendor directory for license for go.mod files (#8689)\n * docs(java): Update info about dev deps in gradle lock (#8830)\n * chore(deps): bump golang.org/x/sync from 0.13.0 to 0.14.0 in the common group (#8822)\n * fix(java): exclude dev dependencies in gradle lockfile (#8803)\n * fix: octalLiteral from go-critic (#8811)\n * fix(redhat): trim invalid suffix from content_sets in manifest parsing (#8818)\n * chore(deps): bump the common group across 1 directory with 10 updates (#8817)\n * fix: use-any from revive (#8810)\n * fix: more revive rules (#8814)\n * docs: change in java.md: fix the Trity -to-\u003e Trivy typo (#8813)\n * fix(misconf): check if for-each is known when expanding dyn block (#8808)\n * ci(helm): bump Trivy version to 0.62.0 for Trivy Helm Chart 0.14.0 (#8802)\n\n- Update to version 0.62.1 (bsc#1239225, CVE-2025-22868,\n bsc#1241724, CVE-2025-22872):\n\n * chore(deps): bump the common group across 1 directory with 10 updates [backport: release/v0.62] (#8831)\n * fix(misconf): check if for-each is known when expanding dyn block [backport: release/v0.62] (#8826)\n * fix(redhat): trim invalid suffix from content_sets in manifest parsing [backport: release/v0.62] (#8824)\n * feat(nodejs): add root and workspace for `yarn` packages (#8535)\n * fix: unused-parameter rule from revive (#8794)\n * chore(deps): Update trivy-checks (#8798)\n * fix: early-return, indent-error-flow and superfluous-else rules from revive (#8796)\n * fix(k8s): remove using `last-applied-configuration` (#8791)\n * refactor(misconf): remove unused methods from providers (#8781)\n * refactor(misconf): remove unused methods from iac types (#8782)\n * fix(misconf): filter null nodes when parsing json manifest (#8785)\n * fix: testifylint last issues (#8768)\n * fix(misconf): perform operations on attribute safely (#8774)\n * refactor(ubuntu): update time handling for fixing time (#8780)\n * chore(deps): bump golangci-lint to v2.1.2 (#8766)\n * feat(image): save layers metadata into report (#8394)\n * feat(misconf): convert AWS managed policy to document (#8757)\n * chore(deps): bump the docker group across 1 directory with 3 updates (#8762)\n * ci(helm): bump Trivy version to 0.61.1 for Trivy Helm Chart 0.13.1 (#8753)\n * ci(helm): create a helm branch for patches from main (#8673)\n * fix(terraform): hcl object expressions to return references (#8271)\n * chore(terraform): option to pass in instanced logger (#8738)\n * ci: use `Skitionek/notify-microsoft-teams` instead of `aquasecurity` fork (#8740)\n * chore(terraform): remove os.OpenPath call from terraform file functions (#8737)\n * chore(deps): bump the common group across 1 directory with 23 updates (#8733)\n * feat(rust): add root and workspace relationships/package for `cargo` lock files (#8676)\n * refactor(misconf): remove module outputs from parser.EvaluateAll (#8587)\n * fix(misconf): populate context correctly for module instances (#8656)\n * fix(misconf): check if metadata is not nil (#8647)\n * refactor(misconf): switch to x/json (#8719)\n * fix(report): clean buffer after flushing (#8725)\n * ci: improve PR title validation workflow (#8720)\n * refactor(flag): improve flag system architecture and extensibility (#8718)\n * fix(terraform): `evaluateStep` to correctly set `EvalContext` for multiple instances of blocks (#8555)\n * refactor: migrate from `github.com/aquasecurity/jfather` to `github.com/go-json-experiment/json` (#8591)\n * feat(misconf): support auto_provisioning_defaults in google_container_cluster (#8705)\n * ci: use `github.event.pull_request.user.login` for release PR check workflow (#8702)\n * refactor: add hook interface for extended functionality (#8585)\n * fix(misconf): add missing variable as unknown (#8683)\n * docs: Update maintainer docs (#8674)\n * ci(vuln): reduce github action script injection attack risk (#8610)\n * fix(secret): ignore .dist-info directories during secret scanning (#8646)\n * fix(server): fix redis key when trying to delete blob (#8649)\n * chore(deps): bump the testcontainers group with 2 updates (#8650)\n * test: use `aquasecurity` repository for test images (#8677)\n * chore(deps): bump the aws group across 1 directory with 5 updates (#8652)\n * fix(k8s): skip passed misconfigs for the summary report (#8684)\n * fix(k8s): correct compare artifact versions (#8682)\n * chore: update Docker lib (#8681)\n * refactor(misconf): remove unused terraform attribute methods (#8657)\n * feat(misconf): add option to pass Rego scanner to IaC scanner (#8369)\n * chore: typo fix to replace `rego` with `repo` on the RepoFlagGroup options error output (#8643)\n * docs: Add info about helm charts release (#8640)\n * ci(helm): bump Trivy version to 0.61.0 for Trivy Helm Chart 0.13.0 (#8638)\n\nUpdate to version 0.61.1 (bsc#1239385, CVE-2025-22869, bsc#1240466, CVE-2025-30204):\n\n * fix(k8s): skip passed misconfigs for the summary report [backport: release/v0.61] (#8748)\n * fix(k8s): correct compare artifact versions [backport: release/v0.61] (#8699)\n * test: use `aquasecurity` repository for test images [backport: release/v0.61] (#8698)\n * fix(misconf): Improve logging for unsupported checks (#8634)\n * feat(k8s): add support for controllers (#8614)\n * fix(debian): don\u0027t include empty licenses for `dpkgs` (#8623)\n * fix(misconf): Check values wholly prior to evalution (#8604)\n * chore(deps): Bump trivy-checks (#8619)\n * fix(k8s): show report for `--report all` (#8613)\n * chore(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.1 to 4.5.2 (#8597)\n * refactor: rename scanner to service (#8584)\n * fix(misconf): do not skip loading documents from subdirectories (#8526)\n * refactor(misconf): get a block or attribute without calling HasChild (#8586)\n * fix(misconf): identify the chart file exactly by name (#8590)\n * test: use table-driven tests in Helm scanner tests (#8592)\n * refactor(misconf): Simplify misconfig checks bundle parsing (#8533)\n * chore(deps): bump the common group across 1 directory with 10 updates (#8566)\n * fix(misconf): do not use cty.NilVal for non-nil values (#8567)\n * docs(cli): improve flag value display format (#8560)\n * fix(misconf): set default values for AWS::EKS::Cluster.ResourcesVpcConfig (#8548)\n * docs: remove slack (#8565)\n * fix: use `--file-patterns` flag for all post analyzers (#7365)\n * docs(python): Mention pip-compile (#8484)\n * feat(misconf): adapt aws_opensearch_domain (#8550)\n * feat(misconf): adapt AWS::EC2::VPC (#8534)\n * docs: fix a broken link (#8546)\n * fix(fs): check postAnalyzers for StaticPaths (#8543)\n * refactor(misconf): remove unused methods for ec2.Instance (#8536)\n * feat(misconf): adapt aws_default_security_group (#8538)\n * feat(fs): optimize scanning performance by direct file access for known paths (#8525)\n * feat(misconf): adapt AWS::DynamoDB::Table (#8529)\n * style: Fix MD syntax in self-hosting.md (#8523)\n * perf(misconf): retrieve check metadata from annotations once (#8478)\n * feat(misconf): Add support for aws_ami (#8499)\n * fix(misconf): skip Azure CreateUiDefinition (#8503)\n * refactor(misconf): use OPA v1 (#8518)\n * fix(misconf): add ephemeral block type to config schema (#8513)\n * perf(misconf): parse input for Rego once (#8483)\n * feat: replace TinyGo with standard Go for WebAssembly modules (#8496)\n * chore: replace deprecated tenv linter with usetesting (#8504)\n * fix(spdx): save text licenses into `otherLicenses` without normalize (#8502)\n * chore(deps): bump the common group across 1 directory with 13 updates (#8491)\n * chore: use go.mod for managing Go tools (#8493)\n * ci(helm): bump Trivy version to 0.60.0 for Trivy Helm Chart 0.12.0 (#8494)\n * fix(sbom): improve logic for binding direct dependency to parent component (#8489)\n * chore(deps): remove missed replace of `trivy-db` (#8492)\n * chore(deps): bump alpine from 3.21.0 to 3.21.3 in the docker group across 1 directory (#8490)\n * chore(deps): update Go to 1.24 and switch to go-version-file (#8388)\n * docs: add abbreviation list (#8453)\n * chore(terraform): assign *terraform.Module \u0027parent\u0027 field (#8444)\n * feat: add report summary table (#8177)\n * chore(deps): bump the github-actions group with 3 updates (#8473)\n * refactor(vex): improve SBOM reference handling with project standards (#8457)\n * ci: update GitHub Actions cache to v4 (#8475)\n * feat: add `--vuln-severity-source` flag (#8269)\n * fix(os): add mapping OS aliases (#8466)\n * chore(deps): bump the aws group across 1 directory with 7 updates (#8468)\n * chore(deps): Bump trivy-checks to v1.7.1 (#8467)\n * refactor(report): write tables after rendering all results (#8357)\n * docs: update VEX documentation index page (#8458)\n * fix(db): fix case when 2 trivy-db were copied at the same time (#8452)\n * feat(misconf): render causes for Terraform (#8360)\n * fix(misconf): fix incorrect k8s locations due to JSON to YAML conversion (#8073)\n * feat(cyclonedx): Add initial support for loading external VEX files from SBOM references (#8254)\n * chore(deps): update go-rustaudit location (#8450)\n * fix: update all documentation links (#8045)\n * chore(deps): bump github.com/go-jose/go-jose/v4 from 4.0.4 to 4.0.5 (#8443)\n * chore(deps): bump the common group with 6 updates (#8411)\n * fix(k8s): add missed option `PkgRelationships` (#8442)\n * fix(sbom): add SBOM file\u0027s filePath as Application FilePath if we can\u0027t detect its path (#8346)\n * feat(go): fix parsing main module version for go \u003e= 1.24 (#8433)\n * refactor(misconf): make Rego scanner independent of config type (#7517)\n * fix(image): disable AVD-DS-0007 for history scanning (#8366)\n * fix(server): secrets inspectation for the config analyzer in client server mode (#8418)\n * chore: remove mockery (#8417)\n * test(server): replace mock driver with memory cache in server tests (#8416)\n * test: replace mock with memory cache and fix non-deterministic tests (#8410)\n * test: replace mock with memory cache in scanner tests (#8413)\n * test: use memory cache (#8403)\n * fix(spdx): init `pkgFilePaths` map for all formats (#8380)\n * chore(deps): bump the common group across 1 directory with 11 updates (#8381)\n * docs: correct Ruby documentation (#8402)\n * chore: bump `mockery` to update v2.52.2 version and rebuild mock files (#8390)\n * fix: don\u0027t use `scope` for `trivy registry login` command (#8393)\n * fix(go): merge nested flags into string for ldflags for Go binaries (#8368)\n * chore(terraform): export module path on terraform modules (#8374)\n * fix(terraform): apply parser options to submodule parsing (#8377)\n * docs: Fix typos in documentation (#8361)\n * docs: fix navigate links (#8336)\n * ci(helm): bump Trivy version to 0.59.1 for Trivy Helm Chart 0.11.1 (#8354)\n * ci(spdx): add `aqua-installer` step to fix `mage` error (#8353)\n * chore: remove debug prints (#8347)\n * fix(misconf): do not log scanners when misconfig scanning is disabled (#8345)\n * fix(report): remove html escaping for `shortDescription` and `fullDescription` fields for sarif reports (#8344)\n * chore(deps): bump Go to `v1.23.5` (#8341)\n * fix(python): add `poetry` v2 support (#8323)\n * chore(deps): bump the github-actions group across 1 directory with 4 updates (#8331)\n * fix(misconf): ecs include enhanced for container insights (#8326)\n * fix(sbom): preserve OS packages from multiple SBOMs (#8325)\n * ci(helm): bump Trivy version to 0.59.0 for Trivy Helm Chart 0.11.0 (#8311)\n * (bsc#1237618, CVE-2025-27144)\n\nUpdate to version 0.59.1:\n\n * fix(misconf): do not log scanners when misconfig scanning is disabled [backport: release/v0.59] (#8349)\n * chore(deps): bump Go to `v1.23.5` [backport: release/v0.59] (#8343)\n * fix(python): add `poetry` v2 support [backport: release/v0.59] (#8335)\n * fix(sbom): preserve OS packages from multiple SBOMs [backport: release/v0.59] (#8333)\n\nUpdate to version 0.59.0:\n\n * feat(image): return error early if total size of layers exceeds limit (#8294)\n * chore(deps): Bump trivy-checks (#8310)\n * chore(terraform): add accessors to underlying raw hcl values (#8306)\n * fix: improve conversion of image config to Dockerfile (#8308)\n * docs: replace short codes with Unicode emojis (#8296)\n * feat(k8s): improve artifact selections for specific namespaces (#8248)\n * chore: update code owners (#8303)\n * fix(misconf): handle heredocs in dockerfile instructions (#8284)\n * fix: de-duplicate same `dpkg` packages with different filePaths from different layers (#8298)\n * chore(deps): bump the aws group with 7 updates (#8299)\n * chore(deps): bump the common group with 12 updates (#8301)\n * chore: enable int-conversion from perfsprint (#8194)\n * feat(fs): use git commit hash as cache key for clean repositories (#8278)\n * fix(spdx): use the `hasExtractedLicensingInfos` field for licenses that are not listed in the SPDX (#8077)\n * chore: use require.ErrorContains when possible (#8291)\n * feat(image): prevent scanning oversized container images (#8178)\n * chore(deps): use aqua forks for `github.com/liamg/jfather` and `github.com/liamg/iamgo` (#8289)\n * fix(fs): fix cache key generation to use UUID (#8275)\n * fix(misconf): correctly handle all YAML tags in K8S templates (#8259)\n * feat: add support for registry mirrors (#8244)\n * chore(deps): bump the common group across 1 directory with 29 updates (#8261)\n * refactor(license): improve license expression normalization (#8257)\n * feat(misconf): support for ignoring by inline comments for Dockerfile (#8115)\n * feat: add a examples field to check metadata (#8068)\n * chore(deps): bump alpine from 3.20.0 to 3.21.0 in the docker group across 1 directory (#8196)\n * ci: add workflow to restrict direct PRs to release branches (#8240)\n * fix(suse): SUSE - update OSType constants and references for compatility (#8236)\n * ci: fix path to main dir for canary builds (#8231)\n * chore(secret): add reported issues related to secrets in junit template (#8193)\n * refactor: use trivy-checks/pkg/specs package (#8226)\n * ci(helm): bump Trivy version to 0.58.1 for Trivy Helm Chart 0.10.0 (#8170)\n * fix(misconf): allow null values only for tf variables (#8112)\n * feat(misconf): support for ignoring by inline comments for Helm (#8138)\n * fix(redhat): check `usr/share/buildinfo/` dir to detect content sets (#8222)\n * chore(alpine): add EOL date for Alpine 3.21 (#8221)\n * fix: CVE-2025-21613 and CVE-2025-21614 : go-git: argument injection via the URL field (#8207)\n * fix(misconf): disable git terminal prompt on tf module load (#8026)\n * chore: remove aws iam related scripts (#8179)\n * docs: Updated JSON schema version 2 in the trivy documentation (#8188)\n * refactor(python): use once + debug for `License acquired from METADATA...` logs (#8175)\n * refactor: use slices package instead of custom function (#8172)\n * chore(deps): bump the common group with 6 updates (#8162)\n * feat(python): add support for uv dev and optional dependencies (#8134)\n * feat(python): add support for poetry dev dependencies (#8152)\n * fix(sbom): attach nested packages to Application (#8144)\n * docs(vex): use debian minor version in examples (#8166)\n * refactor: add generic Set implementation (#8149)\n * chore(deps): bump the aws group across 1 directory with 6 updates (#8163)\n * fix(python): skip dev group\u0027s deps for poetry (#8106)\n * fix(sbom): use root package for `unknown` dependencies (if exists) (#8104)\n * chore(deps): bump `golang.org/x/net` from `v0.32.0` to `v0.33.0` (#8140)\n * chore(vex): suppress CVE-2024-45338 (#8137)\n * feat(python): add support for uv (#8080)\n * chore(deps): bump the docker group across 1 directory with 3 updates (#8127)\n * chore(deps): bump the common group across 1 directory with 14 updates (#8126)\n * chore: bump go to 1.23.4 (#8123)\n * test: set dummy value for NUGET_PACKAGES (#8107)\n * chore(deps): bump `github.com/CycloneDX/cyclonedx-go` from `v0.9.1` to `v0.9.2` (#8105)\n * chore(deps): bump golang.org/x/crypto from 0.30.0 to 0.31.0 (#8103)\n * fix: wasm module test (#8099)\n * fix: CVE-2024-45337: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass (#8088)\n * chore(vex): suppress CVE-2024-45337 (#8101)\n * fix(license): always trim leading and trailing spaces for licenses (#8095)\n * fix(sbom): scan results of SBOMs generated from container images are missing layers (#7635)\n * fix(redhat): correct rewriting of recommendations for the same vulnerability (#8063)\n * fix: enable err-error and errorf rules from perfsprint linter (#7859)\n * chore(deps): bump the aws group across 1 directory with 6 updates (#8074)\n * perf: avoid heap allocation in applier findPackage (#7883)\n * fix: Updated twitter icon (#7772)\n * docs(k8s): add a note about multi-container pods (#7815)\n * feat: add `--distro` flag to manually specify OS distribution for vulnerability scanning (#8070)\n * fix(oracle): add architectures support for advisories (#4809)\n * fix: handle `BLOW_UNKNOWN` error to download DBs (#8060)\n * feat(misconf): generate placeholders for random provider resources (#8051)\n * fix(sbom): fix wrong overwriting of applications obtained from different sbom files but having same app type (#8052)\n * fix(flag): skip hidden flags for `--generate-default-config` command (#8046)\n * fix(java): correctly overwrite version from depManagement if dependency uses `project.*` props (#8050)\n * feat(nodejs): respect peer dependencies for dependency tree (#7989)\n * ci(helm): bump Trivy version to 0.58.0 for Trivy Helm Chart 0.10.0 (#8038)\n * fix: respect GITHUB_TOKEN to download artifacts from GHCR (#7580)\n * chore(deps): bump github.com/moby/buildkit from 0.17.2 to 0.18.0 in the docker group (#8029)\n * fix(misconf): use log instead of fmt for logging (#8033)\n * docs: add commercial content (#8030)\n\n- Update to version 0.58.2 (\n bsc#1234512, CVE-2024-45337,\n bsc#1235265, CVE-2024-45338,\n bsc#1232948, CVE-2024-51744):\n\n * fix(misconf): allow null values only for tf variables [backport: release/v0.58] (#8238)\n * fix(suse): SUSE - update OSType constants and references for compatility [backport: release/v0.58] (#8237)\n * fix: CVE-2025-21613 and CVE-2025-21614 : go-git: argument injection via the URL field [backport: release/v0.58] (#8215)\n * fix(sbom): attach nested packages to Application [backport: release/v0.58] (#8168)\n * fix(python): skip dev group\u0027s deps for poetry [backport: release/v0.58] (#8158)\n * fix(sbom): use root package for `unknown` dependencies (if exists) [backport: release/v0.58] (#8156)\n * chore(deps): bump `golang.org/x/net` from `v0.32.0` to `v0.33.0` [backport: release/v0.58] (#8142)\n * chore(deps): bump `github.com/CycloneDX/cyclonedx-go` from `v0.9.1` to `v0.9.2` [backport: release/v0.58] (#8136)\n * fix(redhat): correct rewriting of recommendations for the same vulnerability [backport: release/v0.58] (#8135)\n * fix(oracle): add architectures support for advisories [backport: release/v0.58] (#8125)\n * fix(sbom): fix wrong overwriting of applications obtained from different sbom files but having same app type [backport: release/v0.58] (#8124)\n * chore(deps): bump golang.org/x/crypto from 0.30.0 to 0.31.0 [backport: release/v0.58] (#8122)\n * fix: handle `BLOW_UNKNOWN` error to download DBs [backport: release/v0.58] (#8121)\n * fix(java): correctly overwrite version from depManagement if dependency uses `project.*` props [backport: release/v0.58] (#8119)\n * fix(misconf): wrap AWS EnvVar to iac types (#7407)\n * chore(deps): Upgrade trivy-checks (#8018)\n * refactor(misconf): Remove unused options (#7896)\n * docs: add terminology page to explain Trivy concepts (#7996)\n * feat: add `workspaceRelationship` (#7889)\n * refactor(sbom): simplify relationship generation (#7985)\n * chore: remove Go checks (#7907)\n * docs: improve databases documentation (#7732)\n * refactor: remove support for custom Terraform checks (#7901)\n * docs: fix dead links (#7998)\n * docs: drop AWS account scanning (#7997)\n * fix(aws): change CPU and Memory type of ContainerDefinition to a string (#7995)\n * fix(cli): Handle empty ignore files more gracefully (#7962)\n * fix(misconf): load full Terraform module (#7925)\n * fix(misconf): properly resolve local Terraform cache (#7983)\n * refactor(k8s): add v prefix for Go packages (#7839)\n * test: replace Go checks with Rego (#7867)\n * feat(misconf): log causes of HCL file parsing errors (#7634)\n * chore(deps): bump the aws group across 1 directory with 7 updates (#7991)\n * chore(deps): bump github.com/moby/buildkit from 0.17.0 to 0.17.2 in the docker group across 1 directory (#7990)\n * chore(deps): update csaf module dependency from csaf-poc to gocsaf (#7992)\n * chore: downgrade the failed block expand message to debug (#7964)\n * fix(misconf): do not erase variable type for child modules (#7941)\n * feat(go): construct dependencies of `go.mod` main module in the parser (#7977)\n * feat(go): construct dependencies in the parser (#7973)\n * feat: add cvss v4 score and vector in scan response (#7968)\n * docs: add `overview` page for `others` (#7972)\n * fix(sbom): Fixes for Programming Language Vulnerabilities and SBOM Package Maintainer Details (#7871)\n * feat(suse): Align SUSE/OpenSUSE OS Identifiers (#7965)\n * chore(deps): bump the common group with 4 updates (#7949)\n * feat(oracle): add `flavors` support (#7858)\n * fix(misconf): Update trivy-checks default repo to `mirror.gcr.io` (#7953)\n * chore(deps): Bump up trivy-checks to v1.3.0 (#7959)\n * fix(k8s): check all results for vulnerabilities (#7946)\n * ci(helm): bump Trivy version to 0.57.1 for Trivy Helm Chart 0.9.0 (#7945)\n * feat(secret): Add built-in secrets rules for Private Packagist (#7826)\n * docs: Fix broken links (#7900)\n * docs: fix mistakes/typos (#7942)\n * feat: Update registry fallbacks (#7679)\n * fix(alpine): add `UID` for removed packages (#7887)\n * chore(deps): bump the aws group with 6 updates (#7902)\n * chore(deps): bump the common group with 6 updates (#7904)\n * fix(debian): infinite loop (#7928)\n * fix(redhat): don\u0027t return error if `root/buildinfo/content_manifests/` contains files that are not `contentSets` files (#7912)\n * docs: add note about temporary podman socket (#7921)\n * docs: combine trivy.dev into trivy docs (#7884)\n * test: change branch in spdx schema link to check in integration tests (#7935)\n * docs: add Headlamp to the Trivy Ecosystem page (#7916)\n * fix(report): handle `git@github.com` schema for misconfigs in `sarif` report (#7898)\n * chore(k8s): enhance k8s scan log (#6997)\n * fix(terraform): set null value as fallback for missing variables (#7669)\n * fix(misconf): handle null properties in CloudFormation templates (#7813)\n * fix(fs): add missing defered Cleanup() call to post analyzer fs (#7882)\n * chore(deps): bump the common group across 1 directory with 20 updates (#7876)\n * chore: bump containerd to v2.0.0 (#7875)\n * fix: Improve version comparisons when build identifiers are present (#7873)\n * feat(k8s): add default commands for unknown platform (#7863)\n * chore(deps): bump github.com/golang-jwt/jwt/v4 from 4.5.0 to 4.5.1 (#7868)\n * refactor(secret): optimize performance by moving ToLower operation outside loop (#7862)\n * test: save `containerd` image into archive and use in tests (#7816)\n * chore(deps): bump the github-actions group across 1 directory with 2 updates (#7854)\n * chore: bump golangci-lint to v1.61.0 (#7853)\n\nUpdate to version 0.57.1:\n\n * feat: Update registry fallbacks [backport: release/v0.57] (#7944)\n * fix(redhat): don\u0027t return error if `root/buildinfo/content_manifests/` contains files that are not `contentSets` files [backport: release/v0.57] (#7939)\n * test: change branch in spdx schema link to check in integration tests [backport: release/v0.57] (#7940)\n * release: v0.57.0 [main] (#7710)\n * chore: lint `errors.Join` (#7845)\n * feat(db): append errors (#7843)\n * docs(java): add info about supported scopes (#7842)\n * docs: add example of creating whitelist of checks (#7821)\n * chore(deps): Bump trivy-checks (#7819)\n * fix(go): Do not trim v prefix from versions in Go Mod Analyzer (#7733)\n * fix(k8s): skip resources without misconfigs (#7797)\n * fix(sbom): use `Annotation` instead of `AttributionTexts` for `SPDX` formats (#7811)\n * fix(cli): add config name to skip-policy-update alias (#7820)\n * fix(helm): properly handle multiple archived dependencies (#7782)\n * refactor(misconf): Deprecate `EXCEPTIONS` for misconfiguration scanning (#7776)\n * fix(k8s)!: support k8s multi container (#7444)\n * fix(k8s): support kubernetes v1.31 (#7810)\n * docs: add Windows install instructions (#7800)\n * ci(helm): auto public Helm chart after PR merged (#7526)\n * feat: add end of life date for Ubuntu 24.10 (#7787)\n * feat(report): update gitlab template to populate operating_system value (#7735)\n * feat(misconf): Show misconfig ID in output (#7762)\n * feat(misconf): export unresolvable field of IaC types to Rego (#7765)\n * refactor(k8s): scan config files as a folder (#7690)\n * fix(license): fix license normalization for Universal Permissive License (#7766)\n * fix: enable usestdlibvars linter (#7770)\n * fix(misconf): properly expand dynamic blocks (#7612)\n * feat(cyclonedx): add file checksums to `CycloneDX` reports (#7507)\n * fix(misconf): fix for Azure Storage Account network acls adaptation (#7602)\n * refactor(misconf): simplify k8s scanner (#7717)\n * feat(parser): ignore white space in pom.xml files (#7747)\n * test: use forked images (#7755)\n * fix(java): correctly inherit `version` and `scope` from upper/root `depManagement` and `dependencies` into parents (#7541)\n * fix(misconf): check if property is not nil before conversion (#7578)\n * fix(misconf): change default ACL of digitalocean_spaces_bucket to private (#7577)\n * feat(misconf): ssl_mode support for GCP SQL DB instance (#7564)\n * test: define constants for test images (#7739)\n * docs: add note about disabled DS016 check (#7724)\n * feat(misconf): public network support for Azure Storage Account (#7601)\n * feat(cli): rename `trivy auth` to `trivy registry` (#7727)\n * docs: apt-transport-https is a transitional package (#7678)\n * refactor(misconf): introduce generic scanner (#7515)\n * fix(cli): `clean --all` deletes only relevant dirs (#7704)\n * feat(cli): add `trivy auth` (#7664)\n * fix(sbom): add options for DBs in private registries (#7660)\n * docs(report): fix reporting doc format (#7671)\n * fix(repo): `git clone` output to Stderr (#7561)\n * fix(redhat): include arch in PURL qualifiers (#7654)\n * fix(report): Fix invalid URI in SARIF report (#7645)\n * docs(report): Improve SARIF reporting doc (#7655)\n * fix(db): fix javadb downloading error handling (#7642)\n * feat(cli): error out when ignore file cannot be found (#7624)\n\nUpdate to version 0.56.2:\n\n * fix(redhat): include arch in PURL qualifiers [backport: release/v0.56] (#7702)\n * fix(sbom): add options for DBs in private registries [backport: release/v0.56] (#7691)\n\n- Update to version 0.51.1 (bsc#1227010, CVE-2024-3817):\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-Leap-16.0-packagehub-33",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2025_20117-1.json"
},
{
"category": "self",
"summary": "SUSE Bug 1227010",
"url": "https://bugzilla.suse.com/1227010"
},
{
"category": "self",
"summary": "SUSE Bug 1232948",
"url": "https://bugzilla.suse.com/1232948"
},
{
"category": "self",
"summary": "SUSE Bug 1234512",
"url": "https://bugzilla.suse.com/1234512"
},
{
"category": "self",
"summary": "SUSE Bug 1235265",
"url": "https://bugzilla.suse.com/1235265"
},
{
"category": "self",
"summary": "SUSE Bug 1237618",
"url": "https://bugzilla.suse.com/1237618"
},
{
"category": "self",
"summary": "SUSE Bug 1239225",
"url": "https://bugzilla.suse.com/1239225"
},
{
"category": "self",
"summary": "SUSE Bug 1239385",
"url": "https://bugzilla.suse.com/1239385"
},
{
"category": "self",
"summary": "SUSE Bug 1240466",
"url": "https://bugzilla.suse.com/1240466"
},
{
"category": "self",
"summary": "SUSE Bug 1241724",
"url": "https://bugzilla.suse.com/1241724"
},
{
"category": "self",
"summary": "SUSE Bug 1243633",
"url": "https://bugzilla.suse.com/1243633"
},
{
"category": "self",
"summary": "SUSE Bug 1246151",
"url": "https://bugzilla.suse.com/1246151"
},
{
"category": "self",
"summary": "SUSE Bug 1246730",
"url": "https://bugzilla.suse.com/1246730"
},
{
"category": "self",
"summary": "SUSE Bug 1248897",
"url": "https://bugzilla.suse.com/1248897"
},
{
"category": "self",
"summary": "SUSE Bug 1248937",
"url": "https://bugzilla.suse.com/1248937"
},
{
"category": "self",
"summary": "SUSE Bug 1250625",
"url": "https://bugzilla.suse.com/1250625"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-3817 page",
"url": "https://www.suse.com/security/cve/CVE-2024-3817/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-45337 page",
"url": "https://www.suse.com/security/cve/CVE-2024-45337/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-45338 page",
"url": "https://www.suse.com/security/cve/CVE-2024-45338/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2024-51744 page",
"url": "https://www.suse.com/security/cve/CVE-2024-51744/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-11065 page",
"url": "https://www.suse.com/security/cve/CVE-2025-11065/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-21613 page",
"url": "https://www.suse.com/security/cve/CVE-2025-21613/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-21614 page",
"url": "https://www.suse.com/security/cve/CVE-2025-21614/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-22868 page",
"url": "https://www.suse.com/security/cve/CVE-2025-22868/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-22869 page",
"url": "https://www.suse.com/security/cve/CVE-2025-22869/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-22872 page",
"url": "https://www.suse.com/security/cve/CVE-2025-22872/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-27144 page",
"url": "https://www.suse.com/security/cve/CVE-2025-27144/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-30204 page",
"url": "https://www.suse.com/security/cve/CVE-2025-30204/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-46569 page",
"url": "https://www.suse.com/security/cve/CVE-2025-46569/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-47291 page",
"url": "https://www.suse.com/security/cve/CVE-2025-47291/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-53547 page",
"url": "https://www.suse.com/security/cve/CVE-2025-53547/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-58058 page",
"url": "https://www.suse.com/security/cve/CVE-2025-58058/"
}
],
"title": "Security update for trivy",
"tracking": {
"current_release_date": "2025-11-27T12:27:44Z",
"generator": {
"date": "2025-11-27T12:27:44Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2025:20117-1",
"initial_release_date": "2025-11-27T12:27:44Z",
"revision_history": [
{
"date": "2025-11-27T12:27:44Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "trivy-0.66.0-bp160.1.1.aarch64",
"product": {
"name": "trivy-0.66.0-bp160.1.1.aarch64",
"product_id": "trivy-0.66.0-bp160.1.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "trivy-0.66.0-bp160.1.1.ppc64le",
"product": {
"name": "trivy-0.66.0-bp160.1.1.ppc64le",
"product_id": "trivy-0.66.0-bp160.1.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "trivy-0.66.0-bp160.1.1.s390x",
"product": {
"name": "trivy-0.66.0-bp160.1.1.s390x",
"product_id": "trivy-0.66.0-bp160.1.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "trivy-0.66.0-bp160.1.1.x86_64",
"product": {
"name": "trivy-0.66.0-bp160.1.1.x86_64",
"product_id": "trivy-0.66.0-bp160.1.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Leap 16.0",
"product": {
"name": "openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0"
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "trivy-0.66.0-bp160.1.1.aarch64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.aarch64"
},
"product_reference": "trivy-0.66.0-bp160.1.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "trivy-0.66.0-bp160.1.1.ppc64le as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.ppc64le"
},
"product_reference": "trivy-0.66.0-bp160.1.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "trivy-0.66.0-bp160.1.1.s390x as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.s390x"
},
"product_reference": "trivy-0.66.0-bp160.1.1.s390x",
"relates_to_product_reference": "openSUSE Leap 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "trivy-0.66.0-bp160.1.1.x86_64 as component of openSUSE Leap 16.0",
"product_id": "openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.x86_64"
},
"product_reference": "trivy-0.66.0-bp160.1.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 16.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2024-3817",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-3817"
}
],
"notes": [
{
"category": "general",
"text": "HashiCorp\u0027s go-getter library is vulnerable to argument injection when executing Git to discover remote branches. \n\nThis vulnerability does not affect the go-getter/v2 branch and package.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.aarch64",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.ppc64le",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.s390x",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-3817",
"url": "https://www.suse.com/security/cve/CVE-2024-3817"
},
{
"category": "external",
"summary": "SUSE Bug 1226999 for CVE-2024-3817",
"url": "https://bugzilla.suse.com/1226999"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.aarch64",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.ppc64le",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.s390x",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-11-27T12:27:44Z",
"details": "critical"
}
],
"title": "CVE-2024-3817"
},
{
"cve": "CVE-2024-45337",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-45337"
}
],
"notes": [
{
"category": "general",
"text": "Applications and libraries which misuse connection.serverAuthenticate (via callback field ServerConfig.PublicKeyCallback) may be susceptible to an authorization bypass. The documentation for ServerConfig.PublicKeyCallback says that \"A call to this function does not guarantee that the key offered is in fact used to authenticate.\" Specifically, the SSH protocol allows clients to inquire about whether a public key is acceptable before proving control of the corresponding private key. PublicKeyCallback may be called with multiple keys, and the order in which the keys were provided cannot be used to infer which key the client successfully authenticated with, if any. Some applications, which store the key(s) passed to PublicKeyCallback (or derived information) and make security relevant determinations based on it once the connection is established, may make incorrect assumptions. For example, an attacker may send public keys A and B, and then authenticate with A. PublicKeyCallback would be called only twice, first with A and then with B. A vulnerable application may then make authorization decisions based on key B for which the attacker does not actually control the private key. Since this API is widely misused, as a partial mitigation golang.org/x/cry...@v0.31.0 enforces the property that, when successfully authenticating via public key, the last key passed to ServerConfig.PublicKeyCallback will be the key used to authenticate the connection. PublicKeyCallback will now be called multiple times with the same key, if necessary. Note that the client may still not control the last key passed to PublicKeyCallback if the connection is then authenticated with a different method, such as PasswordCallback, KeyboardInteractiveCallback, or NoClientAuth. Users should be using the Extensions field of the Permissions return value from the various authentication callbacks to record data associated with the authentication attempt instead of referencing external state. Once the connection is established the state corresponding to the successful authentication attempt can be retrieved via the ServerConn.Permissions field. Note that some third-party libraries misuse the Permissions type by sharing it across authentication attempts; users of third-party libraries should refer to the relevant projects for guidance.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.aarch64",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.ppc64le",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.s390x",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-45337",
"url": "https://www.suse.com/security/cve/CVE-2024-45337"
},
{
"category": "external",
"summary": "SUSE Bug 1234482 for CVE-2024-45337",
"url": "https://bugzilla.suse.com/1234482"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.aarch64",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.ppc64le",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.s390x",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.aarch64",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.ppc64le",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.s390x",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-11-27T12:27:44Z",
"details": "important"
}
],
"title": "CVE-2024-45337"
},
{
"cve": "CVE-2024-45338",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-45338"
}
],
"notes": [
{
"category": "general",
"text": "An attacker can craft an input to the Parse functions that would be processed non-linearly with respect to its length, resulting in extremely slow parsing. This could cause a denial of service.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.aarch64",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.ppc64le",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.s390x",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-45338",
"url": "https://www.suse.com/security/cve/CVE-2024-45338"
},
{
"category": "external",
"summary": "SUSE Bug 1234794 for CVE-2024-45338",
"url": "https://bugzilla.suse.com/1234794"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.aarch64",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.ppc64le",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.s390x",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.aarch64",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.ppc64le",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.s390x",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-11-27T12:27:44Z",
"details": "moderate"
}
],
"title": "CVE-2024-45338"
},
{
"cve": "CVE-2024-51744",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2024-51744"
}
],
"notes": [
{
"category": "general",
"text": "golang-jwt is a Go implementation of JSON Web Tokens. Unclear documentation of the error behavior in `ParseWithClaims` can lead to situation where users are potentially not checking errors in the way they should be. Especially, if a token is both expired and invalid, the errors returned by `ParseWithClaims` return both error codes. If users only check for the `jwt.ErrTokenExpired ` using `error.Is`, they will ignore the embedded `jwt.ErrTokenSignatureInvalid` and thus potentially accept invalid tokens. A fix has been back-ported with the error handling logic from the `v5` branch to the `v4` branch. In this logic, the `ParseWithClaims` function will immediately return in \"dangerous\" situations (e.g., an invalid signature), limiting the combined errors only to situations where the signature is valid, but further validation failed (e.g., if the signature is valid, but is expired AND has the wrong audience). This fix is part of the 4.5.1 release. We are aware that this changes the behaviour of an established function and is not 100 % backwards compatible, so updating to 4.5.1 might break your code. In case you cannot update to 4.5.0, please make sure that you are properly checking for all errors (\"dangerous\" ones first), so that you are not running in the case detailed above.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.aarch64",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.ppc64le",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.s390x",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2024-51744",
"url": "https://www.suse.com/security/cve/CVE-2024-51744"
},
{
"category": "external",
"summary": "SUSE Bug 1232936 for CVE-2024-51744",
"url": "https://bugzilla.suse.com/1232936"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.aarch64",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.ppc64le",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.s390x",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.aarch64",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.ppc64le",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.s390x",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-11-27T12:27:44Z",
"details": "moderate"
}
],
"title": "CVE-2024-51744"
},
{
"cve": "CVE-2025-11065",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-11065"
}
],
"notes": [
{
"category": "general",
"text": "unknown",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.aarch64",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.ppc64le",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.s390x",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-11065",
"url": "https://www.suse.com/security/cve/CVE-2025-11065"
},
{
"category": "external",
"summary": "SUSE Bug 1250608 for CVE-2025-11065",
"url": "https://bugzilla.suse.com/1250608"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.aarch64",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.ppc64le",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.s390x",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.aarch64",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.ppc64le",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.s390x",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-11-27T12:27:44Z",
"details": "moderate"
}
],
"title": "CVE-2025-11065"
},
{
"cve": "CVE-2025-21613",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-21613"
}
],
"notes": [
{
"category": "general",
"text": "go-git is a highly extensible git implementation library written in pure Go. An argument injection vulnerability was discovered in go-git versions prior to v5.13. Successful exploitation of this vulnerability could allow an attacker to set arbitrary values to git-upload-pack flags. This only happens when the file transport protocol is being used, as that is the only protocol that shells out to git binaries. This vulnerability is fixed in 5.13.0.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.aarch64",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.ppc64le",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.s390x",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-21613",
"url": "https://www.suse.com/security/cve/CVE-2025-21613"
},
{
"category": "external",
"summary": "SUSE Bug 1235572 for CVE-2025-21613",
"url": "https://bugzilla.suse.com/1235572"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.aarch64",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.ppc64le",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.s390x",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.aarch64",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.ppc64le",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.s390x",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-11-27T12:27:44Z",
"details": "important"
}
],
"title": "CVE-2025-21613"
},
{
"cve": "CVE-2025-21614",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-21614"
}
],
"notes": [
{
"category": "general",
"text": "go-git is a highly extensible git implementation library written in pure Go. A denial of service (DoS) vulnerability was discovered in go-git versions prior to v5.13. This vulnerability allows an attacker to perform denial of service attacks by providing specially crafted responses from a Git server which triggers resource exhaustion in go-git clients. Users running versions of go-git from v4 and above are recommended to upgrade to v5.13 in order to mitigate this vulnerability.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.aarch64",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.ppc64le",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.s390x",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-21614",
"url": "https://www.suse.com/security/cve/CVE-2025-21614"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.aarch64",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.ppc64le",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.s390x",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-11-27T12:27:44Z",
"details": "important"
}
],
"title": "CVE-2025-21614"
},
{
"cve": "CVE-2025-22868",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-22868"
}
],
"notes": [
{
"category": "general",
"text": "An attacker can pass a malicious malformed token which causes unexpected memory to be consumed during parsing.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.aarch64",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.ppc64le",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.s390x",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-22868",
"url": "https://www.suse.com/security/cve/CVE-2025-22868"
},
{
"category": "external",
"summary": "SUSE Bug 1239185 for CVE-2025-22868",
"url": "https://bugzilla.suse.com/1239185"
},
{
"category": "external",
"summary": "SUSE Bug 1239186 for CVE-2025-22868",
"url": "https://bugzilla.suse.com/1239186"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.aarch64",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.ppc64le",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.s390x",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.aarch64",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.ppc64le",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.s390x",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-11-27T12:27:44Z",
"details": "important"
}
],
"title": "CVE-2025-22868"
},
{
"cve": "CVE-2025-22869",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-22869"
}
],
"notes": [
{
"category": "general",
"text": "SSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.aarch64",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.ppc64le",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.s390x",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-22869",
"url": "https://www.suse.com/security/cve/CVE-2025-22869"
},
{
"category": "external",
"summary": "SUSE Bug 1239322 for CVE-2025-22869",
"url": "https://bugzilla.suse.com/1239322"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.aarch64",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.ppc64le",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.s390x",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.aarch64",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.ppc64le",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.s390x",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-11-27T12:27:44Z",
"details": "important"
}
],
"title": "CVE-2025-22869"
},
{
"cve": "CVE-2025-22872",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-22872"
}
],
"notes": [
{
"category": "general",
"text": "The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character (/) as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content following such tags as being placed in the wrong scope during DOM construction, but only when tags are in foreign content (e.g. \u003cmath\u003e, \u003csvg\u003e, etc contexts).",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.aarch64",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.ppc64le",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.s390x",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-22872",
"url": "https://www.suse.com/security/cve/CVE-2025-22872"
},
{
"category": "external",
"summary": "SUSE Bug 1241710 for CVE-2025-22872",
"url": "https://bugzilla.suse.com/1241710"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.aarch64",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.ppc64le",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.s390x",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.aarch64",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.ppc64le",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.s390x",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-11-27T12:27:44Z",
"details": "moderate"
}
],
"title": "CVE-2025-22872"
},
{
"cve": "CVE-2025-27144",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-27144"
}
],
"notes": [
{
"category": "general",
"text": "Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web Token (JWT) standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE input, Go JOSE could use excessive memory. The code used strings.Split(token, \".\") to split JWT tokens, which is vulnerable to excessive memory consumption when processing maliciously crafted tokens with a large number of `.` characters. An attacker could exploit this by sending numerous malformed tokens, leading to memory exhaustion and a Denial of Service. Version 4.0.5 fixes this issue. As a workaround, applications could pre-validate that payloads passed to Go JOSE do not contain an excessive number of `.` characters.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.aarch64",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.ppc64le",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.s390x",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-27144",
"url": "https://www.suse.com/security/cve/CVE-2025-27144"
},
{
"category": "external",
"summary": "SUSE Bug 1237608 for CVE-2025-27144",
"url": "https://bugzilla.suse.com/1237608"
},
{
"category": "external",
"summary": "SUSE Bug 1237609 for CVE-2025-27144",
"url": "https://bugzilla.suse.com/1237609"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.aarch64",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.ppc64le",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.s390x",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.aarch64",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.ppc64le",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.s390x",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-11-27T12:27:44Z",
"details": "important"
}
],
"title": "CVE-2025-27144"
},
{
"cve": "CVE-2025-30204",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-30204"
}
],
"notes": [
{
"category": "general",
"text": "golang-jwt is a Go implementation of JSON Web Tokens. Starting in version 3.2.0 and prior to versions 5.2.2 and 4.5.2, the function parse.ParseUnverified splits (via a call to strings.Split) its argument (which is untrusted data) on periods. As a result, in the face of a malicious request whose Authorization header consists of Bearer followed by many period characters, a call to that function incurs allocations to the tune of O(n) bytes (where n stands for the length of the function\u0027s argument), with a constant factor of about 16. This issue is fixed in 5.2.2 and 4.5.2.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.aarch64",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.ppc64le",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.s390x",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-30204",
"url": "https://www.suse.com/security/cve/CVE-2025-30204"
},
{
"category": "external",
"summary": "SUSE Bug 1240441 for CVE-2025-30204",
"url": "https://bugzilla.suse.com/1240441"
},
{
"category": "external",
"summary": "SUSE Bug 1240442 for CVE-2025-30204",
"url": "https://bugzilla.suse.com/1240442"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.aarch64",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.ppc64le",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.s390x",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.aarch64",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.ppc64le",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.s390x",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-11-27T12:27:44Z",
"details": "important"
}
],
"title": "CVE-2025-30204"
},
{
"cve": "CVE-2025-46569",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-46569"
}
],
"notes": [
{
"category": "general",
"text": "Open Policy Agent (OPA) is an open source, general-purpose policy engine. Prior to version 1.4.0, when run as a server, OPA exposes an HTTP Data API for reading and writing documents. Requesting a virtual document through the Data API entails policy evaluation, where a Rego query containing a single data document reference is constructed from the requested path. This query is then used for policy evaluation. A HTTP request path can be crafted in a way that injects Rego code into the constructed query. The evaluation result cannot be made to return any other data than what is generated by the requested path, but this path can be misdirected, and the injected Rego code can be crafted to make the query succeed or fail; opening up for oracle attacks or, given the right circumstances, erroneous policy decision results. Furthermore, the injected code can be crafted to be computationally expensive, resulting in a Denial Of Service (DoS) attack. This issue has been patched in version 1.4.0. A workaround involves having network access to OPA\u0027s RESTful APIs being limited to `localhost` and/or trusted networks, unless necessary for production reasons.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.aarch64",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.ppc64le",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.s390x",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-46569",
"url": "https://www.suse.com/security/cve/CVE-2025-46569"
},
{
"category": "external",
"summary": "SUSE Bug 1246710 for CVE-2025-46569",
"url": "https://bugzilla.suse.com/1246710"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.aarch64",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.ppc64le",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.s390x",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.aarch64",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.ppc64le",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.s390x",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-11-27T12:27:44Z",
"details": "important"
}
],
"title": "CVE-2025-46569"
},
{
"cve": "CVE-2025-47291",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-47291"
}
],
"notes": [
{
"category": "general",
"text": "containerd is an open-source container runtime. A bug was found in the containerd\u0027s CRI implementation where containerd, starting in version 2.0.1 and prior to version 2.0.5, doesn\u0027t put usernamespaced containers under the Kubernetes\u0027 cgroup hierarchy, therefore some Kubernetes limits are not honored. This may cause a denial of service of the Kubernetes node. This bug has been fixed in containerd 2.0.5+ and 2.1.0+. Users should update to these versions to resolve the issue. As a workaround, disable usernamespaced pods in Kubernetes temporarily.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.aarch64",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.ppc64le",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.s390x",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-47291",
"url": "https://www.suse.com/security/cve/CVE-2025-47291"
},
{
"category": "external",
"summary": "SUSE Bug 1243632 for CVE-2025-47291",
"url": "https://bugzilla.suse.com/1243632"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.aarch64",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.ppc64le",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.s390x",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.aarch64",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.ppc64le",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.s390x",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-11-27T12:27:44Z",
"details": "moderate"
}
],
"title": "CVE-2025-47291"
},
{
"cve": "CVE-2025-53547",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-53547"
}
],
"notes": [
{
"category": "general",
"text": "Helm is a package manager for Charts for Kubernetes. Prior to 3.18.4, a specially crafted Chart.yaml file along with a specially linked Chart.lock file can lead to local code execution when dependencies are updated. Fields in a Chart.yaml file, that are carried over to a Chart.lock file when dependencies are updated and this file is written, can be crafted in a way that can cause execution if that same content were in a file that is executed (e.g., a bash.rc file or shell script). If the Chart.lock file is symlinked to one of these files updating dependencies will write the lock file content to the symlinked file. This can lead to unwanted execution. Helm warns of the symlinked file but did not stop execution due to symlinking. This issue has been resolved in Helm v3.18.4.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.aarch64",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.ppc64le",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.s390x",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-53547",
"url": "https://www.suse.com/security/cve/CVE-2025-53547"
},
{
"category": "external",
"summary": "SUSE Bug 1246150 for CVE-2025-53547",
"url": "https://bugzilla.suse.com/1246150"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.aarch64",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.ppc64le",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.s390x",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:H",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.aarch64",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.ppc64le",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.s390x",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-11-27T12:27:44Z",
"details": "important"
}
],
"title": "CVE-2025-53547"
},
{
"cve": "CVE-2025-58058",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-58058"
}
],
"notes": [
{
"category": "general",
"text": "xz is a pure golang package for reading and writing xz-compressed files. Prior to version 0.5.14, it is possible to put data in front of an LZMA-encoded byte stream without detecting the situation while reading the header. This can lead to increased memory consumption because the current implementation allocates the full decoding buffer directly after reading the header. The LZMA header doesn\u0027t include a magic number or has a checksum to detect such an issue according to the specification. Note that the code recognizes the issue later while reading the stream, but at this time the memory allocation has already been done. This issue has been patched in version 0.5.14.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.aarch64",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.ppc64le",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.s390x",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-58058",
"url": "https://www.suse.com/security/cve/CVE-2025-58058"
},
{
"category": "external",
"summary": "SUSE Bug 1248889 for CVE-2025-58058",
"url": "https://bugzilla.suse.com/1248889"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.aarch64",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.ppc64le",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.s390x",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.aarch64",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.ppc64le",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.s390x",
"openSUSE Leap 16.0:trivy-0.66.0-bp160.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-11-27T12:27:44Z",
"details": "moderate"
}
],
"title": "CVE-2025-58058"
}
]
}
SUSE-SU-2025:4482-1
Vulnerability from csaf_suse - Published: 2025-12-18 12:22 - Updated: 2025-12-18 12:22Summary
Security update for grafana
Notes
Title of the patch
Security update for grafana
Description of the patch
This update for grafana fixes the following issues:
grafana was updated from version 11.5.5 to 11.5.10:
- Security issues fixed:
* CVE-2025-64751: Dropped experimental implementation of authorization Zanzana server/client (version 11.5.10)
(bsc#1254113)
* CVE-2025-47911: Fixed parsing HTML documents (version 11.5.10) (bsc#1251454)
* CVE-2025-58190: Fixed excessive memory consumption (version 11.5.10) (bsc#1251657)
* CVE-2025-11065: Fixed sensitive information leak in logs (version 11.5.9) (bsc#1250616)
* CVE-2025-6023: Fixed cross-site-scripting via scripted dashboards (version 11.5.7) (bsc#1246735)
* CVE-2025-6197: Fixed open redirect in organization switching (version 11.5.7) (bsc#1246736)
* CVE-2025-3415: Fixed exposure of DingDing alerting integration URL to Viewer level users (version 11.5.6)
(bsc#1245302)
- Other changes, new features and bugs fixed:
* Version 11.5.10:
+ Use forked wire from Grafana repository instead of external package (jsc#PED-14178)
+ Auth: Fix render user OAuth passthrough.
+ LDAP Authentication: Fix URL to propagate username context as parameter.
+ Plugins: Dependencies do not inherit parent URL for preinstall.
* Version 11.5.9:
+ Auditing: Document new options for recording datasource query request/response body.
+ Login: Fixed redirection after login when Grafana is served from subpath.
* Version 11.5.7:
+ Azure: Fixed legend formatting and resource name determination in template variable queries.
Patchnames
SUSE-2025-4482,SUSE-SLE-Module-Packagehub-Subpackages-15-SP6-2025-4482,SUSE-SLE-Module-Packagehub-Subpackages-15-SP7-2025-4482,openSUSE-SLE-15.6-2025-4482
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for grafana",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for grafana fixes the following issues:\n\ngrafana was updated from version 11.5.5 to 11.5.10:\n\n- Security issues fixed:\n\n * CVE-2025-64751: Dropped experimental implementation of authorization Zanzana server/client (version 11.5.10)\n (bsc#1254113)\n * CVE-2025-47911: Fixed parsing HTML documents (version 11.5.10) (bsc#1251454)\n * CVE-2025-58190: Fixed excessive memory consumption (version 11.5.10) (bsc#1251657)\n * CVE-2025-11065: Fixed sensitive information leak in logs (version 11.5.9) (bsc#1250616)\n * CVE-2025-6023: Fixed cross-site-scripting via scripted dashboards (version 11.5.7) (bsc#1246735)\n * CVE-2025-6197: Fixed open redirect in organization switching (version 11.5.7) (bsc#1246736)\n * CVE-2025-3415: Fixed exposure of DingDing alerting integration URL to Viewer level users (version 11.5.6)\n (bsc#1245302)\n\n- Other changes, new features and bugs fixed:\n\n * Version 11.5.10:\n + Use forked wire from Grafana repository instead of external package (jsc#PED-14178)\n + Auth: Fix render user OAuth passthrough.\n + LDAP Authentication: Fix URL to propagate username context as parameter.\n + Plugins: Dependencies do not inherit parent URL for preinstall.\n\n * Version 11.5.9:\n + Auditing: Document new options for recording datasource query request/response body.\n + Login: Fixed redirection after login when Grafana is served from subpath.\n\n * Version 11.5.7:\n + Azure: Fixed legend formatting and resource name determination in template variable queries.\n\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-2025-4482,SUSE-SLE-Module-Packagehub-Subpackages-15-SP6-2025-4482,SUSE-SLE-Module-Packagehub-Subpackages-15-SP7-2025-4482,openSUSE-SLE-15.6-2025-4482",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2025_4482-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2025:4482-1",
"url": "https://www.suse.com/support/update/announcement/2025/suse-su-20254482-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2025:4482-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2025-December/023614.html"
},
{
"category": "self",
"summary": "SUSE Bug 1245302",
"url": "https://bugzilla.suse.com/1245302"
},
{
"category": "self",
"summary": "SUSE Bug 1246735",
"url": "https://bugzilla.suse.com/1246735"
},
{
"category": "self",
"summary": "SUSE Bug 1246736",
"url": "https://bugzilla.suse.com/1246736"
},
{
"category": "self",
"summary": "SUSE Bug 1250616",
"url": "https://bugzilla.suse.com/1250616"
},
{
"category": "self",
"summary": "SUSE Bug 1251454",
"url": "https://bugzilla.suse.com/1251454"
},
{
"category": "self",
"summary": "SUSE Bug 1251657",
"url": "https://bugzilla.suse.com/1251657"
},
{
"category": "self",
"summary": "SUSE Bug 1254113",
"url": "https://bugzilla.suse.com/1254113"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-11065 page",
"url": "https://www.suse.com/security/cve/CVE-2025-11065/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-3415 page",
"url": "https://www.suse.com/security/cve/CVE-2025-3415/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-47911 page",
"url": "https://www.suse.com/security/cve/CVE-2025-47911/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-58190 page",
"url": "https://www.suse.com/security/cve/CVE-2025-58190/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-6023 page",
"url": "https://www.suse.com/security/cve/CVE-2025-6023/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-6197 page",
"url": "https://www.suse.com/security/cve/CVE-2025-6197/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-64751 page",
"url": "https://www.suse.com/security/cve/CVE-2025-64751/"
}
],
"title": "Security update for grafana",
"tracking": {
"current_release_date": "2025-12-18T12:22:20Z",
"generator": {
"date": "2025-12-18T12:22:20Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2025:4482-1",
"initial_release_date": "2025-12-18T12:22:20Z",
"revision_history": [
{
"date": "2025-12-18T12:22:20Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "grafana-11.5.10-150200.3.80.1.aarch64",
"product": {
"name": "grafana-11.5.10-150200.3.80.1.aarch64",
"product_id": "grafana-11.5.10-150200.3.80.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "grafana-11.5.10-150200.3.80.1.ppc64le",
"product": {
"name": "grafana-11.5.10-150200.3.80.1.ppc64le",
"product_id": "grafana-11.5.10-150200.3.80.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "grafana-11.5.10-150200.3.80.1.s390x",
"product": {
"name": "grafana-11.5.10-150200.3.80.1.s390x",
"product_id": "grafana-11.5.10-150200.3.80.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "grafana-11.5.10-150200.3.80.1.x86_64",
"product": {
"name": "grafana-11.5.10-150200.3.80.1.x86_64",
"product_id": "grafana-11.5.10-150200.3.80.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Module for Package Hub 15 SP6",
"product": {
"name": "SUSE Linux Enterprise Module for Package Hub 15 SP6",
"product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP6",
"product_identification_helper": {
"cpe": "cpe:/o:suse:packagehub:15:sp6"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Module for Package Hub 15 SP7",
"product": {
"name": "SUSE Linux Enterprise Module for Package Hub 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP7",
"product_identification_helper": {
"cpe": "cpe:/o:suse:packagehub:15:sp7"
}
}
},
{
"category": "product_name",
"name": "openSUSE Leap 15.6",
"product": {
"name": "openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:leap:15.6"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-11.5.10-150200.3.80.1.aarch64 as component of SUSE Linux Enterprise Module for Package Hub 15 SP6",
"product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.aarch64"
},
"product_reference": "grafana-11.5.10-150200.3.80.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-11.5.10-150200.3.80.1.ppc64le as component of SUSE Linux Enterprise Module for Package Hub 15 SP6",
"product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.ppc64le"
},
"product_reference": "grafana-11.5.10-150200.3.80.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-11.5.10-150200.3.80.1.s390x as component of SUSE Linux Enterprise Module for Package Hub 15 SP6",
"product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.s390x"
},
"product_reference": "grafana-11.5.10-150200.3.80.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-11.5.10-150200.3.80.1.x86_64 as component of SUSE Linux Enterprise Module for Package Hub 15 SP6",
"product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.x86_64"
},
"product_reference": "grafana-11.5.10-150200.3.80.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-11.5.10-150200.3.80.1.aarch64 as component of SUSE Linux Enterprise Module for Package Hub 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.aarch64"
},
"product_reference": "grafana-11.5.10-150200.3.80.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-11.5.10-150200.3.80.1.ppc64le as component of SUSE Linux Enterprise Module for Package Hub 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.ppc64le"
},
"product_reference": "grafana-11.5.10-150200.3.80.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-11.5.10-150200.3.80.1.s390x as component of SUSE Linux Enterprise Module for Package Hub 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.s390x"
},
"product_reference": "grafana-11.5.10-150200.3.80.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-11.5.10-150200.3.80.1.x86_64 as component of SUSE Linux Enterprise Module for Package Hub 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.x86_64"
},
"product_reference": "grafana-11.5.10-150200.3.80.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Package Hub 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-11.5.10-150200.3.80.1.aarch64 as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.aarch64"
},
"product_reference": "grafana-11.5.10-150200.3.80.1.aarch64",
"relates_to_product_reference": "openSUSE Leap 15.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-11.5.10-150200.3.80.1.ppc64le as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.ppc64le"
},
"product_reference": "grafana-11.5.10-150200.3.80.1.ppc64le",
"relates_to_product_reference": "openSUSE Leap 15.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-11.5.10-150200.3.80.1.s390x as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.s390x"
},
"product_reference": "grafana-11.5.10-150200.3.80.1.s390x",
"relates_to_product_reference": "openSUSE Leap 15.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-11.5.10-150200.3.80.1.x86_64 as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.x86_64"
},
"product_reference": "grafana-11.5.10-150200.3.80.1.x86_64",
"relates_to_product_reference": "openSUSE Leap 15.6"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-11065",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-11065"
}
],
"notes": [
{
"category": "general",
"text": "unknown",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.x86_64",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.aarch64",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.ppc64le",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.s390x",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-11065",
"url": "https://www.suse.com/security/cve/CVE-2025-11065"
},
{
"category": "external",
"summary": "SUSE Bug 1250608 for CVE-2025-11065",
"url": "https://bugzilla.suse.com/1250608"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.x86_64",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.aarch64",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.ppc64le",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.s390x",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.x86_64",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.aarch64",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.ppc64le",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.s390x",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-12-18T12:22:20Z",
"details": "moderate"
}
],
"title": "CVE-2025-11065"
},
{
"cve": "CVE-2025-3415",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-3415"
}
],
"notes": [
{
"category": "general",
"text": "Grafana is an open-source platform for monitoring and observability. The Grafana Alerting DingDing integration was not properly protected and could be exposed to users with Viewer permission. \nFixed in versions 10.4.19+security-01, 11.2.10+security-01, 11.3.7+security-01, 11.4.5+security-01, 11.5.5+security-01, 11.6.2+security-01 and 12.0.1+security-01",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.x86_64",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.aarch64",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.ppc64le",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.s390x",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-3415",
"url": "https://www.suse.com/security/cve/CVE-2025-3415"
},
{
"category": "external",
"summary": "SUSE Bug 1245302 for CVE-2025-3415",
"url": "https://bugzilla.suse.com/1245302"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.x86_64",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.aarch64",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.ppc64le",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.s390x",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.x86_64",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.aarch64",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.ppc64le",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.s390x",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-12-18T12:22:20Z",
"details": "moderate"
}
],
"title": "CVE-2025-3415"
},
{
"cve": "CVE-2025-47911",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-47911"
}
],
"notes": [
{
"category": "general",
"text": "unknown",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.x86_64",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.aarch64",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.ppc64le",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.s390x",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-47911",
"url": "https://www.suse.com/security/cve/CVE-2025-47911"
},
{
"category": "external",
"summary": "SUSE Bug 1251308 for CVE-2025-47911",
"url": "https://bugzilla.suse.com/1251308"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.x86_64",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.aarch64",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.ppc64le",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.s390x",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.x86_64",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.aarch64",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.ppc64le",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.s390x",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-12-18T12:22:20Z",
"details": "moderate"
}
],
"title": "CVE-2025-47911"
},
{
"cve": "CVE-2025-58190",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-58190"
}
],
"notes": [
{
"category": "general",
"text": "unknown",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.x86_64",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.aarch64",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.ppc64le",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.s390x",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-58190",
"url": "https://www.suse.com/security/cve/CVE-2025-58190"
},
{
"category": "external",
"summary": "SUSE Bug 1251309 for CVE-2025-58190",
"url": "https://bugzilla.suse.com/1251309"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.x86_64",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.aarch64",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.ppc64le",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.s390x",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.x86_64",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.aarch64",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.ppc64le",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.s390x",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-12-18T12:22:20Z",
"details": "moderate"
}
],
"title": "CVE-2025-58190"
},
{
"cve": "CVE-2025-6023",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-6023"
}
],
"notes": [
{
"category": "general",
"text": "An open redirect vulnerability has been identified in Grafana OSS that can be exploited to achieve XSS attacks. The vulnerability was introduced in Grafana v11.5.0.\n\nThe open redirect can be chained with path traversal vulnerabilities to achieve XSS.\n\nFixed in versions 12.0.2+security-01, 11.6.3+security-01, 11.5.6+security-01, 11.4.6+security-01 and 11.3.8+security-01",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.x86_64",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.aarch64",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.ppc64le",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.s390x",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-6023",
"url": "https://www.suse.com/security/cve/CVE-2025-6023"
},
{
"category": "external",
"summary": "SUSE Bug 1246735 for CVE-2025-6023",
"url": "https://bugzilla.suse.com/1246735"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.x86_64",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.aarch64",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.ppc64le",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.s390x",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.x86_64",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.aarch64",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.ppc64le",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.s390x",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-12-18T12:22:20Z",
"details": "important"
}
],
"title": "CVE-2025-6023"
},
{
"cve": "CVE-2025-6197",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-6197"
}
],
"notes": [
{
"category": "general",
"text": "An open redirect vulnerability has been identified in Grafana OSS organization switching functionality.\n\n\nPrerequisites for exploitation:\n\n- Multiple organizations must exist in the Grafana instance\n\n- Victim must be on a different organization than the one specified in the URL",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.x86_64",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.aarch64",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.ppc64le",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.s390x",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-6197",
"url": "https://www.suse.com/security/cve/CVE-2025-6197"
},
{
"category": "external",
"summary": "SUSE Bug 1246736 for CVE-2025-6197",
"url": "https://bugzilla.suse.com/1246736"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.x86_64",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.aarch64",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.ppc64le",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.s390x",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.2,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.x86_64",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.aarch64",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.ppc64le",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.s390x",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-12-18T12:22:20Z",
"details": "moderate"
}
],
"title": "CVE-2025-6197"
},
{
"cve": "CVE-2025-64751",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-64751"
}
],
"notes": [
{
"category": "general",
"text": "OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA v1.4.0 to v1.11.0 ( openfga-0.1.34 \u003c= Helm chart \u003c= openfga-0.2.48, v.1.4.0 \u003c= docker \u003c= v.1.11.0) are vulnerable to improper policy enforcement when certain Check and ListObject calls are executed. This issue has been patched in version 1.11.1.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.x86_64",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.aarch64",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.ppc64le",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.s390x",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-64751",
"url": "https://www.suse.com/security/cve/CVE-2025-64751"
},
{
"category": "external",
"summary": "SUSE Bug 1254112 for CVE-2025-64751",
"url": "https://bugzilla.suse.com/1254112"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.x86_64",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.aarch64",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.ppc64le",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.s390x",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP6:grafana-11.5.10-150200.3.80.1.x86_64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.aarch64",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.ppc64le",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.s390x",
"SUSE Linux Enterprise Module for Package Hub 15 SP7:grafana-11.5.10-150200.3.80.1.x86_64",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.aarch64",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.ppc64le",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.s390x",
"openSUSE Leap 15.6:grafana-11.5.10-150200.3.80.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-12-18T12:22:20Z",
"details": "important"
}
],
"title": "CVE-2025-64751"
}
]
}
SUSE-SU-2025:4121-1
Vulnerability from csaf_suse - Published: 2025-11-17 12:10 - Updated: 2025-11-17 12:10Summary
Security update for alloy
Notes
Title of the patch
Security update for alloy
Description of the patch
This update for alloy fixes the following issues:
- update to 1.11.3:
- CVE-2025-58058: Fixed memory leaks in xz. (bsc#1248960)
- CVE-2025-11065: Fixed sensitive Information leak in logs. (bsc#1250621)
Patchnames
SUSE-2025-4121,SUSE-SLE-Module-Basesystem-15-SP7-2025-4121
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for alloy",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for alloy fixes the following issues:\n\n- update to 1.11.3:\n- CVE-2025-58058: Fixed memory leaks in xz. (bsc#1248960)\n- CVE-2025-11065: Fixed sensitive Information leak in logs. (bsc#1250621)\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-2025-4121,SUSE-SLE-Module-Basesystem-15-SP7-2025-4121",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2025_4121-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2025:4121-1",
"url": "https://www.suse.com/support/update/announcement/2025/suse-su-20254121-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2025:4121-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2025-November/023295.html"
},
{
"category": "self",
"summary": "SUSE Bug 1248960",
"url": "https://bugzilla.suse.com/1248960"
},
{
"category": "self",
"summary": "SUSE Bug 1250621",
"url": "https://bugzilla.suse.com/1250621"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-11065 page",
"url": "https://www.suse.com/security/cve/CVE-2025-11065/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-58058 page",
"url": "https://www.suse.com/security/cve/CVE-2025-58058/"
}
],
"title": "Security update for alloy",
"tracking": {
"current_release_date": "2025-11-17T12:10:11Z",
"generator": {
"date": "2025-11-17T12:10:11Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2025:4121-1",
"initial_release_date": "2025-11-17T12:10:11Z",
"revision_history": [
{
"date": "2025-11-17T12:10:11Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "alloy-1.11.3-150700.15.9.1.aarch64",
"product": {
"name": "alloy-1.11.3-150700.15.9.1.aarch64",
"product_id": "alloy-1.11.3-150700.15.9.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "alloy-1.11.3-150700.15.9.1.ppc64le",
"product": {
"name": "alloy-1.11.3-150700.15.9.1.ppc64le",
"product_id": "alloy-1.11.3-150700.15.9.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "alloy-1.11.3-150700.15.9.1.s390x",
"product": {
"name": "alloy-1.11.3-150700.15.9.1.s390x",
"product_id": "alloy-1.11.3-150700.15.9.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "alloy-1.11.3-150700.15.9.1.x86_64",
"product": {
"name": "alloy-1.11.3-150700.15.9.1.x86_64",
"product_id": "alloy-1.11.3-150700.15.9.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Module for Basesystem 15 SP7",
"product": {
"name": "SUSE Linux Enterprise Module for Basesystem 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle-module-basesystem:15:sp7"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "alloy-1.11.3-150700.15.9.1.aarch64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:alloy-1.11.3-150700.15.9.1.aarch64"
},
"product_reference": "alloy-1.11.3-150700.15.9.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "alloy-1.11.3-150700.15.9.1.ppc64le as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:alloy-1.11.3-150700.15.9.1.ppc64le"
},
"product_reference": "alloy-1.11.3-150700.15.9.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "alloy-1.11.3-150700.15.9.1.s390x as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:alloy-1.11.3-150700.15.9.1.s390x"
},
"product_reference": "alloy-1.11.3-150700.15.9.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "alloy-1.11.3-150700.15.9.1.x86_64 as component of SUSE Linux Enterprise Module for Basesystem 15 SP7",
"product_id": "SUSE Linux Enterprise Module for Basesystem 15 SP7:alloy-1.11.3-150700.15.9.1.x86_64"
},
"product_reference": "alloy-1.11.3-150700.15.9.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Module for Basesystem 15 SP7"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-11065",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-11065"
}
],
"notes": [
{
"category": "general",
"text": "unknown",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Basesystem 15 SP7:alloy-1.11.3-150700.15.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:alloy-1.11.3-150700.15.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:alloy-1.11.3-150700.15.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:alloy-1.11.3-150700.15.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-11065",
"url": "https://www.suse.com/security/cve/CVE-2025-11065"
},
{
"category": "external",
"summary": "SUSE Bug 1250608 for CVE-2025-11065",
"url": "https://bugzilla.suse.com/1250608"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Basesystem 15 SP7:alloy-1.11.3-150700.15.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:alloy-1.11.3-150700.15.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:alloy-1.11.3-150700.15.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:alloy-1.11.3-150700.15.9.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Basesystem 15 SP7:alloy-1.11.3-150700.15.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:alloy-1.11.3-150700.15.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:alloy-1.11.3-150700.15.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:alloy-1.11.3-150700.15.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-11-17T12:10:11Z",
"details": "moderate"
}
],
"title": "CVE-2025-11065"
},
{
"cve": "CVE-2025-58058",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-58058"
}
],
"notes": [
{
"category": "general",
"text": "xz is a pure golang package for reading and writing xz-compressed files. Prior to version 0.5.14, it is possible to put data in front of an LZMA-encoded byte stream without detecting the situation while reading the header. This can lead to increased memory consumption because the current implementation allocates the full decoding buffer directly after reading the header. The LZMA header doesn\u0027t include a magic number or has a checksum to detect such an issue according to the specification. Note that the code recognizes the issue later while reading the stream, but at this time the memory allocation has already been done. This issue has been patched in version 0.5.14.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Module for Basesystem 15 SP7:alloy-1.11.3-150700.15.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:alloy-1.11.3-150700.15.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:alloy-1.11.3-150700.15.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:alloy-1.11.3-150700.15.9.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-58058",
"url": "https://www.suse.com/security/cve/CVE-2025-58058"
},
{
"category": "external",
"summary": "SUSE Bug 1248889 for CVE-2025-58058",
"url": "https://bugzilla.suse.com/1248889"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Module for Basesystem 15 SP7:alloy-1.11.3-150700.15.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:alloy-1.11.3-150700.15.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:alloy-1.11.3-150700.15.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:alloy-1.11.3-150700.15.9.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Module for Basesystem 15 SP7:alloy-1.11.3-150700.15.9.1.aarch64",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:alloy-1.11.3-150700.15.9.1.ppc64le",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:alloy-1.11.3-150700.15.9.1.s390x",
"SUSE Linux Enterprise Module for Basesystem 15 SP7:alloy-1.11.3-150700.15.9.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-11-17T12:10:11Z",
"details": "moderate"
}
],
"title": "CVE-2025-58058"
}
]
}
SUSE-SU-2025:4479-1
Vulnerability from csaf_suse - Published: 2025-12-18 12:15 - Updated: 2025-12-18 12:15Summary
Security update 4.3.16.2 for Multi-Linux Manager Server LTS
Notes
Title of the patch
Security update 4.3.16.2 for Multi-Linux Manager Server LTS
Description of the patch
This update fixes the following issues:
release-notes-susemanager:
- Update to SUSE Manager 4.3.16.2
* SUSE Linux Enterprise Server 15 SP6 LTSS channels enabled
* CVEs Fixed:
CVE-2025-11065, CVE-2025-64751, CCVE-2025-47911, CVE-2025-58190
CVE-2025-62349, CVE-2025-62348
* Bugs mentioned:
bsc#1237060, bsc#1241455, bsc#1250911, bsc#1251864, bsc#1253024
Patchnames
SUSE-2025-4479,SUSE-SLE-Product-SUSE-Manager-Proxy-4.3-LTS-2025-4479,SUSE-SLE-Product-SUSE-Manager-Server-4.3-LTS-2025-4479
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update 4.3.16.2 for Multi-Linux Manager Server LTS",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update fixes the following issues:\n\nrelease-notes-susemanager:\n\n- Update to SUSE Manager 4.3.16.2\n * SUSE Linux Enterprise Server 15 SP6 LTSS channels enabled\n * CVEs Fixed:\n CVE-2025-11065, CVE-2025-64751, CCVE-2025-47911, CVE-2025-58190\n CVE-2025-62349, CVE-2025-62348\n * Bugs mentioned:\n bsc#1237060, bsc#1241455, bsc#1250911, bsc#1251864, bsc#1253024\n\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-2025-4479,SUSE-SLE-Product-SUSE-Manager-Proxy-4.3-LTS-2025-4479,SUSE-SLE-Product-SUSE-Manager-Server-4.3-LTS-2025-4479",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2025_4479-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2025:4479-1",
"url": "https://www.suse.com/support/update/announcement/2025/suse-su-20254479-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2025:4479-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2025-December/023616.html"
},
{
"category": "self",
"summary": "SUSE Bug 1237060",
"url": "https://bugzilla.suse.com/1237060"
},
{
"category": "self",
"summary": "SUSE Bug 1241455",
"url": "https://bugzilla.suse.com/1241455"
},
{
"category": "self",
"summary": "SUSE Bug 1250911",
"url": "https://bugzilla.suse.com/1250911"
},
{
"category": "self",
"summary": "SUSE Bug 1251864",
"url": "https://bugzilla.suse.com/1251864"
},
{
"category": "self",
"summary": "SUSE Bug 1253024",
"url": "https://bugzilla.suse.com/1253024"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-11065 page",
"url": "https://www.suse.com/security/cve/CVE-2025-11065/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-47911 page",
"url": "https://www.suse.com/security/cve/CVE-2025-47911/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-58190 page",
"url": "https://www.suse.com/security/cve/CVE-2025-58190/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-62348 page",
"url": "https://www.suse.com/security/cve/CVE-2025-62348/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-62349 page",
"url": "https://www.suse.com/security/cve/CVE-2025-62349/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-64751 page",
"url": "https://www.suse.com/security/cve/CVE-2025-64751/"
}
],
"title": "Security update 4.3.16.2 for Multi-Linux Manager Server LTS",
"tracking": {
"current_release_date": "2025-12-18T12:15:07Z",
"generator": {
"date": "2025-12-18T12:15:07Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2025:4479-1",
"initial_release_date": "2025-12-18T12:15:07Z",
"revision_history": [
{
"date": "2025-12-18T12:15:07Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "release-notes-susemanager-4.3.16.2-150400.3.148.1.noarch",
"product": {
"name": "release-notes-susemanager-4.3.16.2-150400.3.148.1.noarch",
"product_id": "release-notes-susemanager-4.3.16.2-150400.3.148.1.noarch"
}
},
{
"category": "product_version",
"name": "release-notes-susemanager-proxy-4.3.16.2-150400.3.104.2.noarch",
"product": {
"name": "release-notes-susemanager-proxy-4.3.16.2-150400.3.104.2.noarch",
"product_id": "release-notes-susemanager-proxy-4.3.16.2-150400.3.104.2.noarch"
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Manager Proxy LTS 4.3",
"product": {
"name": "SUSE Manager Proxy LTS 4.3",
"product_id": "SUSE Manager Proxy LTS 4.3",
"product_identification_helper": {
"cpe": "cpe:/o:suse:suse-manager-proxy-lts:4.3"
}
}
},
{
"category": "product_name",
"name": "SUSE Manager Server LTS 4.3",
"product": {
"name": "SUSE Manager Server LTS 4.3",
"product_id": "SUSE Manager Server LTS 4.3",
"product_identification_helper": {
"cpe": "cpe:/o:suse:suse-manager-server-lts:4.3"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "release-notes-susemanager-proxy-4.3.16.2-150400.3.104.2.noarch as component of SUSE Manager Proxy LTS 4.3",
"product_id": "SUSE Manager Proxy LTS 4.3:release-notes-susemanager-proxy-4.3.16.2-150400.3.104.2.noarch"
},
"product_reference": "release-notes-susemanager-proxy-4.3.16.2-150400.3.104.2.noarch",
"relates_to_product_reference": "SUSE Manager Proxy LTS 4.3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "release-notes-susemanager-4.3.16.2-150400.3.148.1.noarch as component of SUSE Manager Server LTS 4.3",
"product_id": "SUSE Manager Server LTS 4.3:release-notes-susemanager-4.3.16.2-150400.3.148.1.noarch"
},
"product_reference": "release-notes-susemanager-4.3.16.2-150400.3.148.1.noarch",
"relates_to_product_reference": "SUSE Manager Server LTS 4.3"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-11065",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-11065"
}
],
"notes": [
{
"category": "general",
"text": "unknown",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Manager Proxy LTS 4.3:release-notes-susemanager-proxy-4.3.16.2-150400.3.104.2.noarch",
"SUSE Manager Server LTS 4.3:release-notes-susemanager-4.3.16.2-150400.3.148.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-11065",
"url": "https://www.suse.com/security/cve/CVE-2025-11065"
},
{
"category": "external",
"summary": "SUSE Bug 1250608 for CVE-2025-11065",
"url": "https://bugzilla.suse.com/1250608"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Manager Proxy LTS 4.3:release-notes-susemanager-proxy-4.3.16.2-150400.3.104.2.noarch",
"SUSE Manager Server LTS 4.3:release-notes-susemanager-4.3.16.2-150400.3.148.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Manager Proxy LTS 4.3:release-notes-susemanager-proxy-4.3.16.2-150400.3.104.2.noarch",
"SUSE Manager Server LTS 4.3:release-notes-susemanager-4.3.16.2-150400.3.148.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-12-18T12:15:07Z",
"details": "moderate"
}
],
"title": "CVE-2025-11065"
},
{
"cve": "CVE-2025-47911",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-47911"
}
],
"notes": [
{
"category": "general",
"text": "unknown",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Manager Proxy LTS 4.3:release-notes-susemanager-proxy-4.3.16.2-150400.3.104.2.noarch",
"SUSE Manager Server LTS 4.3:release-notes-susemanager-4.3.16.2-150400.3.148.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-47911",
"url": "https://www.suse.com/security/cve/CVE-2025-47911"
},
{
"category": "external",
"summary": "SUSE Bug 1251308 for CVE-2025-47911",
"url": "https://bugzilla.suse.com/1251308"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Manager Proxy LTS 4.3:release-notes-susemanager-proxy-4.3.16.2-150400.3.104.2.noarch",
"SUSE Manager Server LTS 4.3:release-notes-susemanager-4.3.16.2-150400.3.148.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"SUSE Manager Proxy LTS 4.3:release-notes-susemanager-proxy-4.3.16.2-150400.3.104.2.noarch",
"SUSE Manager Server LTS 4.3:release-notes-susemanager-4.3.16.2-150400.3.148.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-12-18T12:15:07Z",
"details": "moderate"
}
],
"title": "CVE-2025-47911"
},
{
"cve": "CVE-2025-58190",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-58190"
}
],
"notes": [
{
"category": "general",
"text": "unknown",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Manager Proxy LTS 4.3:release-notes-susemanager-proxy-4.3.16.2-150400.3.104.2.noarch",
"SUSE Manager Server LTS 4.3:release-notes-susemanager-4.3.16.2-150400.3.148.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-58190",
"url": "https://www.suse.com/security/cve/CVE-2025-58190"
},
{
"category": "external",
"summary": "SUSE Bug 1251309 for CVE-2025-58190",
"url": "https://bugzilla.suse.com/1251309"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Manager Proxy LTS 4.3:release-notes-susemanager-proxy-4.3.16.2-150400.3.104.2.noarch",
"SUSE Manager Server LTS 4.3:release-notes-susemanager-4.3.16.2-150400.3.148.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"SUSE Manager Proxy LTS 4.3:release-notes-susemanager-proxy-4.3.16.2-150400.3.104.2.noarch",
"SUSE Manager Server LTS 4.3:release-notes-susemanager-4.3.16.2-150400.3.148.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-12-18T12:15:07Z",
"details": "moderate"
}
],
"title": "CVE-2025-58190"
},
{
"cve": "CVE-2025-62348",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-62348"
}
],
"notes": [
{
"category": "general",
"text": "unknown",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Manager Proxy LTS 4.3:release-notes-susemanager-proxy-4.3.16.2-150400.3.104.2.noarch",
"SUSE Manager Server LTS 4.3:release-notes-susemanager-4.3.16.2-150400.3.148.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-62348",
"url": "https://www.suse.com/security/cve/CVE-2025-62348"
},
{
"category": "external",
"summary": "SUSE Bug 1254256 for CVE-2025-62348",
"url": "https://bugzilla.suse.com/1254256"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Manager Proxy LTS 4.3:release-notes-susemanager-proxy-4.3.16.2-150400.3.104.2.noarch",
"SUSE Manager Server LTS 4.3:release-notes-susemanager-4.3.16.2-150400.3.148.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"SUSE Manager Proxy LTS 4.3:release-notes-susemanager-proxy-4.3.16.2-150400.3.104.2.noarch",
"SUSE Manager Server LTS 4.3:release-notes-susemanager-4.3.16.2-150400.3.148.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-12-18T12:15:07Z",
"details": "important"
}
],
"title": "CVE-2025-62348"
},
{
"cve": "CVE-2025-62349",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-62349"
}
],
"notes": [
{
"category": "general",
"text": "unknown",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Manager Proxy LTS 4.3:release-notes-susemanager-proxy-4.3.16.2-150400.3.104.2.noarch",
"SUSE Manager Server LTS 4.3:release-notes-susemanager-4.3.16.2-150400.3.148.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-62349",
"url": "https://www.suse.com/security/cve/CVE-2025-62349"
},
{
"category": "external",
"summary": "SUSE Bug 1254257 for CVE-2025-62349",
"url": "https://bugzilla.suse.com/1254257"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Manager Proxy LTS 4.3:release-notes-susemanager-proxy-4.3.16.2-150400.3.104.2.noarch",
"SUSE Manager Server LTS 4.3:release-notes-susemanager-4.3.16.2-150400.3.148.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"products": [
"SUSE Manager Proxy LTS 4.3:release-notes-susemanager-proxy-4.3.16.2-150400.3.104.2.noarch",
"SUSE Manager Server LTS 4.3:release-notes-susemanager-4.3.16.2-150400.3.148.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-12-18T12:15:07Z",
"details": "moderate"
}
],
"title": "CVE-2025-62349"
},
{
"cve": "CVE-2025-64751",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-64751"
}
],
"notes": [
{
"category": "general",
"text": "OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA v1.4.0 to v1.11.0 ( openfga-0.1.34 \u003c= Helm chart \u003c= openfga-0.2.48, v.1.4.0 \u003c= docker \u003c= v.1.11.0) are vulnerable to improper policy enforcement when certain Check and ListObject calls are executed. This issue has been patched in version 1.11.1.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Manager Proxy LTS 4.3:release-notes-susemanager-proxy-4.3.16.2-150400.3.104.2.noarch",
"SUSE Manager Server LTS 4.3:release-notes-susemanager-4.3.16.2-150400.3.148.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-64751",
"url": "https://www.suse.com/security/cve/CVE-2025-64751"
},
{
"category": "external",
"summary": "SUSE Bug 1254112 for CVE-2025-64751",
"url": "https://bugzilla.suse.com/1254112"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Manager Proxy LTS 4.3:release-notes-susemanager-proxy-4.3.16.2-150400.3.104.2.noarch",
"SUSE Manager Server LTS 4.3:release-notes-susemanager-4.3.16.2-150400.3.148.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Manager Proxy LTS 4.3:release-notes-susemanager-proxy-4.3.16.2-150400.3.104.2.noarch",
"SUSE Manager Server LTS 4.3:release-notes-susemanager-4.3.16.2-150400.3.148.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-12-18T12:15:07Z",
"details": "important"
}
],
"title": "CVE-2025-64751"
}
]
}
SUSE-SU-2025:4457-1
Vulnerability from csaf_suse - Published: 2025-12-18 11:56 - Updated: 2025-12-18 11:56Summary
Security update 5.0.6 for Multi-Linux Manager Client Tools
Notes
Title of the patch
Security update 5.0.6 for Multi-Linux Manager Client Tools
Description of the patch
This update fixes the following issues:
golang-github-prometheus-alertmanager:
- Update to version 0.28.1 (jsc#PED-13285):
* Improved performance of inhibition rules when using Equal
labels.
* Improve the documentation on escaping in UTF-8 matchers.
* Update alertmanager_config_hash metric help to document the
hash is not cryptographically strong.
* Fix panic in amtool when using --verbose.
* Fix templating of channel field for Rocket.Chat.
* Fix rocketchat_configs written as rocket_configs in docs.
* Fix usage for --enable-feature flag.
* Trim whitespace from OpsGenie API Key.
* Fix Jira project template not rendered when searching for
existing issues.
* Fix subtle bug in JSON/YAML encoding of inhibition rules that
would cause Equal labels to be omitted.
* Fix header for slack_configs in docs.
* Fix weight and wrap of Microsoft Teams notifications.
- Upgrade to version 0.28.0:
* CVE-2025-47908: Bump github.com/rs/cors (bsc#1247748).
* Templating errors in the SNS integration now return an error.
* Adopt log/slog, drop go-kit/log.
* Add a new Microsoft Teams integration based on Flows.
* Add a new Rocket.Chat integration.
* Add a new Jira integration.
* Add support for GOMEMLIMIT, enable it via the feature flag
--enable-feature=auto-gomemlimit.
* Add support for GOMAXPROCS, enable it via the feature flag
--enable-feature=auto-gomaxprocs.
* Add support for limits of silences including the maximum number
of active and pending silences, and the maximum size per
silence (in bytes). You can use the flags
--silences.max-silences and --silences.max-silence-size-bytes
to set them accordingly.
* Muted alerts now show whether they are suppressed or not in
both the /api/v2/alerts endpoint and the Alertmanager UI.
- Upgrade to version 0.27.0:
* API: Removal of all api/v1/ endpoints. These endpoints
now log and return a deprecation message and respond with a
status code of 410.
* UTF-8 Support: Introduction of support for any UTF-8
character as part of label names and matchers.
* Discord Integration: Enforce max length in message.
* Metrics: Introduced the experimental feature flag
--enable-feature=receiver-name-in-metrics to include the
receiver name.
* Metrics: Introduced a new gauge named
alertmanager_inhibition_rules that counts the number of
configured inhibition rules.
* Metrics: Introduced a new counter named
alertmanager_alerts_supressed_total that tracks muted alerts,
it contains a reason label to indicate the source of the mute.
* Discord Integration: Introduced support for webhook_url_file.
* Microsoft Teams Integration: Introduced support for
webhook_url_file.
* Microsoft Teams Integration: Add support for summary.
* Metrics: Notification metrics now support two new values for
the label reason, contextCanceled and contextDeadlineExceeded.
* Email Integration: Contents of auth_password_file are now
trimmed of prefixed and suffixed whitespace.
* amtool: Fixes the error scheme required for webhook url when
using amtool with --alertmanager.url.
* Mixin: Fix AlertmanagerFailedToSendAlerts,
AlertmanagerClusterFailedToSendAlerts, and
AlertmanagerClusterFailedToSendAlerts to make sure they ignore
the reason label.
grafana was updated from version 11.5.5 to 11.5.10:
- Security issues fixed:
* CVE-2025-47911: Fix parsing HTML documents (bsc#1251454)
* CVE-2025-58190: Fix excessive memory consumption (bsc#1251657)
* CVE-2025-64751: Drop experimental implementation of authorization Zanzana server/client
(bsc#1254113)
* CVE-2025-11065: Fixed sensitive information leak in logs (version 11.5.9) (bsc#1250616)
* CVE-2025-6023: Fixed cross-site-scripting via scripted dashboards (version 11.5.7) (bsc#1246735)
* CVE-2025-6197: Fixed open redirect in organization switching (version 11.5.7) (bsc#1246736)
* CVE-2025-3415: Fixed exposure of DingDing alerting integration URL to Viewer level users (version 11.5.6)
(bsc#1245302)
- Other changes, new features and bugs fixed:
* Version 11.5.10:
+ Update to Go 1.25
+ Update to golang.org/x/net v0.45.0
+ Auth: Fix render user OAuth passthrough
+ LDAP Authentication: Fix URL to propagate username context as parameter
* Version 11.5.9:
+ Auditing: Document new options for recording datasource query request/response body.
+ Login: Fixed redirection after login when Grafana is served from subpath.
* Version 11.5.7:
+ Azure: Fixed legend formatting and resource name determination in template variable queries.
mgr-push:
- Version 5.0.3-0
* Fixed syntax error in changelog
rhnlib:
- Version 5.0.6-0
* Use more secure defusedxml parser (bsc#1227577)
spacecmd:
- Version 5.0.14-0:
* Fixed installation of python lib files on Ubuntu 24.04 (bsc#1246586)
* Use JSON instead of pickle for spacecmd cache (bsc#1227579)
* Make spacecmd to work with Python 3.12 and higher
* Call print statements properly in Python 3
supportutils-plugin-susemanager-client:
- Version 5.0.5-0
* Fix syntax error in changelog
uyuni-tools:
- Version 0.1.37-0
* Handle CA files with symlinks during migration (bsc#1251044)
* Add a lowercase version of --logLevel (bsc#1243611)
* Adjust traefik exposed configuration for chart v27+ (bsc#1247721)
* Stop executing scripts in temporary folder (bsc#1243704)
* Convert the traefik install time to local time (bsc#1251138)
* Run smdba and reindex only during migration (bsc#1244534)
* Support config: collect podman inspect for hub container (bsc#1245099)
* Add --registry-host, --registry-user and --registry-password to pull images from an authenticate registry
* Deprecate --registry
* Use new dedicated path for Cobbler settings (bsc#1244027)
* Migrate custom auto installation snippets (bsc#1246320)
* Add SLE15SP7 to buildin productmap
* Fix loading product map from mgradm configuration file (bsc#1246068)
* Fix channel override for distro copy
* Do not use sudo when running as a root user (bsc#1246882)
* Do not require backups to be at the same location for restoring (bsc#1246906)
* Check for restorecon presence before calling (bsc#1246925)
* Automatically get up-to-date systemid file on salt based proxy hosts (bsc#1246789)
* Fix recomputing proxy images when installing a ptf or test (bsc#1246553)
* Add migration for server monitoring configuration (bsc#1247688)
- Version 0.1.36-0
* Bump the default image tag
- Version 0.1.35-0
* Restore SELinux contexts for restored backup volumes (bsc#1244127)
- Version 0.1.34-0
* Fix mgradm backup create handling of images and systemd files (bsc#1246738)
- Version 0.1.33-0
* Restore volumes using tar instead of podman import (bsc#1244127)
Patchnames
SUSE-2025-4457,SUSE-SLE-Manager-Tools-12-2025-4457
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update 5.0.6 for Multi-Linux Manager Client Tools",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update fixes the following issues:\n\ngolang-github-prometheus-alertmanager:\n\n- Update to version 0.28.1 (jsc#PED-13285):\n * Improved performance of inhibition rules when using Equal\n labels.\n * Improve the documentation on escaping in UTF-8 matchers.\n * Update alertmanager_config_hash metric help to document the\n hash is not cryptographically strong.\n * Fix panic in amtool when using --verbose.\n * Fix templating of channel field for Rocket.Chat.\n * Fix rocketchat_configs written as rocket_configs in docs.\n * Fix usage for --enable-feature flag.\n * Trim whitespace from OpsGenie API Key.\n * Fix Jira project template not rendered when searching for\n existing issues.\n * Fix subtle bug in JSON/YAML encoding of inhibition rules that\n would cause Equal labels to be omitted.\n * Fix header for slack_configs in docs.\n * Fix weight and wrap of Microsoft Teams notifications.\n- Upgrade to version 0.28.0:\n * CVE-2025-47908: Bump github.com/rs/cors (bsc#1247748).\n * Templating errors in the SNS integration now return an error.\n * Adopt log/slog, drop go-kit/log.\n * Add a new Microsoft Teams integration based on Flows.\n * Add a new Rocket.Chat integration.\n * Add a new Jira integration.\n * Add support for GOMEMLIMIT, enable it via the feature flag\n --enable-feature=auto-gomemlimit.\n * Add support for GOMAXPROCS, enable it via the feature flag\n --enable-feature=auto-gomaxprocs.\n * Add support for limits of silences including the maximum number\n of active and pending silences, and the maximum size per\n silence (in bytes). You can use the flags\n --silences.max-silences and --silences.max-silence-size-bytes\n to set them accordingly.\n * Muted alerts now show whether they are suppressed or not in\n both the /api/v2/alerts endpoint and the Alertmanager UI.\n- Upgrade to version 0.27.0:\n * API: Removal of all api/v1/ endpoints. These endpoints\n now log and return a deprecation message and respond with a\n status code of 410.\n * UTF-8 Support: Introduction of support for any UTF-8\n character as part of label names and matchers.\n * Discord Integration: Enforce max length in message.\n * Metrics: Introduced the experimental feature flag\n --enable-feature=receiver-name-in-metrics to include the\n receiver name.\n * Metrics: Introduced a new gauge named\n alertmanager_inhibition_rules that counts the number of\n configured inhibition rules.\n * Metrics: Introduced a new counter named\n alertmanager_alerts_supressed_total that tracks muted alerts,\n it contains a reason label to indicate the source of the mute.\n * Discord Integration: Introduced support for webhook_url_file.\n * Microsoft Teams Integration: Introduced support for\n webhook_url_file.\n * Microsoft Teams Integration: Add support for summary.\n * Metrics: Notification metrics now support two new values for\n the label reason, contextCanceled and contextDeadlineExceeded.\n * Email Integration: Contents of auth_password_file are now\n trimmed of prefixed and suffixed whitespace.\n * amtool: Fixes the error scheme required for webhook url when\n using amtool with --alertmanager.url.\n * Mixin: Fix AlertmanagerFailedToSendAlerts,\n AlertmanagerClusterFailedToSendAlerts, and\n AlertmanagerClusterFailedToSendAlerts to make sure they ignore\n the reason label.\n\ngrafana was updated from version 11.5.5 to 11.5.10:\n\n- Security issues fixed:\n \n * CVE-2025-47911: Fix parsing HTML documents (bsc#1251454)\n * CVE-2025-58190: Fix excessive memory consumption (bsc#1251657)\n * CVE-2025-64751: Drop experimental implementation of authorization Zanzana server/client\n (bsc#1254113)\n * CVE-2025-11065: Fixed sensitive information leak in logs (version 11.5.9) (bsc#1250616)\n * CVE-2025-6023: Fixed cross-site-scripting via scripted dashboards (version 11.5.7) (bsc#1246735)\n * CVE-2025-6197: Fixed open redirect in organization switching (version 11.5.7) (bsc#1246736)\n * CVE-2025-3415: Fixed exposure of DingDing alerting integration URL to Viewer level users (version 11.5.6)\n (bsc#1245302)\n\n- Other changes, new features and bugs fixed:\n\n * Version 11.5.10:\n + Update to Go 1.25\n + Update to golang.org/x/net v0.45.0\n + Auth: Fix render user OAuth passthrough\n + LDAP Authentication: Fix URL to propagate username context as parameter\n \n * Version 11.5.9:\n + Auditing: Document new options for recording datasource query request/response body.\n + Login: Fixed redirection after login when Grafana is served from subpath.\n\n * Version 11.5.7:\n + Azure: Fixed legend formatting and resource name determination in template variable queries.\n\nmgr-push:\n\n- Version 5.0.3-0\n * Fixed syntax error in changelog\n\nrhnlib:\n\n- Version 5.0.6-0\n * Use more secure defusedxml parser (bsc#1227577)\n\nspacecmd:\n\n- Version 5.0.14-0:\n\n * Fixed installation of python lib files on Ubuntu 24.04 (bsc#1246586)\n * Use JSON instead of pickle for spacecmd cache (bsc#1227579)\n * Make spacecmd to work with Python 3.12 and higher\n * Call print statements properly in Python 3\n\nsupportutils-plugin-susemanager-client:\n\n- Version 5.0.5-0\n * Fix syntax error in changelog\n\nuyuni-tools:\n\n- Version 0.1.37-0\n * Handle CA files with symlinks during migration (bsc#1251044)\n * Add a lowercase version of --logLevel (bsc#1243611)\n * Adjust traefik exposed configuration for chart v27+ (bsc#1247721)\n * Stop executing scripts in temporary folder (bsc#1243704)\n * Convert the traefik install time to local time (bsc#1251138)\n * Run smdba and reindex only during migration (bsc#1244534)\n * Support config: collect podman inspect for hub container (bsc#1245099)\n * Add --registry-host, --registry-user and --registry-password to pull images from an authenticate registry\n * Deprecate --registry\n * Use new dedicated path for Cobbler settings (bsc#1244027)\n * Migrate custom auto installation snippets (bsc#1246320)\n * Add SLE15SP7 to buildin productmap\n * Fix loading product map from mgradm configuration file (bsc#1246068)\n * Fix channel override for distro copy\n * Do not use sudo when running as a root user (bsc#1246882)\n * Do not require backups to be at the same location for restoring (bsc#1246906)\n * Check for restorecon presence before calling (bsc#1246925)\n * Automatically get up-to-date systemid file on salt based proxy hosts (bsc#1246789)\n * Fix recomputing proxy images when installing a ptf or test (bsc#1246553)\n * Add migration for server monitoring configuration (bsc#1247688)\n- Version 0.1.36-0\n * Bump the default image tag\n- Version 0.1.35-0\n * Restore SELinux contexts for restored backup volumes (bsc#1244127)\n- Version 0.1.34-0\n * Fix mgradm backup create handling of images and systemd files (bsc#1246738)\n- Version 0.1.33-0\n * Restore volumes using tar instead of podman import (bsc#1244127)\n\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-2025-4457,SUSE-SLE-Manager-Tools-12-2025-4457",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2025_4457-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2025:4457-1",
"url": "https://www.suse.com/support/update/announcement/2025/suse-su-20254457-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2025:4457-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2025-December/023598.html"
},
{
"category": "self",
"summary": "SUSE Bug 1227577",
"url": "https://bugzilla.suse.com/1227577"
},
{
"category": "self",
"summary": "SUSE Bug 1227579",
"url": "https://bugzilla.suse.com/1227579"
},
{
"category": "self",
"summary": "SUSE Bug 1243611",
"url": "https://bugzilla.suse.com/1243611"
},
{
"category": "self",
"summary": "SUSE Bug 1243704",
"url": "https://bugzilla.suse.com/1243704"
},
{
"category": "self",
"summary": "SUSE Bug 1244027",
"url": "https://bugzilla.suse.com/1244027"
},
{
"category": "self",
"summary": "SUSE Bug 1244127",
"url": "https://bugzilla.suse.com/1244127"
},
{
"category": "self",
"summary": "SUSE Bug 1244534",
"url": "https://bugzilla.suse.com/1244534"
},
{
"category": "self",
"summary": "SUSE Bug 1245099",
"url": "https://bugzilla.suse.com/1245099"
},
{
"category": "self",
"summary": "SUSE Bug 1245302",
"url": "https://bugzilla.suse.com/1245302"
},
{
"category": "self",
"summary": "SUSE Bug 1246068",
"url": "https://bugzilla.suse.com/1246068"
},
{
"category": "self",
"summary": "SUSE Bug 1246320",
"url": "https://bugzilla.suse.com/1246320"
},
{
"category": "self",
"summary": "SUSE Bug 1246553",
"url": "https://bugzilla.suse.com/1246553"
},
{
"category": "self",
"summary": "SUSE Bug 1246586",
"url": "https://bugzilla.suse.com/1246586"
},
{
"category": "self",
"summary": "SUSE Bug 1246662",
"url": "https://bugzilla.suse.com/1246662"
},
{
"category": "self",
"summary": "SUSE Bug 1246735",
"url": "https://bugzilla.suse.com/1246735"
},
{
"category": "self",
"summary": "SUSE Bug 1246736",
"url": "https://bugzilla.suse.com/1246736"
},
{
"category": "self",
"summary": "SUSE Bug 1246738",
"url": "https://bugzilla.suse.com/1246738"
},
{
"category": "self",
"summary": "SUSE Bug 1246789",
"url": "https://bugzilla.suse.com/1246789"
},
{
"category": "self",
"summary": "SUSE Bug 1246882",
"url": "https://bugzilla.suse.com/1246882"
},
{
"category": "self",
"summary": "SUSE Bug 1246906",
"url": "https://bugzilla.suse.com/1246906"
},
{
"category": "self",
"summary": "SUSE Bug 1246925",
"url": "https://bugzilla.suse.com/1246925"
},
{
"category": "self",
"summary": "SUSE Bug 1247688",
"url": "https://bugzilla.suse.com/1247688"
},
{
"category": "self",
"summary": "SUSE Bug 1247721",
"url": "https://bugzilla.suse.com/1247721"
},
{
"category": "self",
"summary": "SUSE Bug 1247748",
"url": "https://bugzilla.suse.com/1247748"
},
{
"category": "self",
"summary": "SUSE Bug 1250616",
"url": "https://bugzilla.suse.com/1250616"
},
{
"category": "self",
"summary": "SUSE Bug 1251044",
"url": "https://bugzilla.suse.com/1251044"
},
{
"category": "self",
"summary": "SUSE Bug 1251138",
"url": "https://bugzilla.suse.com/1251138"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-11065 page",
"url": "https://www.suse.com/security/cve/CVE-2025-11065/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-3415 page",
"url": "https://www.suse.com/security/cve/CVE-2025-3415/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-47908 page",
"url": "https://www.suse.com/security/cve/CVE-2025-47908/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-6023 page",
"url": "https://www.suse.com/security/cve/CVE-2025-6023/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-6197 page",
"url": "https://www.suse.com/security/cve/CVE-2025-6197/"
}
],
"title": "Security update 5.0.6 for Multi-Linux Manager Client Tools",
"tracking": {
"current_release_date": "2025-12-18T11:56:34Z",
"generator": {
"date": "2025-12-18T11:56:34Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2025:4457-1",
"initial_release_date": "2025-12-18T11:56:34Z",
"revision_history": [
{
"date": "2025-12-18T11:56:34Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "golang-github-prometheus-alertmanager-0.28.1-1.34.1.aarch64",
"product": {
"name": "golang-github-prometheus-alertmanager-0.28.1-1.34.1.aarch64",
"product_id": "golang-github-prometheus-alertmanager-0.28.1-1.34.1.aarch64"
}
},
{
"category": "product_version",
"name": "grafana-11.5.10-1.87.1.aarch64",
"product": {
"name": "grafana-11.5.10-1.87.1.aarch64",
"product_id": "grafana-11.5.10-1.87.1.aarch64"
}
},
{
"category": "product_version",
"name": "mgrctl-0.1.37-1.27.1.aarch64",
"product": {
"name": "mgrctl-0.1.37-1.27.1.aarch64",
"product_id": "mgrctl-0.1.37-1.27.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "golang-github-prometheus-alertmanager-0.28.1-1.34.1.i586",
"product": {
"name": "golang-github-prometheus-alertmanager-0.28.1-1.34.1.i586",
"product_id": "golang-github-prometheus-alertmanager-0.28.1-1.34.1.i586"
}
},
{
"category": "product_version",
"name": "mgrctl-0.1.37-1.27.1.i586",
"product": {
"name": "mgrctl-0.1.37-1.27.1.i586",
"product_id": "mgrctl-0.1.37-1.27.1.i586"
}
}
],
"category": "architecture",
"name": "i586"
},
{
"branches": [
{
"category": "product_version",
"name": "mgr-push-5.0.3-1.30.3.noarch",
"product": {
"name": "mgr-push-5.0.3-1.30.3.noarch",
"product_id": "mgr-push-5.0.3-1.30.3.noarch"
}
},
{
"category": "product_version",
"name": "mgrctl-bash-completion-0.1.37-1.27.1.noarch",
"product": {
"name": "mgrctl-bash-completion-0.1.37-1.27.1.noarch",
"product_id": "mgrctl-bash-completion-0.1.37-1.27.1.noarch"
}
},
{
"category": "product_version",
"name": "mgrctl-lang-0.1.37-1.27.1.noarch",
"product": {
"name": "mgrctl-lang-0.1.37-1.27.1.noarch",
"product_id": "mgrctl-lang-0.1.37-1.27.1.noarch"
}
},
{
"category": "product_version",
"name": "mgrctl-zsh-completion-0.1.37-1.27.1.noarch",
"product": {
"name": "mgrctl-zsh-completion-0.1.37-1.27.1.noarch",
"product_id": "mgrctl-zsh-completion-0.1.37-1.27.1.noarch"
}
},
{
"category": "product_version",
"name": "python2-mgr-push-5.0.3-1.30.3.noarch",
"product": {
"name": "python2-mgr-push-5.0.3-1.30.3.noarch",
"product_id": "python2-mgr-push-5.0.3-1.30.3.noarch"
}
},
{
"category": "product_version",
"name": "python2-rhnlib-5.0.6-21.55.1.noarch",
"product": {
"name": "python2-rhnlib-5.0.6-21.55.1.noarch",
"product_id": "python2-rhnlib-5.0.6-21.55.1.noarch"
}
},
{
"category": "product_version",
"name": "spacecmd-5.0.14-38.162.1.noarch",
"product": {
"name": "spacecmd-5.0.14-38.162.1.noarch",
"product_id": "spacecmd-5.0.14-38.162.1.noarch"
}
},
{
"category": "product_version",
"name": "supportutils-plugin-susemanager-client-5.0.5-6.36.1.noarch",
"product": {
"name": "supportutils-plugin-susemanager-client-5.0.5-6.36.1.noarch",
"product_id": "supportutils-plugin-susemanager-client-5.0.5-6.36.1.noarch"
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "golang-github-prometheus-alertmanager-0.28.1-1.34.1.ppc64le",
"product": {
"name": "golang-github-prometheus-alertmanager-0.28.1-1.34.1.ppc64le",
"product_id": "golang-github-prometheus-alertmanager-0.28.1-1.34.1.ppc64le"
}
},
{
"category": "product_version",
"name": "grafana-11.5.10-1.87.1.ppc64le",
"product": {
"name": "grafana-11.5.10-1.87.1.ppc64le",
"product_id": "grafana-11.5.10-1.87.1.ppc64le"
}
},
{
"category": "product_version",
"name": "mgrctl-0.1.37-1.27.1.ppc64le",
"product": {
"name": "mgrctl-0.1.37-1.27.1.ppc64le",
"product_id": "mgrctl-0.1.37-1.27.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "golang-github-prometheus-alertmanager-0.28.1-1.34.1.s390x",
"product": {
"name": "golang-github-prometheus-alertmanager-0.28.1-1.34.1.s390x",
"product_id": "golang-github-prometheus-alertmanager-0.28.1-1.34.1.s390x"
}
},
{
"category": "product_version",
"name": "grafana-11.5.10-1.87.1.s390x",
"product": {
"name": "grafana-11.5.10-1.87.1.s390x",
"product_id": "grafana-11.5.10-1.87.1.s390x"
}
},
{
"category": "product_version",
"name": "mgrctl-0.1.37-1.27.1.s390x",
"product": {
"name": "mgrctl-0.1.37-1.27.1.s390x",
"product_id": "mgrctl-0.1.37-1.27.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "golang-github-prometheus-alertmanager-0.28.1-1.34.1.x86_64",
"product": {
"name": "golang-github-prometheus-alertmanager-0.28.1-1.34.1.x86_64",
"product_id": "golang-github-prometheus-alertmanager-0.28.1-1.34.1.x86_64"
}
},
{
"category": "product_version",
"name": "grafana-11.5.10-1.87.1.x86_64",
"product": {
"name": "grafana-11.5.10-1.87.1.x86_64",
"product_id": "grafana-11.5.10-1.87.1.x86_64"
}
},
{
"category": "product_version",
"name": "mgrctl-0.1.37-1.27.1.x86_64",
"product": {
"name": "mgrctl-0.1.37-1.27.1.x86_64",
"product_id": "mgrctl-0.1.37-1.27.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Manager Client Tools 12",
"product": {
"name": "SUSE Manager Client Tools 12",
"product_id": "SUSE Manager Client Tools 12"
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-github-prometheus-alertmanager-0.28.1-1.34.1.aarch64 as component of SUSE Manager Client Tools 12",
"product_id": "SUSE Manager Client Tools 12:golang-github-prometheus-alertmanager-0.28.1-1.34.1.aarch64"
},
"product_reference": "golang-github-prometheus-alertmanager-0.28.1-1.34.1.aarch64",
"relates_to_product_reference": "SUSE Manager Client Tools 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-github-prometheus-alertmanager-0.28.1-1.34.1.ppc64le as component of SUSE Manager Client Tools 12",
"product_id": "SUSE Manager Client Tools 12:golang-github-prometheus-alertmanager-0.28.1-1.34.1.ppc64le"
},
"product_reference": "golang-github-prometheus-alertmanager-0.28.1-1.34.1.ppc64le",
"relates_to_product_reference": "SUSE Manager Client Tools 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-github-prometheus-alertmanager-0.28.1-1.34.1.s390x as component of SUSE Manager Client Tools 12",
"product_id": "SUSE Manager Client Tools 12:golang-github-prometheus-alertmanager-0.28.1-1.34.1.s390x"
},
"product_reference": "golang-github-prometheus-alertmanager-0.28.1-1.34.1.s390x",
"relates_to_product_reference": "SUSE Manager Client Tools 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "golang-github-prometheus-alertmanager-0.28.1-1.34.1.x86_64 as component of SUSE Manager Client Tools 12",
"product_id": "SUSE Manager Client Tools 12:golang-github-prometheus-alertmanager-0.28.1-1.34.1.x86_64"
},
"product_reference": "golang-github-prometheus-alertmanager-0.28.1-1.34.1.x86_64",
"relates_to_product_reference": "SUSE Manager Client Tools 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-11.5.10-1.87.1.aarch64 as component of SUSE Manager Client Tools 12",
"product_id": "SUSE Manager Client Tools 12:grafana-11.5.10-1.87.1.aarch64"
},
"product_reference": "grafana-11.5.10-1.87.1.aarch64",
"relates_to_product_reference": "SUSE Manager Client Tools 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-11.5.10-1.87.1.ppc64le as component of SUSE Manager Client Tools 12",
"product_id": "SUSE Manager Client Tools 12:grafana-11.5.10-1.87.1.ppc64le"
},
"product_reference": "grafana-11.5.10-1.87.1.ppc64le",
"relates_to_product_reference": "SUSE Manager Client Tools 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-11.5.10-1.87.1.s390x as component of SUSE Manager Client Tools 12",
"product_id": "SUSE Manager Client Tools 12:grafana-11.5.10-1.87.1.s390x"
},
"product_reference": "grafana-11.5.10-1.87.1.s390x",
"relates_to_product_reference": "SUSE Manager Client Tools 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-11.5.10-1.87.1.x86_64 as component of SUSE Manager Client Tools 12",
"product_id": "SUSE Manager Client Tools 12:grafana-11.5.10-1.87.1.x86_64"
},
"product_reference": "grafana-11.5.10-1.87.1.x86_64",
"relates_to_product_reference": "SUSE Manager Client Tools 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mgr-push-5.0.3-1.30.3.noarch as component of SUSE Manager Client Tools 12",
"product_id": "SUSE Manager Client Tools 12:mgr-push-5.0.3-1.30.3.noarch"
},
"product_reference": "mgr-push-5.0.3-1.30.3.noarch",
"relates_to_product_reference": "SUSE Manager Client Tools 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mgrctl-0.1.37-1.27.1.aarch64 as component of SUSE Manager Client Tools 12",
"product_id": "SUSE Manager Client Tools 12:mgrctl-0.1.37-1.27.1.aarch64"
},
"product_reference": "mgrctl-0.1.37-1.27.1.aarch64",
"relates_to_product_reference": "SUSE Manager Client Tools 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mgrctl-0.1.37-1.27.1.ppc64le as component of SUSE Manager Client Tools 12",
"product_id": "SUSE Manager Client Tools 12:mgrctl-0.1.37-1.27.1.ppc64le"
},
"product_reference": "mgrctl-0.1.37-1.27.1.ppc64le",
"relates_to_product_reference": "SUSE Manager Client Tools 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mgrctl-0.1.37-1.27.1.s390x as component of SUSE Manager Client Tools 12",
"product_id": "SUSE Manager Client Tools 12:mgrctl-0.1.37-1.27.1.s390x"
},
"product_reference": "mgrctl-0.1.37-1.27.1.s390x",
"relates_to_product_reference": "SUSE Manager Client Tools 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mgrctl-0.1.37-1.27.1.x86_64 as component of SUSE Manager Client Tools 12",
"product_id": "SUSE Manager Client Tools 12:mgrctl-0.1.37-1.27.1.x86_64"
},
"product_reference": "mgrctl-0.1.37-1.27.1.x86_64",
"relates_to_product_reference": "SUSE Manager Client Tools 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mgrctl-bash-completion-0.1.37-1.27.1.noarch as component of SUSE Manager Client Tools 12",
"product_id": "SUSE Manager Client Tools 12:mgrctl-bash-completion-0.1.37-1.27.1.noarch"
},
"product_reference": "mgrctl-bash-completion-0.1.37-1.27.1.noarch",
"relates_to_product_reference": "SUSE Manager Client Tools 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mgrctl-zsh-completion-0.1.37-1.27.1.noarch as component of SUSE Manager Client Tools 12",
"product_id": "SUSE Manager Client Tools 12:mgrctl-zsh-completion-0.1.37-1.27.1.noarch"
},
"product_reference": "mgrctl-zsh-completion-0.1.37-1.27.1.noarch",
"relates_to_product_reference": "SUSE Manager Client Tools 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python2-mgr-push-5.0.3-1.30.3.noarch as component of SUSE Manager Client Tools 12",
"product_id": "SUSE Manager Client Tools 12:python2-mgr-push-5.0.3-1.30.3.noarch"
},
"product_reference": "python2-mgr-push-5.0.3-1.30.3.noarch",
"relates_to_product_reference": "SUSE Manager Client Tools 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python2-rhnlib-5.0.6-21.55.1.noarch as component of SUSE Manager Client Tools 12",
"product_id": "SUSE Manager Client Tools 12:python2-rhnlib-5.0.6-21.55.1.noarch"
},
"product_reference": "python2-rhnlib-5.0.6-21.55.1.noarch",
"relates_to_product_reference": "SUSE Manager Client Tools 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "spacecmd-5.0.14-38.162.1.noarch as component of SUSE Manager Client Tools 12",
"product_id": "SUSE Manager Client Tools 12:spacecmd-5.0.14-38.162.1.noarch"
},
"product_reference": "spacecmd-5.0.14-38.162.1.noarch",
"relates_to_product_reference": "SUSE Manager Client Tools 12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "supportutils-plugin-susemanager-client-5.0.5-6.36.1.noarch as component of SUSE Manager Client Tools 12",
"product_id": "SUSE Manager Client Tools 12:supportutils-plugin-susemanager-client-5.0.5-6.36.1.noarch"
},
"product_reference": "supportutils-plugin-susemanager-client-5.0.5-6.36.1.noarch",
"relates_to_product_reference": "SUSE Manager Client Tools 12"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-11065",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-11065"
}
],
"notes": [
{
"category": "general",
"text": "unknown",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Manager Client Tools 12:golang-github-prometheus-alertmanager-0.28.1-1.34.1.aarch64",
"SUSE Manager Client Tools 12:golang-github-prometheus-alertmanager-0.28.1-1.34.1.ppc64le",
"SUSE Manager Client Tools 12:golang-github-prometheus-alertmanager-0.28.1-1.34.1.s390x",
"SUSE Manager Client Tools 12:golang-github-prometheus-alertmanager-0.28.1-1.34.1.x86_64",
"SUSE Manager Client Tools 12:grafana-11.5.10-1.87.1.aarch64",
"SUSE Manager Client Tools 12:grafana-11.5.10-1.87.1.ppc64le",
"SUSE Manager Client Tools 12:grafana-11.5.10-1.87.1.s390x",
"SUSE Manager Client Tools 12:grafana-11.5.10-1.87.1.x86_64",
"SUSE Manager Client Tools 12:mgr-push-5.0.3-1.30.3.noarch",
"SUSE Manager Client Tools 12:mgrctl-0.1.37-1.27.1.aarch64",
"SUSE Manager Client Tools 12:mgrctl-0.1.37-1.27.1.ppc64le",
"SUSE Manager Client Tools 12:mgrctl-0.1.37-1.27.1.s390x",
"SUSE Manager Client Tools 12:mgrctl-0.1.37-1.27.1.x86_64",
"SUSE Manager Client Tools 12:mgrctl-bash-completion-0.1.37-1.27.1.noarch",
"SUSE Manager Client Tools 12:mgrctl-zsh-completion-0.1.37-1.27.1.noarch",
"SUSE Manager Client Tools 12:python2-mgr-push-5.0.3-1.30.3.noarch",
"SUSE Manager Client Tools 12:python2-rhnlib-5.0.6-21.55.1.noarch",
"SUSE Manager Client Tools 12:spacecmd-5.0.14-38.162.1.noarch",
"SUSE Manager Client Tools 12:supportutils-plugin-susemanager-client-5.0.5-6.36.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-11065",
"url": "https://www.suse.com/security/cve/CVE-2025-11065"
},
{
"category": "external",
"summary": "SUSE Bug 1250608 for CVE-2025-11065",
"url": "https://bugzilla.suse.com/1250608"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Manager Client Tools 12:golang-github-prometheus-alertmanager-0.28.1-1.34.1.aarch64",
"SUSE Manager Client Tools 12:golang-github-prometheus-alertmanager-0.28.1-1.34.1.ppc64le",
"SUSE Manager Client Tools 12:golang-github-prometheus-alertmanager-0.28.1-1.34.1.s390x",
"SUSE Manager Client Tools 12:golang-github-prometheus-alertmanager-0.28.1-1.34.1.x86_64",
"SUSE Manager Client Tools 12:grafana-11.5.10-1.87.1.aarch64",
"SUSE Manager Client Tools 12:grafana-11.5.10-1.87.1.ppc64le",
"SUSE Manager Client Tools 12:grafana-11.5.10-1.87.1.s390x",
"SUSE Manager Client Tools 12:grafana-11.5.10-1.87.1.x86_64",
"SUSE Manager Client Tools 12:mgr-push-5.0.3-1.30.3.noarch",
"SUSE Manager Client Tools 12:mgrctl-0.1.37-1.27.1.aarch64",
"SUSE Manager Client Tools 12:mgrctl-0.1.37-1.27.1.ppc64le",
"SUSE Manager Client Tools 12:mgrctl-0.1.37-1.27.1.s390x",
"SUSE Manager Client Tools 12:mgrctl-0.1.37-1.27.1.x86_64",
"SUSE Manager Client Tools 12:mgrctl-bash-completion-0.1.37-1.27.1.noarch",
"SUSE Manager Client Tools 12:mgrctl-zsh-completion-0.1.37-1.27.1.noarch",
"SUSE Manager Client Tools 12:python2-mgr-push-5.0.3-1.30.3.noarch",
"SUSE Manager Client Tools 12:python2-rhnlib-5.0.6-21.55.1.noarch",
"SUSE Manager Client Tools 12:spacecmd-5.0.14-38.162.1.noarch",
"SUSE Manager Client Tools 12:supportutils-plugin-susemanager-client-5.0.5-6.36.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Manager Client Tools 12:golang-github-prometheus-alertmanager-0.28.1-1.34.1.aarch64",
"SUSE Manager Client Tools 12:golang-github-prometheus-alertmanager-0.28.1-1.34.1.ppc64le",
"SUSE Manager Client Tools 12:golang-github-prometheus-alertmanager-0.28.1-1.34.1.s390x",
"SUSE Manager Client Tools 12:golang-github-prometheus-alertmanager-0.28.1-1.34.1.x86_64",
"SUSE Manager Client Tools 12:grafana-11.5.10-1.87.1.aarch64",
"SUSE Manager Client Tools 12:grafana-11.5.10-1.87.1.ppc64le",
"SUSE Manager Client Tools 12:grafana-11.5.10-1.87.1.s390x",
"SUSE Manager Client Tools 12:grafana-11.5.10-1.87.1.x86_64",
"SUSE Manager Client Tools 12:mgr-push-5.0.3-1.30.3.noarch",
"SUSE Manager Client Tools 12:mgrctl-0.1.37-1.27.1.aarch64",
"SUSE Manager Client Tools 12:mgrctl-0.1.37-1.27.1.ppc64le",
"SUSE Manager Client Tools 12:mgrctl-0.1.37-1.27.1.s390x",
"SUSE Manager Client Tools 12:mgrctl-0.1.37-1.27.1.x86_64",
"SUSE Manager Client Tools 12:mgrctl-bash-completion-0.1.37-1.27.1.noarch",
"SUSE Manager Client Tools 12:mgrctl-zsh-completion-0.1.37-1.27.1.noarch",
"SUSE Manager Client Tools 12:python2-mgr-push-5.0.3-1.30.3.noarch",
"SUSE Manager Client Tools 12:python2-rhnlib-5.0.6-21.55.1.noarch",
"SUSE Manager Client Tools 12:spacecmd-5.0.14-38.162.1.noarch",
"SUSE Manager Client Tools 12:supportutils-plugin-susemanager-client-5.0.5-6.36.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-12-18T11:56:34Z",
"details": "moderate"
}
],
"title": "CVE-2025-11065"
},
{
"cve": "CVE-2025-3415",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-3415"
}
],
"notes": [
{
"category": "general",
"text": "Grafana is an open-source platform for monitoring and observability. The Grafana Alerting DingDing integration was not properly protected and could be exposed to users with Viewer permission. \nFixed in versions 10.4.19+security-01, 11.2.10+security-01, 11.3.7+security-01, 11.4.5+security-01, 11.5.5+security-01, 11.6.2+security-01 and 12.0.1+security-01",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Manager Client Tools 12:golang-github-prometheus-alertmanager-0.28.1-1.34.1.aarch64",
"SUSE Manager Client Tools 12:golang-github-prometheus-alertmanager-0.28.1-1.34.1.ppc64le",
"SUSE Manager Client Tools 12:golang-github-prometheus-alertmanager-0.28.1-1.34.1.s390x",
"SUSE Manager Client Tools 12:golang-github-prometheus-alertmanager-0.28.1-1.34.1.x86_64",
"SUSE Manager Client Tools 12:grafana-11.5.10-1.87.1.aarch64",
"SUSE Manager Client Tools 12:grafana-11.5.10-1.87.1.ppc64le",
"SUSE Manager Client Tools 12:grafana-11.5.10-1.87.1.s390x",
"SUSE Manager Client Tools 12:grafana-11.5.10-1.87.1.x86_64",
"SUSE Manager Client Tools 12:mgr-push-5.0.3-1.30.3.noarch",
"SUSE Manager Client Tools 12:mgrctl-0.1.37-1.27.1.aarch64",
"SUSE Manager Client Tools 12:mgrctl-0.1.37-1.27.1.ppc64le",
"SUSE Manager Client Tools 12:mgrctl-0.1.37-1.27.1.s390x",
"SUSE Manager Client Tools 12:mgrctl-0.1.37-1.27.1.x86_64",
"SUSE Manager Client Tools 12:mgrctl-bash-completion-0.1.37-1.27.1.noarch",
"SUSE Manager Client Tools 12:mgrctl-zsh-completion-0.1.37-1.27.1.noarch",
"SUSE Manager Client Tools 12:python2-mgr-push-5.0.3-1.30.3.noarch",
"SUSE Manager Client Tools 12:python2-rhnlib-5.0.6-21.55.1.noarch",
"SUSE Manager Client Tools 12:spacecmd-5.0.14-38.162.1.noarch",
"SUSE Manager Client Tools 12:supportutils-plugin-susemanager-client-5.0.5-6.36.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-3415",
"url": "https://www.suse.com/security/cve/CVE-2025-3415"
},
{
"category": "external",
"summary": "SUSE Bug 1245302 for CVE-2025-3415",
"url": "https://bugzilla.suse.com/1245302"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Manager Client Tools 12:golang-github-prometheus-alertmanager-0.28.1-1.34.1.aarch64",
"SUSE Manager Client Tools 12:golang-github-prometheus-alertmanager-0.28.1-1.34.1.ppc64le",
"SUSE Manager Client Tools 12:golang-github-prometheus-alertmanager-0.28.1-1.34.1.s390x",
"SUSE Manager Client Tools 12:golang-github-prometheus-alertmanager-0.28.1-1.34.1.x86_64",
"SUSE Manager Client Tools 12:grafana-11.5.10-1.87.1.aarch64",
"SUSE Manager Client Tools 12:grafana-11.5.10-1.87.1.ppc64le",
"SUSE Manager Client Tools 12:grafana-11.5.10-1.87.1.s390x",
"SUSE Manager Client Tools 12:grafana-11.5.10-1.87.1.x86_64",
"SUSE Manager Client Tools 12:mgr-push-5.0.3-1.30.3.noarch",
"SUSE Manager Client Tools 12:mgrctl-0.1.37-1.27.1.aarch64",
"SUSE Manager Client Tools 12:mgrctl-0.1.37-1.27.1.ppc64le",
"SUSE Manager Client Tools 12:mgrctl-0.1.37-1.27.1.s390x",
"SUSE Manager Client Tools 12:mgrctl-0.1.37-1.27.1.x86_64",
"SUSE Manager Client Tools 12:mgrctl-bash-completion-0.1.37-1.27.1.noarch",
"SUSE Manager Client Tools 12:mgrctl-zsh-completion-0.1.37-1.27.1.noarch",
"SUSE Manager Client Tools 12:python2-mgr-push-5.0.3-1.30.3.noarch",
"SUSE Manager Client Tools 12:python2-rhnlib-5.0.6-21.55.1.noarch",
"SUSE Manager Client Tools 12:spacecmd-5.0.14-38.162.1.noarch",
"SUSE Manager Client Tools 12:supportutils-plugin-susemanager-client-5.0.5-6.36.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Manager Client Tools 12:golang-github-prometheus-alertmanager-0.28.1-1.34.1.aarch64",
"SUSE Manager Client Tools 12:golang-github-prometheus-alertmanager-0.28.1-1.34.1.ppc64le",
"SUSE Manager Client Tools 12:golang-github-prometheus-alertmanager-0.28.1-1.34.1.s390x",
"SUSE Manager Client Tools 12:golang-github-prometheus-alertmanager-0.28.1-1.34.1.x86_64",
"SUSE Manager Client Tools 12:grafana-11.5.10-1.87.1.aarch64",
"SUSE Manager Client Tools 12:grafana-11.5.10-1.87.1.ppc64le",
"SUSE Manager Client Tools 12:grafana-11.5.10-1.87.1.s390x",
"SUSE Manager Client Tools 12:grafana-11.5.10-1.87.1.x86_64",
"SUSE Manager Client Tools 12:mgr-push-5.0.3-1.30.3.noarch",
"SUSE Manager Client Tools 12:mgrctl-0.1.37-1.27.1.aarch64",
"SUSE Manager Client Tools 12:mgrctl-0.1.37-1.27.1.ppc64le",
"SUSE Manager Client Tools 12:mgrctl-0.1.37-1.27.1.s390x",
"SUSE Manager Client Tools 12:mgrctl-0.1.37-1.27.1.x86_64",
"SUSE Manager Client Tools 12:mgrctl-bash-completion-0.1.37-1.27.1.noarch",
"SUSE Manager Client Tools 12:mgrctl-zsh-completion-0.1.37-1.27.1.noarch",
"SUSE Manager Client Tools 12:python2-mgr-push-5.0.3-1.30.3.noarch",
"SUSE Manager Client Tools 12:python2-rhnlib-5.0.6-21.55.1.noarch",
"SUSE Manager Client Tools 12:spacecmd-5.0.14-38.162.1.noarch",
"SUSE Manager Client Tools 12:supportutils-plugin-susemanager-client-5.0.5-6.36.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-12-18T11:56:34Z",
"details": "moderate"
}
],
"title": "CVE-2025-3415"
},
{
"cve": "CVE-2025-47908",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-47908"
}
],
"notes": [
{
"category": "general",
"text": "Middleware causes a prohibitive amount of heap allocations when processing malicious preflight requests that include a Access-Control-Request-Headers (ACRH) header whose value contains many commas. This behavior can be abused by attackers to produce undue load on the middleware/server as an attempt to cause a denial of service.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Manager Client Tools 12:golang-github-prometheus-alertmanager-0.28.1-1.34.1.aarch64",
"SUSE Manager Client Tools 12:golang-github-prometheus-alertmanager-0.28.1-1.34.1.ppc64le",
"SUSE Manager Client Tools 12:golang-github-prometheus-alertmanager-0.28.1-1.34.1.s390x",
"SUSE Manager Client Tools 12:golang-github-prometheus-alertmanager-0.28.1-1.34.1.x86_64",
"SUSE Manager Client Tools 12:grafana-11.5.10-1.87.1.aarch64",
"SUSE Manager Client Tools 12:grafana-11.5.10-1.87.1.ppc64le",
"SUSE Manager Client Tools 12:grafana-11.5.10-1.87.1.s390x",
"SUSE Manager Client Tools 12:grafana-11.5.10-1.87.1.x86_64",
"SUSE Manager Client Tools 12:mgr-push-5.0.3-1.30.3.noarch",
"SUSE Manager Client Tools 12:mgrctl-0.1.37-1.27.1.aarch64",
"SUSE Manager Client Tools 12:mgrctl-0.1.37-1.27.1.ppc64le",
"SUSE Manager Client Tools 12:mgrctl-0.1.37-1.27.1.s390x",
"SUSE Manager Client Tools 12:mgrctl-0.1.37-1.27.1.x86_64",
"SUSE Manager Client Tools 12:mgrctl-bash-completion-0.1.37-1.27.1.noarch",
"SUSE Manager Client Tools 12:mgrctl-zsh-completion-0.1.37-1.27.1.noarch",
"SUSE Manager Client Tools 12:python2-mgr-push-5.0.3-1.30.3.noarch",
"SUSE Manager Client Tools 12:python2-rhnlib-5.0.6-21.55.1.noarch",
"SUSE Manager Client Tools 12:spacecmd-5.0.14-38.162.1.noarch",
"SUSE Manager Client Tools 12:supportutils-plugin-susemanager-client-5.0.5-6.36.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-47908",
"url": "https://www.suse.com/security/cve/CVE-2025-47908"
},
{
"category": "external",
"summary": "SUSE Bug 1247746 for CVE-2025-47908",
"url": "https://bugzilla.suse.com/1247746"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Manager Client Tools 12:golang-github-prometheus-alertmanager-0.28.1-1.34.1.aarch64",
"SUSE Manager Client Tools 12:golang-github-prometheus-alertmanager-0.28.1-1.34.1.ppc64le",
"SUSE Manager Client Tools 12:golang-github-prometheus-alertmanager-0.28.1-1.34.1.s390x",
"SUSE Manager Client Tools 12:golang-github-prometheus-alertmanager-0.28.1-1.34.1.x86_64",
"SUSE Manager Client Tools 12:grafana-11.5.10-1.87.1.aarch64",
"SUSE Manager Client Tools 12:grafana-11.5.10-1.87.1.ppc64le",
"SUSE Manager Client Tools 12:grafana-11.5.10-1.87.1.s390x",
"SUSE Manager Client Tools 12:grafana-11.5.10-1.87.1.x86_64",
"SUSE Manager Client Tools 12:mgr-push-5.0.3-1.30.3.noarch",
"SUSE Manager Client Tools 12:mgrctl-0.1.37-1.27.1.aarch64",
"SUSE Manager Client Tools 12:mgrctl-0.1.37-1.27.1.ppc64le",
"SUSE Manager Client Tools 12:mgrctl-0.1.37-1.27.1.s390x",
"SUSE Manager Client Tools 12:mgrctl-0.1.37-1.27.1.x86_64",
"SUSE Manager Client Tools 12:mgrctl-bash-completion-0.1.37-1.27.1.noarch",
"SUSE Manager Client Tools 12:mgrctl-zsh-completion-0.1.37-1.27.1.noarch",
"SUSE Manager Client Tools 12:python2-mgr-push-5.0.3-1.30.3.noarch",
"SUSE Manager Client Tools 12:python2-rhnlib-5.0.6-21.55.1.noarch",
"SUSE Manager Client Tools 12:spacecmd-5.0.14-38.162.1.noarch",
"SUSE Manager Client Tools 12:supportutils-plugin-susemanager-client-5.0.5-6.36.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"SUSE Manager Client Tools 12:golang-github-prometheus-alertmanager-0.28.1-1.34.1.aarch64",
"SUSE Manager Client Tools 12:golang-github-prometheus-alertmanager-0.28.1-1.34.1.ppc64le",
"SUSE Manager Client Tools 12:golang-github-prometheus-alertmanager-0.28.1-1.34.1.s390x",
"SUSE Manager Client Tools 12:golang-github-prometheus-alertmanager-0.28.1-1.34.1.x86_64",
"SUSE Manager Client Tools 12:grafana-11.5.10-1.87.1.aarch64",
"SUSE Manager Client Tools 12:grafana-11.5.10-1.87.1.ppc64le",
"SUSE Manager Client Tools 12:grafana-11.5.10-1.87.1.s390x",
"SUSE Manager Client Tools 12:grafana-11.5.10-1.87.1.x86_64",
"SUSE Manager Client Tools 12:mgr-push-5.0.3-1.30.3.noarch",
"SUSE Manager Client Tools 12:mgrctl-0.1.37-1.27.1.aarch64",
"SUSE Manager Client Tools 12:mgrctl-0.1.37-1.27.1.ppc64le",
"SUSE Manager Client Tools 12:mgrctl-0.1.37-1.27.1.s390x",
"SUSE Manager Client Tools 12:mgrctl-0.1.37-1.27.1.x86_64",
"SUSE Manager Client Tools 12:mgrctl-bash-completion-0.1.37-1.27.1.noarch",
"SUSE Manager Client Tools 12:mgrctl-zsh-completion-0.1.37-1.27.1.noarch",
"SUSE Manager Client Tools 12:python2-mgr-push-5.0.3-1.30.3.noarch",
"SUSE Manager Client Tools 12:python2-rhnlib-5.0.6-21.55.1.noarch",
"SUSE Manager Client Tools 12:spacecmd-5.0.14-38.162.1.noarch",
"SUSE Manager Client Tools 12:supportutils-plugin-susemanager-client-5.0.5-6.36.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-12-18T11:56:34Z",
"details": "moderate"
}
],
"title": "CVE-2025-47908"
},
{
"cve": "CVE-2025-6023",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-6023"
}
],
"notes": [
{
"category": "general",
"text": "An open redirect vulnerability has been identified in Grafana OSS that can be exploited to achieve XSS attacks. The vulnerability was introduced in Grafana v11.5.0.\n\nThe open redirect can be chained with path traversal vulnerabilities to achieve XSS.\n\nFixed in versions 12.0.2+security-01, 11.6.3+security-01, 11.5.6+security-01, 11.4.6+security-01 and 11.3.8+security-01",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Manager Client Tools 12:golang-github-prometheus-alertmanager-0.28.1-1.34.1.aarch64",
"SUSE Manager Client Tools 12:golang-github-prometheus-alertmanager-0.28.1-1.34.1.ppc64le",
"SUSE Manager Client Tools 12:golang-github-prometheus-alertmanager-0.28.1-1.34.1.s390x",
"SUSE Manager Client Tools 12:golang-github-prometheus-alertmanager-0.28.1-1.34.1.x86_64",
"SUSE Manager Client Tools 12:grafana-11.5.10-1.87.1.aarch64",
"SUSE Manager Client Tools 12:grafana-11.5.10-1.87.1.ppc64le",
"SUSE Manager Client Tools 12:grafana-11.5.10-1.87.1.s390x",
"SUSE Manager Client Tools 12:grafana-11.5.10-1.87.1.x86_64",
"SUSE Manager Client Tools 12:mgr-push-5.0.3-1.30.3.noarch",
"SUSE Manager Client Tools 12:mgrctl-0.1.37-1.27.1.aarch64",
"SUSE Manager Client Tools 12:mgrctl-0.1.37-1.27.1.ppc64le",
"SUSE Manager Client Tools 12:mgrctl-0.1.37-1.27.1.s390x",
"SUSE Manager Client Tools 12:mgrctl-0.1.37-1.27.1.x86_64",
"SUSE Manager Client Tools 12:mgrctl-bash-completion-0.1.37-1.27.1.noarch",
"SUSE Manager Client Tools 12:mgrctl-zsh-completion-0.1.37-1.27.1.noarch",
"SUSE Manager Client Tools 12:python2-mgr-push-5.0.3-1.30.3.noarch",
"SUSE Manager Client Tools 12:python2-rhnlib-5.0.6-21.55.1.noarch",
"SUSE Manager Client Tools 12:spacecmd-5.0.14-38.162.1.noarch",
"SUSE Manager Client Tools 12:supportutils-plugin-susemanager-client-5.0.5-6.36.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-6023",
"url": "https://www.suse.com/security/cve/CVE-2025-6023"
},
{
"category": "external",
"summary": "SUSE Bug 1246735 for CVE-2025-6023",
"url": "https://bugzilla.suse.com/1246735"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Manager Client Tools 12:golang-github-prometheus-alertmanager-0.28.1-1.34.1.aarch64",
"SUSE Manager Client Tools 12:golang-github-prometheus-alertmanager-0.28.1-1.34.1.ppc64le",
"SUSE Manager Client Tools 12:golang-github-prometheus-alertmanager-0.28.1-1.34.1.s390x",
"SUSE Manager Client Tools 12:golang-github-prometheus-alertmanager-0.28.1-1.34.1.x86_64",
"SUSE Manager Client Tools 12:grafana-11.5.10-1.87.1.aarch64",
"SUSE Manager Client Tools 12:grafana-11.5.10-1.87.1.ppc64le",
"SUSE Manager Client Tools 12:grafana-11.5.10-1.87.1.s390x",
"SUSE Manager Client Tools 12:grafana-11.5.10-1.87.1.x86_64",
"SUSE Manager Client Tools 12:mgr-push-5.0.3-1.30.3.noarch",
"SUSE Manager Client Tools 12:mgrctl-0.1.37-1.27.1.aarch64",
"SUSE Manager Client Tools 12:mgrctl-0.1.37-1.27.1.ppc64le",
"SUSE Manager Client Tools 12:mgrctl-0.1.37-1.27.1.s390x",
"SUSE Manager Client Tools 12:mgrctl-0.1.37-1.27.1.x86_64",
"SUSE Manager Client Tools 12:mgrctl-bash-completion-0.1.37-1.27.1.noarch",
"SUSE Manager Client Tools 12:mgrctl-zsh-completion-0.1.37-1.27.1.noarch",
"SUSE Manager Client Tools 12:python2-mgr-push-5.0.3-1.30.3.noarch",
"SUSE Manager Client Tools 12:python2-rhnlib-5.0.6-21.55.1.noarch",
"SUSE Manager Client Tools 12:spacecmd-5.0.14-38.162.1.noarch",
"SUSE Manager Client Tools 12:supportutils-plugin-susemanager-client-5.0.5-6.36.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L",
"version": "3.1"
},
"products": [
"SUSE Manager Client Tools 12:golang-github-prometheus-alertmanager-0.28.1-1.34.1.aarch64",
"SUSE Manager Client Tools 12:golang-github-prometheus-alertmanager-0.28.1-1.34.1.ppc64le",
"SUSE Manager Client Tools 12:golang-github-prometheus-alertmanager-0.28.1-1.34.1.s390x",
"SUSE Manager Client Tools 12:golang-github-prometheus-alertmanager-0.28.1-1.34.1.x86_64",
"SUSE Manager Client Tools 12:grafana-11.5.10-1.87.1.aarch64",
"SUSE Manager Client Tools 12:grafana-11.5.10-1.87.1.ppc64le",
"SUSE Manager Client Tools 12:grafana-11.5.10-1.87.1.s390x",
"SUSE Manager Client Tools 12:grafana-11.5.10-1.87.1.x86_64",
"SUSE Manager Client Tools 12:mgr-push-5.0.3-1.30.3.noarch",
"SUSE Manager Client Tools 12:mgrctl-0.1.37-1.27.1.aarch64",
"SUSE Manager Client Tools 12:mgrctl-0.1.37-1.27.1.ppc64le",
"SUSE Manager Client Tools 12:mgrctl-0.1.37-1.27.1.s390x",
"SUSE Manager Client Tools 12:mgrctl-0.1.37-1.27.1.x86_64",
"SUSE Manager Client Tools 12:mgrctl-bash-completion-0.1.37-1.27.1.noarch",
"SUSE Manager Client Tools 12:mgrctl-zsh-completion-0.1.37-1.27.1.noarch",
"SUSE Manager Client Tools 12:python2-mgr-push-5.0.3-1.30.3.noarch",
"SUSE Manager Client Tools 12:python2-rhnlib-5.0.6-21.55.1.noarch",
"SUSE Manager Client Tools 12:spacecmd-5.0.14-38.162.1.noarch",
"SUSE Manager Client Tools 12:supportutils-plugin-susemanager-client-5.0.5-6.36.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-12-18T11:56:34Z",
"details": "important"
}
],
"title": "CVE-2025-6023"
},
{
"cve": "CVE-2025-6197",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-6197"
}
],
"notes": [
{
"category": "general",
"text": "An open redirect vulnerability has been identified in Grafana OSS organization switching functionality.\n\n\nPrerequisites for exploitation:\n\n- Multiple organizations must exist in the Grafana instance\n\n- Victim must be on a different organization than the one specified in the URL",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Manager Client Tools 12:golang-github-prometheus-alertmanager-0.28.1-1.34.1.aarch64",
"SUSE Manager Client Tools 12:golang-github-prometheus-alertmanager-0.28.1-1.34.1.ppc64le",
"SUSE Manager Client Tools 12:golang-github-prometheus-alertmanager-0.28.1-1.34.1.s390x",
"SUSE Manager Client Tools 12:golang-github-prometheus-alertmanager-0.28.1-1.34.1.x86_64",
"SUSE Manager Client Tools 12:grafana-11.5.10-1.87.1.aarch64",
"SUSE Manager Client Tools 12:grafana-11.5.10-1.87.1.ppc64le",
"SUSE Manager Client Tools 12:grafana-11.5.10-1.87.1.s390x",
"SUSE Manager Client Tools 12:grafana-11.5.10-1.87.1.x86_64",
"SUSE Manager Client Tools 12:mgr-push-5.0.3-1.30.3.noarch",
"SUSE Manager Client Tools 12:mgrctl-0.1.37-1.27.1.aarch64",
"SUSE Manager Client Tools 12:mgrctl-0.1.37-1.27.1.ppc64le",
"SUSE Manager Client Tools 12:mgrctl-0.1.37-1.27.1.s390x",
"SUSE Manager Client Tools 12:mgrctl-0.1.37-1.27.1.x86_64",
"SUSE Manager Client Tools 12:mgrctl-bash-completion-0.1.37-1.27.1.noarch",
"SUSE Manager Client Tools 12:mgrctl-zsh-completion-0.1.37-1.27.1.noarch",
"SUSE Manager Client Tools 12:python2-mgr-push-5.0.3-1.30.3.noarch",
"SUSE Manager Client Tools 12:python2-rhnlib-5.0.6-21.55.1.noarch",
"SUSE Manager Client Tools 12:spacecmd-5.0.14-38.162.1.noarch",
"SUSE Manager Client Tools 12:supportutils-plugin-susemanager-client-5.0.5-6.36.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-6197",
"url": "https://www.suse.com/security/cve/CVE-2025-6197"
},
{
"category": "external",
"summary": "SUSE Bug 1246736 for CVE-2025-6197",
"url": "https://bugzilla.suse.com/1246736"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Manager Client Tools 12:golang-github-prometheus-alertmanager-0.28.1-1.34.1.aarch64",
"SUSE Manager Client Tools 12:golang-github-prometheus-alertmanager-0.28.1-1.34.1.ppc64le",
"SUSE Manager Client Tools 12:golang-github-prometheus-alertmanager-0.28.1-1.34.1.s390x",
"SUSE Manager Client Tools 12:golang-github-prometheus-alertmanager-0.28.1-1.34.1.x86_64",
"SUSE Manager Client Tools 12:grafana-11.5.10-1.87.1.aarch64",
"SUSE Manager Client Tools 12:grafana-11.5.10-1.87.1.ppc64le",
"SUSE Manager Client Tools 12:grafana-11.5.10-1.87.1.s390x",
"SUSE Manager Client Tools 12:grafana-11.5.10-1.87.1.x86_64",
"SUSE Manager Client Tools 12:mgr-push-5.0.3-1.30.3.noarch",
"SUSE Manager Client Tools 12:mgrctl-0.1.37-1.27.1.aarch64",
"SUSE Manager Client Tools 12:mgrctl-0.1.37-1.27.1.ppc64le",
"SUSE Manager Client Tools 12:mgrctl-0.1.37-1.27.1.s390x",
"SUSE Manager Client Tools 12:mgrctl-0.1.37-1.27.1.x86_64",
"SUSE Manager Client Tools 12:mgrctl-bash-completion-0.1.37-1.27.1.noarch",
"SUSE Manager Client Tools 12:mgrctl-zsh-completion-0.1.37-1.27.1.noarch",
"SUSE Manager Client Tools 12:python2-mgr-push-5.0.3-1.30.3.noarch",
"SUSE Manager Client Tools 12:python2-rhnlib-5.0.6-21.55.1.noarch",
"SUSE Manager Client Tools 12:spacecmd-5.0.14-38.162.1.noarch",
"SUSE Manager Client Tools 12:supportutils-plugin-susemanager-client-5.0.5-6.36.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.2,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Manager Client Tools 12:golang-github-prometheus-alertmanager-0.28.1-1.34.1.aarch64",
"SUSE Manager Client Tools 12:golang-github-prometheus-alertmanager-0.28.1-1.34.1.ppc64le",
"SUSE Manager Client Tools 12:golang-github-prometheus-alertmanager-0.28.1-1.34.1.s390x",
"SUSE Manager Client Tools 12:golang-github-prometheus-alertmanager-0.28.1-1.34.1.x86_64",
"SUSE Manager Client Tools 12:grafana-11.5.10-1.87.1.aarch64",
"SUSE Manager Client Tools 12:grafana-11.5.10-1.87.1.ppc64le",
"SUSE Manager Client Tools 12:grafana-11.5.10-1.87.1.s390x",
"SUSE Manager Client Tools 12:grafana-11.5.10-1.87.1.x86_64",
"SUSE Manager Client Tools 12:mgr-push-5.0.3-1.30.3.noarch",
"SUSE Manager Client Tools 12:mgrctl-0.1.37-1.27.1.aarch64",
"SUSE Manager Client Tools 12:mgrctl-0.1.37-1.27.1.ppc64le",
"SUSE Manager Client Tools 12:mgrctl-0.1.37-1.27.1.s390x",
"SUSE Manager Client Tools 12:mgrctl-0.1.37-1.27.1.x86_64",
"SUSE Manager Client Tools 12:mgrctl-bash-completion-0.1.37-1.27.1.noarch",
"SUSE Manager Client Tools 12:mgrctl-zsh-completion-0.1.37-1.27.1.noarch",
"SUSE Manager Client Tools 12:python2-mgr-push-5.0.3-1.30.3.noarch",
"SUSE Manager Client Tools 12:python2-rhnlib-5.0.6-21.55.1.noarch",
"SUSE Manager Client Tools 12:spacecmd-5.0.14-38.162.1.noarch",
"SUSE Manager Client Tools 12:supportutils-plugin-susemanager-client-5.0.5-6.36.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-12-18T11:56:34Z",
"details": "moderate"
}
],
"title": "CVE-2025-6197"
}
]
}
SUSE-SU-2025:4446-1
Vulnerability from csaf_suse - Published: 2025-12-18 08:49 - Updated: 2025-12-18 08:49Summary
Security update 5.1.1.1 for Multi-Linux Manager Client Tools
Notes
Title of the patch
Security update 5.1.1.1 for Multi-Linux Manager Client Tools
Description of the patch
This update fixes the following issues:
grafana was updated from version 11.5.7 to 11.5.10:
- Security issues fixed:
* CVE-2025-64751: Drop experimental implementation of authorization Zanzana server/client (version 11.5.10)
(bsc#1254113)
* CVE-2025-47911: Fix parsing HTML documents (version 11.5.10) (bsc#1251454)
* CVE-2025-58190: Fix excessive memory consumption (version 11.5.10) (bsc#1251657)
* CVE-2025-11065: Fixed sensitive information leak in logs (version 11.5.9) (bsc#1250616)
- Other changes, new features and bugs fixed:
* Version 11.5.10:
+ Use forked wire from Grafana repository instead of external package (jsc#PED-14178)
+ Auth: Fix render user OAuth passthrough.
+ LDAP Authentication: Fix URL to propagate username context as parameter.
+ Plugins: Dependencies do not inherit parent URL for preinstall.
* Version 11.5.9:
+ Auditing: Document new options for recording datasource query request/response body.
+ Login: Fixed redirection after login when Grafana is served from subpath.
* Update to version 11.5.8:
+ No relevant changes
uyuni-tools:
- version 5.1.23-0
* Update the default tag to 5.1.1.1
- version 5.1.22-0
* Fix cobbler config migration to standalone files
* Fix generated DB certificate subject alternate names
- version 5.1.21-0
* Remove extraneous quotes when getting the running image (bsc#1249434)
Patchnames
SUSE-2025-4446,SUSE-MultiLinuxManagerTools-SLE-15-2025-4446,SUSE-MultiLinuxManagerTools-SLE-Micro-5-2025-4446
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update 5.1.1.1 for Multi-Linux Manager Client Tools",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update fixes the following issues:\n\ngrafana was updated from version 11.5.7 to 11.5.10:\n\n- Security issues fixed:\n\n * CVE-2025-64751: Drop experimental implementation of authorization Zanzana server/client (version 11.5.10)\n (bsc#1254113)\n * CVE-2025-47911: Fix parsing HTML documents (version 11.5.10) (bsc#1251454)\n * CVE-2025-58190: Fix excessive memory consumption (version 11.5.10) (bsc#1251657)\n * CVE-2025-11065: Fixed sensitive information leak in logs (version 11.5.9) (bsc#1250616)\n\n- Other changes, new features and bugs fixed:\n\n * Version 11.5.10:\n + Use forked wire from Grafana repository instead of external package (jsc#PED-14178)\n + Auth: Fix render user OAuth passthrough.\n + LDAP Authentication: Fix URL to propagate username context as parameter.\n + Plugins: Dependencies do not inherit parent URL for preinstall.\n * Version 11.5.9:\n + Auditing: Document new options for recording datasource query request/response body.\n + Login: Fixed redirection after login when Grafana is served from subpath.\n * Update to version 11.5.8:\n + No relevant changes\n\nuyuni-tools:\n\n- version 5.1.23-0\n * Update the default tag to 5.1.1.1\n- version 5.1.22-0\n * Fix cobbler config migration to standalone files\n * Fix generated DB certificate subject alternate names\n- version 5.1.21-0\n * Remove extraneous quotes when getting the running image (bsc#1249434)\n\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-2025-4446,SUSE-MultiLinuxManagerTools-SLE-15-2025-4446,SUSE-MultiLinuxManagerTools-SLE-Micro-5-2025-4446",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2025_4446-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2025:4446-1",
"url": "https://www.suse.com/support/update/announcement/2025/suse-su-20254446-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2025:4446-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2025-December/023607.html"
},
{
"category": "self",
"summary": "SUSE Bug 1249434",
"url": "https://bugzilla.suse.com/1249434"
},
{
"category": "self",
"summary": "SUSE Bug 1250616",
"url": "https://bugzilla.suse.com/1250616"
},
{
"category": "self",
"summary": "SUSE Bug 1251454",
"url": "https://bugzilla.suse.com/1251454"
},
{
"category": "self",
"summary": "SUSE Bug 1251657",
"url": "https://bugzilla.suse.com/1251657"
},
{
"category": "self",
"summary": "SUSE Bug 1254113",
"url": "https://bugzilla.suse.com/1254113"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-11065 page",
"url": "https://www.suse.com/security/cve/CVE-2025-11065/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-47911 page",
"url": "https://www.suse.com/security/cve/CVE-2025-47911/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-58190 page",
"url": "https://www.suse.com/security/cve/CVE-2025-58190/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-64751 page",
"url": "https://www.suse.com/security/cve/CVE-2025-64751/"
}
],
"title": "Security update 5.1.1.1 for Multi-Linux Manager Client Tools",
"tracking": {
"current_release_date": "2025-12-18T08:49:58Z",
"generator": {
"date": "2025-12-18T08:49:58Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2025:4446-1",
"initial_release_date": "2025-12-18T08:49:58Z",
"revision_history": [
{
"date": "2025-12-18T08:49:58Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "grafana-11.5.10-150002.4.6.1.aarch64",
"product": {
"name": "grafana-11.5.10-150002.4.6.1.aarch64",
"product_id": "grafana-11.5.10-150002.4.6.1.aarch64"
}
},
{
"category": "product_version",
"name": "mgrctl-5.1.23-150002.3.6.1.aarch64",
"product": {
"name": "mgrctl-5.1.23-150002.3.6.1.aarch64",
"product_id": "mgrctl-5.1.23-150002.3.6.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "mgrctl-bash-completion-5.1.23-150002.3.6.1.noarch",
"product": {
"name": "mgrctl-bash-completion-5.1.23-150002.3.6.1.noarch",
"product_id": "mgrctl-bash-completion-5.1.23-150002.3.6.1.noarch"
}
},
{
"category": "product_version",
"name": "mgrctl-lang-5.1.23-150002.3.6.1.noarch",
"product": {
"name": "mgrctl-lang-5.1.23-150002.3.6.1.noarch",
"product_id": "mgrctl-lang-5.1.23-150002.3.6.1.noarch"
}
},
{
"category": "product_version",
"name": "mgrctl-zsh-completion-5.1.23-150002.3.6.1.noarch",
"product": {
"name": "mgrctl-zsh-completion-5.1.23-150002.3.6.1.noarch",
"product_id": "mgrctl-zsh-completion-5.1.23-150002.3.6.1.noarch"
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "grafana-11.5.10-150002.4.6.1.ppc64le",
"product": {
"name": "grafana-11.5.10-150002.4.6.1.ppc64le",
"product_id": "grafana-11.5.10-150002.4.6.1.ppc64le"
}
},
{
"category": "product_version",
"name": "mgrctl-5.1.23-150002.3.6.1.ppc64le",
"product": {
"name": "mgrctl-5.1.23-150002.3.6.1.ppc64le",
"product_id": "mgrctl-5.1.23-150002.3.6.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "grafana-11.5.10-150002.4.6.1.s390x",
"product": {
"name": "grafana-11.5.10-150002.4.6.1.s390x",
"product_id": "grafana-11.5.10-150002.4.6.1.s390x"
}
},
{
"category": "product_version",
"name": "mgrctl-5.1.23-150002.3.6.1.s390x",
"product": {
"name": "mgrctl-5.1.23-150002.3.6.1.s390x",
"product_id": "mgrctl-5.1.23-150002.3.6.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "grafana-11.5.10-150002.4.6.1.x86_64",
"product": {
"name": "grafana-11.5.10-150002.4.6.1.x86_64",
"product_id": "grafana-11.5.10-150002.4.6.1.x86_64"
}
},
{
"category": "product_version",
"name": "mgrctl-5.1.23-150002.3.6.1.x86_64",
"product": {
"name": "mgrctl-5.1.23-150002.3.6.1.x86_64",
"product_id": "mgrctl-5.1.23-150002.3.6.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Multi Linux Manager Tools SLE-15",
"product": {
"name": "SUSE Multi Linux Manager Tools SLE-15",
"product_id": "SUSE Multi Linux Manager Tools SLE-15"
}
},
{
"category": "product_name",
"name": "SUSE Multi Linux Manager Tools SLE-Micro-5",
"product": {
"name": "SUSE Multi Linux Manager Tools SLE-Micro-5",
"product_id": "SUSE Multi Linux Manager Tools SLE-Micro-5"
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-11.5.10-150002.4.6.1.aarch64 as component of SUSE Multi Linux Manager Tools SLE-15",
"product_id": "SUSE Multi Linux Manager Tools SLE-15:grafana-11.5.10-150002.4.6.1.aarch64"
},
"product_reference": "grafana-11.5.10-150002.4.6.1.aarch64",
"relates_to_product_reference": "SUSE Multi Linux Manager Tools SLE-15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-11.5.10-150002.4.6.1.ppc64le as component of SUSE Multi Linux Manager Tools SLE-15",
"product_id": "SUSE Multi Linux Manager Tools SLE-15:grafana-11.5.10-150002.4.6.1.ppc64le"
},
"product_reference": "grafana-11.5.10-150002.4.6.1.ppc64le",
"relates_to_product_reference": "SUSE Multi Linux Manager Tools SLE-15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-11.5.10-150002.4.6.1.s390x as component of SUSE Multi Linux Manager Tools SLE-15",
"product_id": "SUSE Multi Linux Manager Tools SLE-15:grafana-11.5.10-150002.4.6.1.s390x"
},
"product_reference": "grafana-11.5.10-150002.4.6.1.s390x",
"relates_to_product_reference": "SUSE Multi Linux Manager Tools SLE-15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-11.5.10-150002.4.6.1.x86_64 as component of SUSE Multi Linux Manager Tools SLE-15",
"product_id": "SUSE Multi Linux Manager Tools SLE-15:grafana-11.5.10-150002.4.6.1.x86_64"
},
"product_reference": "grafana-11.5.10-150002.4.6.1.x86_64",
"relates_to_product_reference": "SUSE Multi Linux Manager Tools SLE-15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mgrctl-5.1.23-150002.3.6.1.aarch64 as component of SUSE Multi Linux Manager Tools SLE-15",
"product_id": "SUSE Multi Linux Manager Tools SLE-15:mgrctl-5.1.23-150002.3.6.1.aarch64"
},
"product_reference": "mgrctl-5.1.23-150002.3.6.1.aarch64",
"relates_to_product_reference": "SUSE Multi Linux Manager Tools SLE-15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mgrctl-5.1.23-150002.3.6.1.ppc64le as component of SUSE Multi Linux Manager Tools SLE-15",
"product_id": "SUSE Multi Linux Manager Tools SLE-15:mgrctl-5.1.23-150002.3.6.1.ppc64le"
},
"product_reference": "mgrctl-5.1.23-150002.3.6.1.ppc64le",
"relates_to_product_reference": "SUSE Multi Linux Manager Tools SLE-15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mgrctl-5.1.23-150002.3.6.1.s390x as component of SUSE Multi Linux Manager Tools SLE-15",
"product_id": "SUSE Multi Linux Manager Tools SLE-15:mgrctl-5.1.23-150002.3.6.1.s390x"
},
"product_reference": "mgrctl-5.1.23-150002.3.6.1.s390x",
"relates_to_product_reference": "SUSE Multi Linux Manager Tools SLE-15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mgrctl-5.1.23-150002.3.6.1.x86_64 as component of SUSE Multi Linux Manager Tools SLE-15",
"product_id": "SUSE Multi Linux Manager Tools SLE-15:mgrctl-5.1.23-150002.3.6.1.x86_64"
},
"product_reference": "mgrctl-5.1.23-150002.3.6.1.x86_64",
"relates_to_product_reference": "SUSE Multi Linux Manager Tools SLE-15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mgrctl-bash-completion-5.1.23-150002.3.6.1.noarch as component of SUSE Multi Linux Manager Tools SLE-15",
"product_id": "SUSE Multi Linux Manager Tools SLE-15:mgrctl-bash-completion-5.1.23-150002.3.6.1.noarch"
},
"product_reference": "mgrctl-bash-completion-5.1.23-150002.3.6.1.noarch",
"relates_to_product_reference": "SUSE Multi Linux Manager Tools SLE-15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mgrctl-lang-5.1.23-150002.3.6.1.noarch as component of SUSE Multi Linux Manager Tools SLE-15",
"product_id": "SUSE Multi Linux Manager Tools SLE-15:mgrctl-lang-5.1.23-150002.3.6.1.noarch"
},
"product_reference": "mgrctl-lang-5.1.23-150002.3.6.1.noarch",
"relates_to_product_reference": "SUSE Multi Linux Manager Tools SLE-15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mgrctl-zsh-completion-5.1.23-150002.3.6.1.noarch as component of SUSE Multi Linux Manager Tools SLE-15",
"product_id": "SUSE Multi Linux Manager Tools SLE-15:mgrctl-zsh-completion-5.1.23-150002.3.6.1.noarch"
},
"product_reference": "mgrctl-zsh-completion-5.1.23-150002.3.6.1.noarch",
"relates_to_product_reference": "SUSE Multi Linux Manager Tools SLE-15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mgrctl-5.1.23-150002.3.6.1.aarch64 as component of SUSE Multi Linux Manager Tools SLE-Micro-5",
"product_id": "SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-5.1.23-150002.3.6.1.aarch64"
},
"product_reference": "mgrctl-5.1.23-150002.3.6.1.aarch64",
"relates_to_product_reference": "SUSE Multi Linux Manager Tools SLE-Micro-5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mgrctl-5.1.23-150002.3.6.1.ppc64le as component of SUSE Multi Linux Manager Tools SLE-Micro-5",
"product_id": "SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-5.1.23-150002.3.6.1.ppc64le"
},
"product_reference": "mgrctl-5.1.23-150002.3.6.1.ppc64le",
"relates_to_product_reference": "SUSE Multi Linux Manager Tools SLE-Micro-5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mgrctl-5.1.23-150002.3.6.1.s390x as component of SUSE Multi Linux Manager Tools SLE-Micro-5",
"product_id": "SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-5.1.23-150002.3.6.1.s390x"
},
"product_reference": "mgrctl-5.1.23-150002.3.6.1.s390x",
"relates_to_product_reference": "SUSE Multi Linux Manager Tools SLE-Micro-5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mgrctl-5.1.23-150002.3.6.1.x86_64 as component of SUSE Multi Linux Manager Tools SLE-Micro-5",
"product_id": "SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-5.1.23-150002.3.6.1.x86_64"
},
"product_reference": "mgrctl-5.1.23-150002.3.6.1.x86_64",
"relates_to_product_reference": "SUSE Multi Linux Manager Tools SLE-Micro-5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mgrctl-bash-completion-5.1.23-150002.3.6.1.noarch as component of SUSE Multi Linux Manager Tools SLE-Micro-5",
"product_id": "SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-bash-completion-5.1.23-150002.3.6.1.noarch"
},
"product_reference": "mgrctl-bash-completion-5.1.23-150002.3.6.1.noarch",
"relates_to_product_reference": "SUSE Multi Linux Manager Tools SLE-Micro-5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mgrctl-lang-5.1.23-150002.3.6.1.noarch as component of SUSE Multi Linux Manager Tools SLE-Micro-5",
"product_id": "SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-lang-5.1.23-150002.3.6.1.noarch"
},
"product_reference": "mgrctl-lang-5.1.23-150002.3.6.1.noarch",
"relates_to_product_reference": "SUSE Multi Linux Manager Tools SLE-Micro-5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mgrctl-zsh-completion-5.1.23-150002.3.6.1.noarch as component of SUSE Multi Linux Manager Tools SLE-Micro-5",
"product_id": "SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-zsh-completion-5.1.23-150002.3.6.1.noarch"
},
"product_reference": "mgrctl-zsh-completion-5.1.23-150002.3.6.1.noarch",
"relates_to_product_reference": "SUSE Multi Linux Manager Tools SLE-Micro-5"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-11065",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-11065"
}
],
"notes": [
{
"category": "general",
"text": "unknown",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Multi Linux Manager Tools SLE-15:grafana-11.5.10-150002.4.6.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-15:grafana-11.5.10-150002.4.6.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-15:grafana-11.5.10-150002.4.6.1.s390x",
"SUSE Multi Linux Manager Tools SLE-15:grafana-11.5.10-150002.4.6.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-5.1.23-150002.3.6.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-5.1.23-150002.3.6.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-5.1.23-150002.3.6.1.s390x",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-5.1.23-150002.3.6.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-bash-completion-5.1.23-150002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-lang-5.1.23-150002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-zsh-completion-5.1.23-150002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-5.1.23-150002.3.6.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-5.1.23-150002.3.6.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-5.1.23-150002.3.6.1.s390x",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-5.1.23-150002.3.6.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-bash-completion-5.1.23-150002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-lang-5.1.23-150002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-zsh-completion-5.1.23-150002.3.6.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-11065",
"url": "https://www.suse.com/security/cve/CVE-2025-11065"
},
{
"category": "external",
"summary": "SUSE Bug 1250608 for CVE-2025-11065",
"url": "https://bugzilla.suse.com/1250608"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Multi Linux Manager Tools SLE-15:grafana-11.5.10-150002.4.6.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-15:grafana-11.5.10-150002.4.6.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-15:grafana-11.5.10-150002.4.6.1.s390x",
"SUSE Multi Linux Manager Tools SLE-15:grafana-11.5.10-150002.4.6.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-5.1.23-150002.3.6.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-5.1.23-150002.3.6.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-5.1.23-150002.3.6.1.s390x",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-5.1.23-150002.3.6.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-bash-completion-5.1.23-150002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-lang-5.1.23-150002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-zsh-completion-5.1.23-150002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-5.1.23-150002.3.6.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-5.1.23-150002.3.6.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-5.1.23-150002.3.6.1.s390x",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-5.1.23-150002.3.6.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-bash-completion-5.1.23-150002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-lang-5.1.23-150002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-zsh-completion-5.1.23-150002.3.6.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Multi Linux Manager Tools SLE-15:grafana-11.5.10-150002.4.6.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-15:grafana-11.5.10-150002.4.6.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-15:grafana-11.5.10-150002.4.6.1.s390x",
"SUSE Multi Linux Manager Tools SLE-15:grafana-11.5.10-150002.4.6.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-5.1.23-150002.3.6.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-5.1.23-150002.3.6.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-5.1.23-150002.3.6.1.s390x",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-5.1.23-150002.3.6.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-bash-completion-5.1.23-150002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-lang-5.1.23-150002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-zsh-completion-5.1.23-150002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-5.1.23-150002.3.6.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-5.1.23-150002.3.6.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-5.1.23-150002.3.6.1.s390x",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-5.1.23-150002.3.6.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-bash-completion-5.1.23-150002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-lang-5.1.23-150002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-zsh-completion-5.1.23-150002.3.6.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-12-18T08:49:58Z",
"details": "moderate"
}
],
"title": "CVE-2025-11065"
},
{
"cve": "CVE-2025-47911",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-47911"
}
],
"notes": [
{
"category": "general",
"text": "unknown",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Multi Linux Manager Tools SLE-15:grafana-11.5.10-150002.4.6.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-15:grafana-11.5.10-150002.4.6.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-15:grafana-11.5.10-150002.4.6.1.s390x",
"SUSE Multi Linux Manager Tools SLE-15:grafana-11.5.10-150002.4.6.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-5.1.23-150002.3.6.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-5.1.23-150002.3.6.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-5.1.23-150002.3.6.1.s390x",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-5.1.23-150002.3.6.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-bash-completion-5.1.23-150002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-lang-5.1.23-150002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-zsh-completion-5.1.23-150002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-5.1.23-150002.3.6.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-5.1.23-150002.3.6.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-5.1.23-150002.3.6.1.s390x",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-5.1.23-150002.3.6.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-bash-completion-5.1.23-150002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-lang-5.1.23-150002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-zsh-completion-5.1.23-150002.3.6.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-47911",
"url": "https://www.suse.com/security/cve/CVE-2025-47911"
},
{
"category": "external",
"summary": "SUSE Bug 1251308 for CVE-2025-47911",
"url": "https://bugzilla.suse.com/1251308"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Multi Linux Manager Tools SLE-15:grafana-11.5.10-150002.4.6.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-15:grafana-11.5.10-150002.4.6.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-15:grafana-11.5.10-150002.4.6.1.s390x",
"SUSE Multi Linux Manager Tools SLE-15:grafana-11.5.10-150002.4.6.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-5.1.23-150002.3.6.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-5.1.23-150002.3.6.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-5.1.23-150002.3.6.1.s390x",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-5.1.23-150002.3.6.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-bash-completion-5.1.23-150002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-lang-5.1.23-150002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-zsh-completion-5.1.23-150002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-5.1.23-150002.3.6.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-5.1.23-150002.3.6.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-5.1.23-150002.3.6.1.s390x",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-5.1.23-150002.3.6.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-bash-completion-5.1.23-150002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-lang-5.1.23-150002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-zsh-completion-5.1.23-150002.3.6.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"SUSE Multi Linux Manager Tools SLE-15:grafana-11.5.10-150002.4.6.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-15:grafana-11.5.10-150002.4.6.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-15:grafana-11.5.10-150002.4.6.1.s390x",
"SUSE Multi Linux Manager Tools SLE-15:grafana-11.5.10-150002.4.6.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-5.1.23-150002.3.6.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-5.1.23-150002.3.6.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-5.1.23-150002.3.6.1.s390x",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-5.1.23-150002.3.6.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-bash-completion-5.1.23-150002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-lang-5.1.23-150002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-zsh-completion-5.1.23-150002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-5.1.23-150002.3.6.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-5.1.23-150002.3.6.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-5.1.23-150002.3.6.1.s390x",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-5.1.23-150002.3.6.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-bash-completion-5.1.23-150002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-lang-5.1.23-150002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-zsh-completion-5.1.23-150002.3.6.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-12-18T08:49:58Z",
"details": "moderate"
}
],
"title": "CVE-2025-47911"
},
{
"cve": "CVE-2025-58190",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-58190"
}
],
"notes": [
{
"category": "general",
"text": "unknown",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Multi Linux Manager Tools SLE-15:grafana-11.5.10-150002.4.6.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-15:grafana-11.5.10-150002.4.6.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-15:grafana-11.5.10-150002.4.6.1.s390x",
"SUSE Multi Linux Manager Tools SLE-15:grafana-11.5.10-150002.4.6.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-5.1.23-150002.3.6.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-5.1.23-150002.3.6.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-5.1.23-150002.3.6.1.s390x",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-5.1.23-150002.3.6.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-bash-completion-5.1.23-150002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-lang-5.1.23-150002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-zsh-completion-5.1.23-150002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-5.1.23-150002.3.6.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-5.1.23-150002.3.6.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-5.1.23-150002.3.6.1.s390x",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-5.1.23-150002.3.6.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-bash-completion-5.1.23-150002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-lang-5.1.23-150002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-zsh-completion-5.1.23-150002.3.6.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-58190",
"url": "https://www.suse.com/security/cve/CVE-2025-58190"
},
{
"category": "external",
"summary": "SUSE Bug 1251309 for CVE-2025-58190",
"url": "https://bugzilla.suse.com/1251309"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Multi Linux Manager Tools SLE-15:grafana-11.5.10-150002.4.6.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-15:grafana-11.5.10-150002.4.6.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-15:grafana-11.5.10-150002.4.6.1.s390x",
"SUSE Multi Linux Manager Tools SLE-15:grafana-11.5.10-150002.4.6.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-5.1.23-150002.3.6.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-5.1.23-150002.3.6.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-5.1.23-150002.3.6.1.s390x",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-5.1.23-150002.3.6.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-bash-completion-5.1.23-150002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-lang-5.1.23-150002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-zsh-completion-5.1.23-150002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-5.1.23-150002.3.6.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-5.1.23-150002.3.6.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-5.1.23-150002.3.6.1.s390x",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-5.1.23-150002.3.6.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-bash-completion-5.1.23-150002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-lang-5.1.23-150002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-zsh-completion-5.1.23-150002.3.6.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"SUSE Multi Linux Manager Tools SLE-15:grafana-11.5.10-150002.4.6.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-15:grafana-11.5.10-150002.4.6.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-15:grafana-11.5.10-150002.4.6.1.s390x",
"SUSE Multi Linux Manager Tools SLE-15:grafana-11.5.10-150002.4.6.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-5.1.23-150002.3.6.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-5.1.23-150002.3.6.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-5.1.23-150002.3.6.1.s390x",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-5.1.23-150002.3.6.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-bash-completion-5.1.23-150002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-lang-5.1.23-150002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-zsh-completion-5.1.23-150002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-5.1.23-150002.3.6.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-5.1.23-150002.3.6.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-5.1.23-150002.3.6.1.s390x",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-5.1.23-150002.3.6.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-bash-completion-5.1.23-150002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-lang-5.1.23-150002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-zsh-completion-5.1.23-150002.3.6.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-12-18T08:49:58Z",
"details": "moderate"
}
],
"title": "CVE-2025-58190"
},
{
"cve": "CVE-2025-64751",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-64751"
}
],
"notes": [
{
"category": "general",
"text": "OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA v1.4.0 to v1.11.0 ( openfga-0.1.34 \u003c= Helm chart \u003c= openfga-0.2.48, v.1.4.0 \u003c= docker \u003c= v.1.11.0) are vulnerable to improper policy enforcement when certain Check and ListObject calls are executed. This issue has been patched in version 1.11.1.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Multi Linux Manager Tools SLE-15:grafana-11.5.10-150002.4.6.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-15:grafana-11.5.10-150002.4.6.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-15:grafana-11.5.10-150002.4.6.1.s390x",
"SUSE Multi Linux Manager Tools SLE-15:grafana-11.5.10-150002.4.6.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-5.1.23-150002.3.6.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-5.1.23-150002.3.6.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-5.1.23-150002.3.6.1.s390x",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-5.1.23-150002.3.6.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-bash-completion-5.1.23-150002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-lang-5.1.23-150002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-zsh-completion-5.1.23-150002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-5.1.23-150002.3.6.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-5.1.23-150002.3.6.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-5.1.23-150002.3.6.1.s390x",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-5.1.23-150002.3.6.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-bash-completion-5.1.23-150002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-lang-5.1.23-150002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-zsh-completion-5.1.23-150002.3.6.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-64751",
"url": "https://www.suse.com/security/cve/CVE-2025-64751"
},
{
"category": "external",
"summary": "SUSE Bug 1254112 for CVE-2025-64751",
"url": "https://bugzilla.suse.com/1254112"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Multi Linux Manager Tools SLE-15:grafana-11.5.10-150002.4.6.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-15:grafana-11.5.10-150002.4.6.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-15:grafana-11.5.10-150002.4.6.1.s390x",
"SUSE Multi Linux Manager Tools SLE-15:grafana-11.5.10-150002.4.6.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-5.1.23-150002.3.6.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-5.1.23-150002.3.6.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-5.1.23-150002.3.6.1.s390x",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-5.1.23-150002.3.6.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-bash-completion-5.1.23-150002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-lang-5.1.23-150002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-zsh-completion-5.1.23-150002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-5.1.23-150002.3.6.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-5.1.23-150002.3.6.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-5.1.23-150002.3.6.1.s390x",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-5.1.23-150002.3.6.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-bash-completion-5.1.23-150002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-lang-5.1.23-150002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-zsh-completion-5.1.23-150002.3.6.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Multi Linux Manager Tools SLE-15:grafana-11.5.10-150002.4.6.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-15:grafana-11.5.10-150002.4.6.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-15:grafana-11.5.10-150002.4.6.1.s390x",
"SUSE Multi Linux Manager Tools SLE-15:grafana-11.5.10-150002.4.6.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-5.1.23-150002.3.6.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-5.1.23-150002.3.6.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-5.1.23-150002.3.6.1.s390x",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-5.1.23-150002.3.6.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-bash-completion-5.1.23-150002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-lang-5.1.23-150002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-15:mgrctl-zsh-completion-5.1.23-150002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-5.1.23-150002.3.6.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-5.1.23-150002.3.6.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-5.1.23-150002.3.6.1.s390x",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-5.1.23-150002.3.6.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-bash-completion-5.1.23-150002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-lang-5.1.23-150002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-Micro-5:mgrctl-zsh-completion-5.1.23-150002.3.6.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-12-18T08:49:58Z",
"details": "important"
}
],
"title": "CVE-2025-64751"
}
]
}
SUSE-SU-2025:4458-1
Vulnerability from csaf_suse - Published: 2025-12-18 11:57 - Updated: 2025-12-18 11:57Summary
Security update 5.0.6 for Multi-Linux Manager Client Tools
Notes
Title of the patch
Security update 5.0.6 for Multi-Linux Manager Client Tools
Description of the patch
This update fixes the following issues:
dracut-saltboot:
- Update to version 1.0.0
* Reboot on salt key timeout (bsc#1237495)
* Fixed parsing files with space in the name (bsc#1252100)
grafana was updated from version 11.5.5 to 11.5.10:
- Security issues fixed:
* CVE-2025-47911: Fix parsing HTML documents (bsc#1251454)
* CVE-2025-58190: Fix excessive memory consumption (bsc#1251657)
* CVE-2025-64751: Drop experimental implementation of authorization Zanzana server/client
(bsc#1254113)
* CVE-2025-11065: Fixed sensitive information leak in logs (version 11.5.9) (bsc#1250616)
* CVE-2025-6023: Fixed cross-site-scripting via scripted dashboards (version 11.5.7) (bsc#1246735)
* CVE-2025-6197: Fixed open redirect in organization switching (version 11.5.7) (bsc#1246736)
* CVE-2025-3415: Fixed exposure of DingDing alerting integration URL to Viewer level users (version 11.5.6)
(bsc#1245302)
- Other changes, new features and bugs fixed:
* Version 11.5.10:
+ Update to Go 1.25
+ Update to golang.org/x/net v0.45.0
+ Auth: Fix render user OAuth passthrough
+ LDAP Authentication: Fix URL to propagate username context as parameter
* Version 11.5.9:
+ Auditing: Document new options for recording datasource query request/response body.
+ Login: Fixed redirection after login when Grafana is served from subpath.
* Version 11.5.7:
+ Azure: Fixed legend formatting and resource name determination in template variable queries.
mgr-push:
- Version 5.0.3-0
* Fixed syntax error in changelog
rhnlib:
- Version 5.0.6-0
* Use more secure defusedxml parser (bsc#1227577)
spacecmd:
- Version 5.0.14-0
* Fixed installation of python lib files on Ubuntu 24.04 (bsc#1246586)
* Use JSON instead of pickle for spacecmd cache (bsc#1227579)
* Make spacecmd to work with Python 3.12 and higher
* Call print statements properly in Python 3
uyuni-tools:
- Version 0.1.37-0
* Handle CA files with symlinks during migration (bsc#1251044)
* Add a lowercase version of --logLevel (bsc#1243611)
* Adjust traefik exposed configuration for chart v27+ (bsc#1247721)
* Stop executing scripts in temporary folder (bsc#1243704)
* Convert the traefik install time to local time (bsc#1251138)
* Run smdba and reindex only during migration (bsc#1244534)
* Support config: collect podman inspect for hub container (bsc#1245099)
* Add --registry-host, --registry-user and --registry-password to pull images from an authenticate registry
* Deprecate --registry
* Use new dedicated path for Cobbler settings (bsc#1244027)
* Migrate custom auto installation snippets (bsc#1246320)
* Add SLE15SP7 to buildin productmap
* Fix loading product map from mgradm configuration file (bsc#1246068)
* Fix channel override for distro copy
* Do not use sudo when running as a root user (bsc#1246882)
* Do not require backups to be at the same location for restoring (bsc#1246906)
* Check for restorecon presence before calling (bsc#1246925)
* Automatically get up-to-date systemid file on salt based proxy hosts (bsc#1246789)
* Fix recomputing proxy images when installing a ptf or test (bsc#1246553)
* Add migration for server monitoring configuration (bsc#1247688)
- Version 0.1.36-0
* Bump the default image tag
- Version 0.1.35-0
* Restore SELinux contexts for restored backup volumes (bsc#1244127)
- Version 0.1.34-0
* Fix mgradm backup create handling of images and systemd files (bsc#1246738)
- Version 0.1.33-0
* Restore volumes using tar instead of podman import (bsc#1244127)
Patchnames
SUSE-2025-4458,SUSE-SLE-Manager-Tools-15-2025-4458,SUSE-SLE-Manager-Tools-For-Micro-5-2025-4458,openSUSE-SLE-15.6-2025-4458
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update 5.0.6 for Multi-Linux Manager Client Tools",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update fixes the following issues:\n\ndracut-saltboot:\n\n- Update to version 1.0.0\n * Reboot on salt key timeout (bsc#1237495)\n * Fixed parsing files with space in the name (bsc#1252100)\n\ngrafana was updated from version 11.5.5 to 11.5.10:\n\n- Security issues fixed:\n\n * CVE-2025-47911: Fix parsing HTML documents (bsc#1251454)\n * CVE-2025-58190: Fix excessive memory consumption (bsc#1251657)\n * CVE-2025-64751: Drop experimental implementation of authorization Zanzana server/client\n (bsc#1254113)\n * CVE-2025-11065: Fixed sensitive information leak in logs (version 11.5.9) (bsc#1250616)\n * CVE-2025-6023: Fixed cross-site-scripting via scripted dashboards (version 11.5.7) (bsc#1246735)\n * CVE-2025-6197: Fixed open redirect in organization switching (version 11.5.7) (bsc#1246736)\n * CVE-2025-3415: Fixed exposure of DingDing alerting integration URL to Viewer level users (version 11.5.6)\n (bsc#1245302)\n\n- Other changes, new features and bugs fixed:\n \n * Version 11.5.10:\n + Update to Go 1.25\n + Update to golang.org/x/net v0.45.0\n + Auth: Fix render user OAuth passthrough\n + LDAP Authentication: Fix URL to propagate username context as parameter\n\n * Version 11.5.9:\n + Auditing: Document new options for recording datasource query request/response body.\n + Login: Fixed redirection after login when Grafana is served from subpath.\n\n * Version 11.5.7:\n + Azure: Fixed legend formatting and resource name determination in template variable queries.\n\nmgr-push:\n\n- Version 5.0.3-0\n * Fixed syntax error in changelog\n\nrhnlib:\n\n- Version 5.0.6-0\n * Use more secure defusedxml parser (bsc#1227577)\n\nspacecmd:\n\n- Version 5.0.14-0\n * Fixed installation of python lib files on Ubuntu 24.04 (bsc#1246586)\n * Use JSON instead of pickle for spacecmd cache (bsc#1227579)\n * Make spacecmd to work with Python 3.12 and higher\n * Call print statements properly in Python 3\n\nuyuni-tools:\n\n- Version 0.1.37-0\n * Handle CA files with symlinks during migration (bsc#1251044)\n * Add a lowercase version of --logLevel (bsc#1243611)\n * Adjust traefik exposed configuration for chart v27+ (bsc#1247721)\n * Stop executing scripts in temporary folder (bsc#1243704)\n * Convert the traefik install time to local time (bsc#1251138)\n * Run smdba and reindex only during migration (bsc#1244534)\n * Support config: collect podman inspect for hub container (bsc#1245099)\n * Add --registry-host, --registry-user and --registry-password to pull images from an authenticate registry\n * Deprecate --registry\n * Use new dedicated path for Cobbler settings (bsc#1244027)\n * Migrate custom auto installation snippets (bsc#1246320)\n * Add SLE15SP7 to buildin productmap\n * Fix loading product map from mgradm configuration file (bsc#1246068)\n * Fix channel override for distro copy\n * Do not use sudo when running as a root user (bsc#1246882)\n * Do not require backups to be at the same location for restoring (bsc#1246906)\n * Check for restorecon presence before calling (bsc#1246925)\n * Automatically get up-to-date systemid file on salt based proxy hosts (bsc#1246789)\n * Fix recomputing proxy images when installing a ptf or test (bsc#1246553)\n * Add migration for server monitoring configuration (bsc#1247688)\n- Version 0.1.36-0\n * Bump the default image tag\n- Version 0.1.35-0\n * Restore SELinux contexts for restored backup volumes (bsc#1244127)\n- Version 0.1.34-0\n * Fix mgradm backup create handling of images and systemd files (bsc#1246738)\n- Version 0.1.33-0\n * Restore volumes using tar instead of podman import (bsc#1244127)\n\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-2025-4458,SUSE-SLE-Manager-Tools-15-2025-4458,SUSE-SLE-Manager-Tools-For-Micro-5-2025-4458,openSUSE-SLE-15.6-2025-4458",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2025_4458-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2025:4458-1",
"url": "https://www.suse.com/support/update/announcement/2025/suse-su-20254458-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2025:4458-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2025-December/023628.html"
},
{
"category": "self",
"summary": "SUSE Bug 1227577",
"url": "https://bugzilla.suse.com/1227577"
},
{
"category": "self",
"summary": "SUSE Bug 1227579",
"url": "https://bugzilla.suse.com/1227579"
},
{
"category": "self",
"summary": "SUSE Bug 1237495",
"url": "https://bugzilla.suse.com/1237495"
},
{
"category": "self",
"summary": "SUSE Bug 1243611",
"url": "https://bugzilla.suse.com/1243611"
},
{
"category": "self",
"summary": "SUSE Bug 1243704",
"url": "https://bugzilla.suse.com/1243704"
},
{
"category": "self",
"summary": "SUSE Bug 1244027",
"url": "https://bugzilla.suse.com/1244027"
},
{
"category": "self",
"summary": "SUSE Bug 1244127",
"url": "https://bugzilla.suse.com/1244127"
},
{
"category": "self",
"summary": "SUSE Bug 1244534",
"url": "https://bugzilla.suse.com/1244534"
},
{
"category": "self",
"summary": "SUSE Bug 1245099",
"url": "https://bugzilla.suse.com/1245099"
},
{
"category": "self",
"summary": "SUSE Bug 1245302",
"url": "https://bugzilla.suse.com/1245302"
},
{
"category": "self",
"summary": "SUSE Bug 1246068",
"url": "https://bugzilla.suse.com/1246068"
},
{
"category": "self",
"summary": "SUSE Bug 1246320",
"url": "https://bugzilla.suse.com/1246320"
},
{
"category": "self",
"summary": "SUSE Bug 1246553",
"url": "https://bugzilla.suse.com/1246553"
},
{
"category": "self",
"summary": "SUSE Bug 1246586",
"url": "https://bugzilla.suse.com/1246586"
},
{
"category": "self",
"summary": "SUSE Bug 1246662",
"url": "https://bugzilla.suse.com/1246662"
},
{
"category": "self",
"summary": "SUSE Bug 1246735",
"url": "https://bugzilla.suse.com/1246735"
},
{
"category": "self",
"summary": "SUSE Bug 1246736",
"url": "https://bugzilla.suse.com/1246736"
},
{
"category": "self",
"summary": "SUSE Bug 1246738",
"url": "https://bugzilla.suse.com/1246738"
},
{
"category": "self",
"summary": "SUSE Bug 1246789",
"url": "https://bugzilla.suse.com/1246789"
},
{
"category": "self",
"summary": "SUSE Bug 1246882",
"url": "https://bugzilla.suse.com/1246882"
},
{
"category": "self",
"summary": "SUSE Bug 1246906",
"url": "https://bugzilla.suse.com/1246906"
},
{
"category": "self",
"summary": "SUSE Bug 1246925",
"url": "https://bugzilla.suse.com/1246925"
},
{
"category": "self",
"summary": "SUSE Bug 1247688",
"url": "https://bugzilla.suse.com/1247688"
},
{
"category": "self",
"summary": "SUSE Bug 1247721",
"url": "https://bugzilla.suse.com/1247721"
},
{
"category": "self",
"summary": "SUSE Bug 1250616",
"url": "https://bugzilla.suse.com/1250616"
},
{
"category": "self",
"summary": "SUSE Bug 1251044",
"url": "https://bugzilla.suse.com/1251044"
},
{
"category": "self",
"summary": "SUSE Bug 1251138",
"url": "https://bugzilla.suse.com/1251138"
},
{
"category": "self",
"summary": "SUSE Bug 1252100",
"url": "https://bugzilla.suse.com/1252100"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-11065 page",
"url": "https://www.suse.com/security/cve/CVE-2025-11065/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-3415 page",
"url": "https://www.suse.com/security/cve/CVE-2025-3415/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-6023 page",
"url": "https://www.suse.com/security/cve/CVE-2025-6023/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-6197 page",
"url": "https://www.suse.com/security/cve/CVE-2025-6197/"
}
],
"title": "Security update 5.0.6 for Multi-Linux Manager Client Tools",
"tracking": {
"current_release_date": "2025-12-18T11:57:30Z",
"generator": {
"date": "2025-12-18T11:57:30Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2025:4458-1",
"initial_release_date": "2025-12-18T11:57:30Z",
"revision_history": [
{
"date": "2025-12-18T11:57:30Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "golang-github-prometheus-alertmanager-0.28.1-150000.9.1.aarch64",
"product": {
"name": "golang-github-prometheus-alertmanager-0.28.1-150000.9.1.aarch64",
"product_id": "golang-github-prometheus-alertmanager-0.28.1-150000.9.1.aarch64"
}
},
{
"category": "product_version",
"name": "grafana-11.5.10-150000.1.87.1.aarch64",
"product": {
"name": "grafana-11.5.10-150000.1.87.1.aarch64",
"product_id": "grafana-11.5.10-150000.1.87.1.aarch64"
}
},
{
"category": "product_version",
"name": "mgrctl-0.1.37-150000.1.27.1.aarch64",
"product": {
"name": "mgrctl-0.1.37-150000.1.27.1.aarch64",
"product_id": "mgrctl-0.1.37-150000.1.27.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "golang-github-prometheus-alertmanager-0.28.1-150000.9.1.i586",
"product": {
"name": "golang-github-prometheus-alertmanager-0.28.1-150000.9.1.i586",
"product_id": "golang-github-prometheus-alertmanager-0.28.1-150000.9.1.i586"
}
},
{
"category": "product_version",
"name": "mgrctl-0.1.37-150000.1.27.1.i586",
"product": {
"name": "mgrctl-0.1.37-150000.1.27.1.i586",
"product_id": "mgrctl-0.1.37-150000.1.27.1.i586"
}
}
],
"category": "architecture",
"name": "i586"
},
{
"branches": [
{
"category": "product_version",
"name": "dracut-saltboot-1.0.0-150000.1.62.1.noarch",
"product": {
"name": "dracut-saltboot-1.0.0-150000.1.62.1.noarch",
"product_id": "dracut-saltboot-1.0.0-150000.1.62.1.noarch"
}
},
{
"category": "product_version",
"name": "mgr-push-5.0.3-150000.1.30.1.noarch",
"product": {
"name": "mgr-push-5.0.3-150000.1.30.1.noarch",
"product_id": "mgr-push-5.0.3-150000.1.30.1.noarch"
}
},
{
"category": "product_version",
"name": "mgrctl-bash-completion-0.1.37-150000.1.27.1.noarch",
"product": {
"name": "mgrctl-bash-completion-0.1.37-150000.1.27.1.noarch",
"product_id": "mgrctl-bash-completion-0.1.37-150000.1.27.1.noarch"
}
},
{
"category": "product_version",
"name": "mgrctl-lang-0.1.37-150000.1.27.1.noarch",
"product": {
"name": "mgrctl-lang-0.1.37-150000.1.27.1.noarch",
"product_id": "mgrctl-lang-0.1.37-150000.1.27.1.noarch"
}
},
{
"category": "product_version",
"name": "mgrctl-zsh-completion-0.1.37-150000.1.27.1.noarch",
"product": {
"name": "mgrctl-zsh-completion-0.1.37-150000.1.27.1.noarch",
"product_id": "mgrctl-zsh-completion-0.1.37-150000.1.27.1.noarch"
}
},
{
"category": "product_version",
"name": "python3-mgr-push-5.0.3-150000.1.30.1.noarch",
"product": {
"name": "python3-mgr-push-5.0.3-150000.1.30.1.noarch",
"product_id": "python3-mgr-push-5.0.3-150000.1.30.1.noarch"
}
},
{
"category": "product_version",
"name": "python3-rhnlib-5.0.6-150000.3.49.1.noarch",
"product": {
"name": "python3-rhnlib-5.0.6-150000.3.49.1.noarch",
"product_id": "python3-rhnlib-5.0.6-150000.3.49.1.noarch"
}
},
{
"category": "product_version",
"name": "spacecmd-5.0.14-150000.3.139.1.noarch",
"product": {
"name": "spacecmd-5.0.14-150000.3.139.1.noarch",
"product_id": "spacecmd-5.0.14-150000.3.139.1.noarch"
}
},
{
"category": "product_version",
"name": "supportutils-plugin-susemanager-client-5.0.5-150000.3.30.1.noarch",
"product": {
"name": "supportutils-plugin-susemanager-client-5.0.5-150000.3.30.1.noarch",
"product_id": "supportutils-plugin-susemanager-client-5.0.5-150000.3.30.1.noarch"
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "golang-github-prometheus-alertmanager-0.28.1-150000.9.1.ppc64le",
"product": {
"name": "golang-github-prometheus-alertmanager-0.28.1-150000.9.1.ppc64le",
"product_id": "golang-github-prometheus-alertmanager-0.28.1-150000.9.1.ppc64le"
}
},
{
"category": "product_version",
"name": "grafana-11.5.10-150000.1.87.1.ppc64le",
"product": {
"name": "grafana-11.5.10-150000.1.87.1.ppc64le",
"product_id": "grafana-11.5.10-150000.1.87.1.ppc64le"
}
},
{
"category": "product_version",
"name": "mgrctl-0.1.37-150000.1.27.1.ppc64le",
"product": {
"name": "mgrctl-0.1.37-150000.1.27.1.ppc64le",
"product_id": "mgrctl-0.1.37-150000.1.27.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "golang-github-prometheus-alertmanager-0.28.1-150000.9.1.s390x",
"product": {
"name": "golang-github-prometheus-alertmanager-0.28.1-150000.9.1.s390x",
"product_id": "golang-github-prometheus-alertmanager-0.28.1-150000.9.1.s390x"
}
},
{
"category": "product_version",
"name": "grafana-11.5.10-150000.1.87.1.s390x",
"product": {
"name": "grafana-11.5.10-150000.1.87.1.s390x",
"product_id": "grafana-11.5.10-150000.1.87.1.s390x"
}
},
{
"category": "product_version",
"name": "mgrctl-0.1.37-150000.1.27.1.s390x",
"product": {
"name": "mgrctl-0.1.37-150000.1.27.1.s390x",
"product_id": "mgrctl-0.1.37-150000.1.27.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "golang-github-prometheus-alertmanager-0.28.1-150000.9.1.x86_64",
"product": {
"name": "golang-github-prometheus-alertmanager-0.28.1-150000.9.1.x86_64",
"product_id": "golang-github-prometheus-alertmanager-0.28.1-150000.9.1.x86_64"
}
},
{
"category": "product_version",
"name": "grafana-11.5.10-150000.1.87.1.x86_64",
"product": {
"name": "grafana-11.5.10-150000.1.87.1.x86_64",
"product_id": "grafana-11.5.10-150000.1.87.1.x86_64"
}
},
{
"category": "product_version",
"name": "mgrctl-0.1.37-150000.1.27.1.x86_64",
"product": {
"name": "mgrctl-0.1.37-150000.1.27.1.x86_64",
"product_id": "mgrctl-0.1.37-150000.1.27.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Manager Client Tools 15",
"product": {
"name": "SUSE Manager Client Tools 15",
"product_id": "SUSE Manager Client Tools 15"
}
},
{
"category": "product_name",
"name": "SUSE Manager Client Tools for SLE Micro 5",
"product": {
"name": "SUSE Manager Client Tools for SLE Micro 5",
"product_id": "SUSE Manager Client Tools for SLE Micro 5",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sle-manager-tools-micro:5"
}
}
},
{
"category": "product_name",
"name": "openSUSE Leap 15.6",
"product": {
"name": "openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:leap:15.6"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "dracut-saltboot-1.0.0-150000.1.62.1.noarch as component of SUSE Manager Client Tools 15",
"product_id": "SUSE Manager Client Tools 15:dracut-saltboot-1.0.0-150000.1.62.1.noarch"
},
"product_reference": "dracut-saltboot-1.0.0-150000.1.62.1.noarch",
"relates_to_product_reference": "SUSE Manager Client Tools 15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-11.5.10-150000.1.87.1.aarch64 as component of SUSE Manager Client Tools 15",
"product_id": "SUSE Manager Client Tools 15:grafana-11.5.10-150000.1.87.1.aarch64"
},
"product_reference": "grafana-11.5.10-150000.1.87.1.aarch64",
"relates_to_product_reference": "SUSE Manager Client Tools 15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-11.5.10-150000.1.87.1.ppc64le as component of SUSE Manager Client Tools 15",
"product_id": "SUSE Manager Client Tools 15:grafana-11.5.10-150000.1.87.1.ppc64le"
},
"product_reference": "grafana-11.5.10-150000.1.87.1.ppc64le",
"relates_to_product_reference": "SUSE Manager Client Tools 15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-11.5.10-150000.1.87.1.s390x as component of SUSE Manager Client Tools 15",
"product_id": "SUSE Manager Client Tools 15:grafana-11.5.10-150000.1.87.1.s390x"
},
"product_reference": "grafana-11.5.10-150000.1.87.1.s390x",
"relates_to_product_reference": "SUSE Manager Client Tools 15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-11.5.10-150000.1.87.1.x86_64 as component of SUSE Manager Client Tools 15",
"product_id": "SUSE Manager Client Tools 15:grafana-11.5.10-150000.1.87.1.x86_64"
},
"product_reference": "grafana-11.5.10-150000.1.87.1.x86_64",
"relates_to_product_reference": "SUSE Manager Client Tools 15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mgr-push-5.0.3-150000.1.30.1.noarch as component of SUSE Manager Client Tools 15",
"product_id": "SUSE Manager Client Tools 15:mgr-push-5.0.3-150000.1.30.1.noarch"
},
"product_reference": "mgr-push-5.0.3-150000.1.30.1.noarch",
"relates_to_product_reference": "SUSE Manager Client Tools 15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mgrctl-0.1.37-150000.1.27.1.aarch64 as component of SUSE Manager Client Tools 15",
"product_id": "SUSE Manager Client Tools 15:mgrctl-0.1.37-150000.1.27.1.aarch64"
},
"product_reference": "mgrctl-0.1.37-150000.1.27.1.aarch64",
"relates_to_product_reference": "SUSE Manager Client Tools 15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mgrctl-0.1.37-150000.1.27.1.ppc64le as component of SUSE Manager Client Tools 15",
"product_id": "SUSE Manager Client Tools 15:mgrctl-0.1.37-150000.1.27.1.ppc64le"
},
"product_reference": "mgrctl-0.1.37-150000.1.27.1.ppc64le",
"relates_to_product_reference": "SUSE Manager Client Tools 15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mgrctl-0.1.37-150000.1.27.1.s390x as component of SUSE Manager Client Tools 15",
"product_id": "SUSE Manager Client Tools 15:mgrctl-0.1.37-150000.1.27.1.s390x"
},
"product_reference": "mgrctl-0.1.37-150000.1.27.1.s390x",
"relates_to_product_reference": "SUSE Manager Client Tools 15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mgrctl-0.1.37-150000.1.27.1.x86_64 as component of SUSE Manager Client Tools 15",
"product_id": "SUSE Manager Client Tools 15:mgrctl-0.1.37-150000.1.27.1.x86_64"
},
"product_reference": "mgrctl-0.1.37-150000.1.27.1.x86_64",
"relates_to_product_reference": "SUSE Manager Client Tools 15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mgrctl-bash-completion-0.1.37-150000.1.27.1.noarch as component of SUSE Manager Client Tools 15",
"product_id": "SUSE Manager Client Tools 15:mgrctl-bash-completion-0.1.37-150000.1.27.1.noarch"
},
"product_reference": "mgrctl-bash-completion-0.1.37-150000.1.27.1.noarch",
"relates_to_product_reference": "SUSE Manager Client Tools 15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mgrctl-lang-0.1.37-150000.1.27.1.noarch as component of SUSE Manager Client Tools 15",
"product_id": "SUSE Manager Client Tools 15:mgrctl-lang-0.1.37-150000.1.27.1.noarch"
},
"product_reference": "mgrctl-lang-0.1.37-150000.1.27.1.noarch",
"relates_to_product_reference": "SUSE Manager Client Tools 15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mgrctl-zsh-completion-0.1.37-150000.1.27.1.noarch as component of SUSE Manager Client Tools 15",
"product_id": "SUSE Manager Client Tools 15:mgrctl-zsh-completion-0.1.37-150000.1.27.1.noarch"
},
"product_reference": "mgrctl-zsh-completion-0.1.37-150000.1.27.1.noarch",
"relates_to_product_reference": "SUSE Manager Client Tools 15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-mgr-push-5.0.3-150000.1.30.1.noarch as component of SUSE Manager Client Tools 15",
"product_id": "SUSE Manager Client Tools 15:python3-mgr-push-5.0.3-150000.1.30.1.noarch"
},
"product_reference": "python3-mgr-push-5.0.3-150000.1.30.1.noarch",
"relates_to_product_reference": "SUSE Manager Client Tools 15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-rhnlib-5.0.6-150000.3.49.1.noarch as component of SUSE Manager Client Tools 15",
"product_id": "SUSE Manager Client Tools 15:python3-rhnlib-5.0.6-150000.3.49.1.noarch"
},
"product_reference": "python3-rhnlib-5.0.6-150000.3.49.1.noarch",
"relates_to_product_reference": "SUSE Manager Client Tools 15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "spacecmd-5.0.14-150000.3.139.1.noarch as component of SUSE Manager Client Tools 15",
"product_id": "SUSE Manager Client Tools 15:spacecmd-5.0.14-150000.3.139.1.noarch"
},
"product_reference": "spacecmd-5.0.14-150000.3.139.1.noarch",
"relates_to_product_reference": "SUSE Manager Client Tools 15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "supportutils-plugin-susemanager-client-5.0.5-150000.3.30.1.noarch as component of SUSE Manager Client Tools 15",
"product_id": "SUSE Manager Client Tools 15:supportutils-plugin-susemanager-client-5.0.5-150000.3.30.1.noarch"
},
"product_reference": "supportutils-plugin-susemanager-client-5.0.5-150000.3.30.1.noarch",
"relates_to_product_reference": "SUSE Manager Client Tools 15"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dracut-saltboot-1.0.0-150000.1.62.1.noarch as component of SUSE Manager Client Tools for SLE Micro 5",
"product_id": "SUSE Manager Client Tools for SLE Micro 5:dracut-saltboot-1.0.0-150000.1.62.1.noarch"
},
"product_reference": "dracut-saltboot-1.0.0-150000.1.62.1.noarch",
"relates_to_product_reference": "SUSE Manager Client Tools for SLE Micro 5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mgrctl-0.1.37-150000.1.27.1.aarch64 as component of SUSE Manager Client Tools for SLE Micro 5",
"product_id": "SUSE Manager Client Tools for SLE Micro 5:mgrctl-0.1.37-150000.1.27.1.aarch64"
},
"product_reference": "mgrctl-0.1.37-150000.1.27.1.aarch64",
"relates_to_product_reference": "SUSE Manager Client Tools for SLE Micro 5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mgrctl-0.1.37-150000.1.27.1.s390x as component of SUSE Manager Client Tools for SLE Micro 5",
"product_id": "SUSE Manager Client Tools for SLE Micro 5:mgrctl-0.1.37-150000.1.27.1.s390x"
},
"product_reference": "mgrctl-0.1.37-150000.1.27.1.s390x",
"relates_to_product_reference": "SUSE Manager Client Tools for SLE Micro 5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mgrctl-0.1.37-150000.1.27.1.x86_64 as component of SUSE Manager Client Tools for SLE Micro 5",
"product_id": "SUSE Manager Client Tools for SLE Micro 5:mgrctl-0.1.37-150000.1.27.1.x86_64"
},
"product_reference": "mgrctl-0.1.37-150000.1.27.1.x86_64",
"relates_to_product_reference": "SUSE Manager Client Tools for SLE Micro 5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mgrctl-bash-completion-0.1.37-150000.1.27.1.noarch as component of SUSE Manager Client Tools for SLE Micro 5",
"product_id": "SUSE Manager Client Tools for SLE Micro 5:mgrctl-bash-completion-0.1.37-150000.1.27.1.noarch"
},
"product_reference": "mgrctl-bash-completion-0.1.37-150000.1.27.1.noarch",
"relates_to_product_reference": "SUSE Manager Client Tools for SLE Micro 5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mgrctl-lang-0.1.37-150000.1.27.1.noarch as component of SUSE Manager Client Tools for SLE Micro 5",
"product_id": "SUSE Manager Client Tools for SLE Micro 5:mgrctl-lang-0.1.37-150000.1.27.1.noarch"
},
"product_reference": "mgrctl-lang-0.1.37-150000.1.27.1.noarch",
"relates_to_product_reference": "SUSE Manager Client Tools for SLE Micro 5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mgrctl-zsh-completion-0.1.37-150000.1.27.1.noarch as component of SUSE Manager Client Tools for SLE Micro 5",
"product_id": "SUSE Manager Client Tools for SLE Micro 5:mgrctl-zsh-completion-0.1.37-150000.1.27.1.noarch"
},
"product_reference": "mgrctl-zsh-completion-0.1.37-150000.1.27.1.noarch",
"relates_to_product_reference": "SUSE Manager Client Tools for SLE Micro 5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "dracut-saltboot-1.0.0-150000.1.62.1.noarch as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:dracut-saltboot-1.0.0-150000.1.62.1.noarch"
},
"product_reference": "dracut-saltboot-1.0.0-150000.1.62.1.noarch",
"relates_to_product_reference": "openSUSE Leap 15.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "spacecmd-5.0.14-150000.3.139.1.noarch as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:spacecmd-5.0.14-150000.3.139.1.noarch"
},
"product_reference": "spacecmd-5.0.14-150000.3.139.1.noarch",
"relates_to_product_reference": "openSUSE Leap 15.6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "supportutils-plugin-susemanager-client-5.0.5-150000.3.30.1.noarch as component of openSUSE Leap 15.6",
"product_id": "openSUSE Leap 15.6:supportutils-plugin-susemanager-client-5.0.5-150000.3.30.1.noarch"
},
"product_reference": "supportutils-plugin-susemanager-client-5.0.5-150000.3.30.1.noarch",
"relates_to_product_reference": "openSUSE Leap 15.6"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-11065",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-11065"
}
],
"notes": [
{
"category": "general",
"text": "unknown",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Manager Client Tools 15:dracut-saltboot-1.0.0-150000.1.62.1.noarch",
"SUSE Manager Client Tools 15:grafana-11.5.10-150000.1.87.1.aarch64",
"SUSE Manager Client Tools 15:grafana-11.5.10-150000.1.87.1.ppc64le",
"SUSE Manager Client Tools 15:grafana-11.5.10-150000.1.87.1.s390x",
"SUSE Manager Client Tools 15:grafana-11.5.10-150000.1.87.1.x86_64",
"SUSE Manager Client Tools 15:mgr-push-5.0.3-150000.1.30.1.noarch",
"SUSE Manager Client Tools 15:mgrctl-0.1.37-150000.1.27.1.aarch64",
"SUSE Manager Client Tools 15:mgrctl-0.1.37-150000.1.27.1.ppc64le",
"SUSE Manager Client Tools 15:mgrctl-0.1.37-150000.1.27.1.s390x",
"SUSE Manager Client Tools 15:mgrctl-0.1.37-150000.1.27.1.x86_64",
"SUSE Manager Client Tools 15:mgrctl-bash-completion-0.1.37-150000.1.27.1.noarch",
"SUSE Manager Client Tools 15:mgrctl-lang-0.1.37-150000.1.27.1.noarch",
"SUSE Manager Client Tools 15:mgrctl-zsh-completion-0.1.37-150000.1.27.1.noarch",
"SUSE Manager Client Tools 15:python3-mgr-push-5.0.3-150000.1.30.1.noarch",
"SUSE Manager Client Tools 15:python3-rhnlib-5.0.6-150000.3.49.1.noarch",
"SUSE Manager Client Tools 15:spacecmd-5.0.14-150000.3.139.1.noarch",
"SUSE Manager Client Tools 15:supportutils-plugin-susemanager-client-5.0.5-150000.3.30.1.noarch",
"SUSE Manager Client Tools for SLE Micro 5:dracut-saltboot-1.0.0-150000.1.62.1.noarch",
"SUSE Manager Client Tools for SLE Micro 5:mgrctl-0.1.37-150000.1.27.1.aarch64",
"SUSE Manager Client Tools for SLE Micro 5:mgrctl-0.1.37-150000.1.27.1.s390x",
"SUSE Manager Client Tools for SLE Micro 5:mgrctl-0.1.37-150000.1.27.1.x86_64",
"SUSE Manager Client Tools for SLE Micro 5:mgrctl-bash-completion-0.1.37-150000.1.27.1.noarch",
"SUSE Manager Client Tools for SLE Micro 5:mgrctl-lang-0.1.37-150000.1.27.1.noarch",
"SUSE Manager Client Tools for SLE Micro 5:mgrctl-zsh-completion-0.1.37-150000.1.27.1.noarch",
"openSUSE Leap 15.6:dracut-saltboot-1.0.0-150000.1.62.1.noarch",
"openSUSE Leap 15.6:spacecmd-5.0.14-150000.3.139.1.noarch",
"openSUSE Leap 15.6:supportutils-plugin-susemanager-client-5.0.5-150000.3.30.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-11065",
"url": "https://www.suse.com/security/cve/CVE-2025-11065"
},
{
"category": "external",
"summary": "SUSE Bug 1250608 for CVE-2025-11065",
"url": "https://bugzilla.suse.com/1250608"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Manager Client Tools 15:dracut-saltboot-1.0.0-150000.1.62.1.noarch",
"SUSE Manager Client Tools 15:grafana-11.5.10-150000.1.87.1.aarch64",
"SUSE Manager Client Tools 15:grafana-11.5.10-150000.1.87.1.ppc64le",
"SUSE Manager Client Tools 15:grafana-11.5.10-150000.1.87.1.s390x",
"SUSE Manager Client Tools 15:grafana-11.5.10-150000.1.87.1.x86_64",
"SUSE Manager Client Tools 15:mgr-push-5.0.3-150000.1.30.1.noarch",
"SUSE Manager Client Tools 15:mgrctl-0.1.37-150000.1.27.1.aarch64",
"SUSE Manager Client Tools 15:mgrctl-0.1.37-150000.1.27.1.ppc64le",
"SUSE Manager Client Tools 15:mgrctl-0.1.37-150000.1.27.1.s390x",
"SUSE Manager Client Tools 15:mgrctl-0.1.37-150000.1.27.1.x86_64",
"SUSE Manager Client Tools 15:mgrctl-bash-completion-0.1.37-150000.1.27.1.noarch",
"SUSE Manager Client Tools 15:mgrctl-lang-0.1.37-150000.1.27.1.noarch",
"SUSE Manager Client Tools 15:mgrctl-zsh-completion-0.1.37-150000.1.27.1.noarch",
"SUSE Manager Client Tools 15:python3-mgr-push-5.0.3-150000.1.30.1.noarch",
"SUSE Manager Client Tools 15:python3-rhnlib-5.0.6-150000.3.49.1.noarch",
"SUSE Manager Client Tools 15:spacecmd-5.0.14-150000.3.139.1.noarch",
"SUSE Manager Client Tools 15:supportutils-plugin-susemanager-client-5.0.5-150000.3.30.1.noarch",
"SUSE Manager Client Tools for SLE Micro 5:dracut-saltboot-1.0.0-150000.1.62.1.noarch",
"SUSE Manager Client Tools for SLE Micro 5:mgrctl-0.1.37-150000.1.27.1.aarch64",
"SUSE Manager Client Tools for SLE Micro 5:mgrctl-0.1.37-150000.1.27.1.s390x",
"SUSE Manager Client Tools for SLE Micro 5:mgrctl-0.1.37-150000.1.27.1.x86_64",
"SUSE Manager Client Tools for SLE Micro 5:mgrctl-bash-completion-0.1.37-150000.1.27.1.noarch",
"SUSE Manager Client Tools for SLE Micro 5:mgrctl-lang-0.1.37-150000.1.27.1.noarch",
"SUSE Manager Client Tools for SLE Micro 5:mgrctl-zsh-completion-0.1.37-150000.1.27.1.noarch",
"openSUSE Leap 15.6:dracut-saltboot-1.0.0-150000.1.62.1.noarch",
"openSUSE Leap 15.6:spacecmd-5.0.14-150000.3.139.1.noarch",
"openSUSE Leap 15.6:supportutils-plugin-susemanager-client-5.0.5-150000.3.30.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Manager Client Tools 15:dracut-saltboot-1.0.0-150000.1.62.1.noarch",
"SUSE Manager Client Tools 15:grafana-11.5.10-150000.1.87.1.aarch64",
"SUSE Manager Client Tools 15:grafana-11.5.10-150000.1.87.1.ppc64le",
"SUSE Manager Client Tools 15:grafana-11.5.10-150000.1.87.1.s390x",
"SUSE Manager Client Tools 15:grafana-11.5.10-150000.1.87.1.x86_64",
"SUSE Manager Client Tools 15:mgr-push-5.0.3-150000.1.30.1.noarch",
"SUSE Manager Client Tools 15:mgrctl-0.1.37-150000.1.27.1.aarch64",
"SUSE Manager Client Tools 15:mgrctl-0.1.37-150000.1.27.1.ppc64le",
"SUSE Manager Client Tools 15:mgrctl-0.1.37-150000.1.27.1.s390x",
"SUSE Manager Client Tools 15:mgrctl-0.1.37-150000.1.27.1.x86_64",
"SUSE Manager Client Tools 15:mgrctl-bash-completion-0.1.37-150000.1.27.1.noarch",
"SUSE Manager Client Tools 15:mgrctl-lang-0.1.37-150000.1.27.1.noarch",
"SUSE Manager Client Tools 15:mgrctl-zsh-completion-0.1.37-150000.1.27.1.noarch",
"SUSE Manager Client Tools 15:python3-mgr-push-5.0.3-150000.1.30.1.noarch",
"SUSE Manager Client Tools 15:python3-rhnlib-5.0.6-150000.3.49.1.noarch",
"SUSE Manager Client Tools 15:spacecmd-5.0.14-150000.3.139.1.noarch",
"SUSE Manager Client Tools 15:supportutils-plugin-susemanager-client-5.0.5-150000.3.30.1.noarch",
"SUSE Manager Client Tools for SLE Micro 5:dracut-saltboot-1.0.0-150000.1.62.1.noarch",
"SUSE Manager Client Tools for SLE Micro 5:mgrctl-0.1.37-150000.1.27.1.aarch64",
"SUSE Manager Client Tools for SLE Micro 5:mgrctl-0.1.37-150000.1.27.1.s390x",
"SUSE Manager Client Tools for SLE Micro 5:mgrctl-0.1.37-150000.1.27.1.x86_64",
"SUSE Manager Client Tools for SLE Micro 5:mgrctl-bash-completion-0.1.37-150000.1.27.1.noarch",
"SUSE Manager Client Tools for SLE Micro 5:mgrctl-lang-0.1.37-150000.1.27.1.noarch",
"SUSE Manager Client Tools for SLE Micro 5:mgrctl-zsh-completion-0.1.37-150000.1.27.1.noarch",
"openSUSE Leap 15.6:dracut-saltboot-1.0.0-150000.1.62.1.noarch",
"openSUSE Leap 15.6:spacecmd-5.0.14-150000.3.139.1.noarch",
"openSUSE Leap 15.6:supportutils-plugin-susemanager-client-5.0.5-150000.3.30.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-12-18T11:57:30Z",
"details": "moderate"
}
],
"title": "CVE-2025-11065"
},
{
"cve": "CVE-2025-3415",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-3415"
}
],
"notes": [
{
"category": "general",
"text": "Grafana is an open-source platform for monitoring and observability. The Grafana Alerting DingDing integration was not properly protected and could be exposed to users with Viewer permission. \nFixed in versions 10.4.19+security-01, 11.2.10+security-01, 11.3.7+security-01, 11.4.5+security-01, 11.5.5+security-01, 11.6.2+security-01 and 12.0.1+security-01",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Manager Client Tools 15:dracut-saltboot-1.0.0-150000.1.62.1.noarch",
"SUSE Manager Client Tools 15:grafana-11.5.10-150000.1.87.1.aarch64",
"SUSE Manager Client Tools 15:grafana-11.5.10-150000.1.87.1.ppc64le",
"SUSE Manager Client Tools 15:grafana-11.5.10-150000.1.87.1.s390x",
"SUSE Manager Client Tools 15:grafana-11.5.10-150000.1.87.1.x86_64",
"SUSE Manager Client Tools 15:mgr-push-5.0.3-150000.1.30.1.noarch",
"SUSE Manager Client Tools 15:mgrctl-0.1.37-150000.1.27.1.aarch64",
"SUSE Manager Client Tools 15:mgrctl-0.1.37-150000.1.27.1.ppc64le",
"SUSE Manager Client Tools 15:mgrctl-0.1.37-150000.1.27.1.s390x",
"SUSE Manager Client Tools 15:mgrctl-0.1.37-150000.1.27.1.x86_64",
"SUSE Manager Client Tools 15:mgrctl-bash-completion-0.1.37-150000.1.27.1.noarch",
"SUSE Manager Client Tools 15:mgrctl-lang-0.1.37-150000.1.27.1.noarch",
"SUSE Manager Client Tools 15:mgrctl-zsh-completion-0.1.37-150000.1.27.1.noarch",
"SUSE Manager Client Tools 15:python3-mgr-push-5.0.3-150000.1.30.1.noarch",
"SUSE Manager Client Tools 15:python3-rhnlib-5.0.6-150000.3.49.1.noarch",
"SUSE Manager Client Tools 15:spacecmd-5.0.14-150000.3.139.1.noarch",
"SUSE Manager Client Tools 15:supportutils-plugin-susemanager-client-5.0.5-150000.3.30.1.noarch",
"SUSE Manager Client Tools for SLE Micro 5:dracut-saltboot-1.0.0-150000.1.62.1.noarch",
"SUSE Manager Client Tools for SLE Micro 5:mgrctl-0.1.37-150000.1.27.1.aarch64",
"SUSE Manager Client Tools for SLE Micro 5:mgrctl-0.1.37-150000.1.27.1.s390x",
"SUSE Manager Client Tools for SLE Micro 5:mgrctl-0.1.37-150000.1.27.1.x86_64",
"SUSE Manager Client Tools for SLE Micro 5:mgrctl-bash-completion-0.1.37-150000.1.27.1.noarch",
"SUSE Manager Client Tools for SLE Micro 5:mgrctl-lang-0.1.37-150000.1.27.1.noarch",
"SUSE Manager Client Tools for SLE Micro 5:mgrctl-zsh-completion-0.1.37-150000.1.27.1.noarch",
"openSUSE Leap 15.6:dracut-saltboot-1.0.0-150000.1.62.1.noarch",
"openSUSE Leap 15.6:spacecmd-5.0.14-150000.3.139.1.noarch",
"openSUSE Leap 15.6:supportutils-plugin-susemanager-client-5.0.5-150000.3.30.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-3415",
"url": "https://www.suse.com/security/cve/CVE-2025-3415"
},
{
"category": "external",
"summary": "SUSE Bug 1245302 for CVE-2025-3415",
"url": "https://bugzilla.suse.com/1245302"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Manager Client Tools 15:dracut-saltboot-1.0.0-150000.1.62.1.noarch",
"SUSE Manager Client Tools 15:grafana-11.5.10-150000.1.87.1.aarch64",
"SUSE Manager Client Tools 15:grafana-11.5.10-150000.1.87.1.ppc64le",
"SUSE Manager Client Tools 15:grafana-11.5.10-150000.1.87.1.s390x",
"SUSE Manager Client Tools 15:grafana-11.5.10-150000.1.87.1.x86_64",
"SUSE Manager Client Tools 15:mgr-push-5.0.3-150000.1.30.1.noarch",
"SUSE Manager Client Tools 15:mgrctl-0.1.37-150000.1.27.1.aarch64",
"SUSE Manager Client Tools 15:mgrctl-0.1.37-150000.1.27.1.ppc64le",
"SUSE Manager Client Tools 15:mgrctl-0.1.37-150000.1.27.1.s390x",
"SUSE Manager Client Tools 15:mgrctl-0.1.37-150000.1.27.1.x86_64",
"SUSE Manager Client Tools 15:mgrctl-bash-completion-0.1.37-150000.1.27.1.noarch",
"SUSE Manager Client Tools 15:mgrctl-lang-0.1.37-150000.1.27.1.noarch",
"SUSE Manager Client Tools 15:mgrctl-zsh-completion-0.1.37-150000.1.27.1.noarch",
"SUSE Manager Client Tools 15:python3-mgr-push-5.0.3-150000.1.30.1.noarch",
"SUSE Manager Client Tools 15:python3-rhnlib-5.0.6-150000.3.49.1.noarch",
"SUSE Manager Client Tools 15:spacecmd-5.0.14-150000.3.139.1.noarch",
"SUSE Manager Client Tools 15:supportutils-plugin-susemanager-client-5.0.5-150000.3.30.1.noarch",
"SUSE Manager Client Tools for SLE Micro 5:dracut-saltboot-1.0.0-150000.1.62.1.noarch",
"SUSE Manager Client Tools for SLE Micro 5:mgrctl-0.1.37-150000.1.27.1.aarch64",
"SUSE Manager Client Tools for SLE Micro 5:mgrctl-0.1.37-150000.1.27.1.s390x",
"SUSE Manager Client Tools for SLE Micro 5:mgrctl-0.1.37-150000.1.27.1.x86_64",
"SUSE Manager Client Tools for SLE Micro 5:mgrctl-bash-completion-0.1.37-150000.1.27.1.noarch",
"SUSE Manager Client Tools for SLE Micro 5:mgrctl-lang-0.1.37-150000.1.27.1.noarch",
"SUSE Manager Client Tools for SLE Micro 5:mgrctl-zsh-completion-0.1.37-150000.1.27.1.noarch",
"openSUSE Leap 15.6:dracut-saltboot-1.0.0-150000.1.62.1.noarch",
"openSUSE Leap 15.6:spacecmd-5.0.14-150000.3.139.1.noarch",
"openSUSE Leap 15.6:supportutils-plugin-susemanager-client-5.0.5-150000.3.30.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Manager Client Tools 15:dracut-saltboot-1.0.0-150000.1.62.1.noarch",
"SUSE Manager Client Tools 15:grafana-11.5.10-150000.1.87.1.aarch64",
"SUSE Manager Client Tools 15:grafana-11.5.10-150000.1.87.1.ppc64le",
"SUSE Manager Client Tools 15:grafana-11.5.10-150000.1.87.1.s390x",
"SUSE Manager Client Tools 15:grafana-11.5.10-150000.1.87.1.x86_64",
"SUSE Manager Client Tools 15:mgr-push-5.0.3-150000.1.30.1.noarch",
"SUSE Manager Client Tools 15:mgrctl-0.1.37-150000.1.27.1.aarch64",
"SUSE Manager Client Tools 15:mgrctl-0.1.37-150000.1.27.1.ppc64le",
"SUSE Manager Client Tools 15:mgrctl-0.1.37-150000.1.27.1.s390x",
"SUSE Manager Client Tools 15:mgrctl-0.1.37-150000.1.27.1.x86_64",
"SUSE Manager Client Tools 15:mgrctl-bash-completion-0.1.37-150000.1.27.1.noarch",
"SUSE Manager Client Tools 15:mgrctl-lang-0.1.37-150000.1.27.1.noarch",
"SUSE Manager Client Tools 15:mgrctl-zsh-completion-0.1.37-150000.1.27.1.noarch",
"SUSE Manager Client Tools 15:python3-mgr-push-5.0.3-150000.1.30.1.noarch",
"SUSE Manager Client Tools 15:python3-rhnlib-5.0.6-150000.3.49.1.noarch",
"SUSE Manager Client Tools 15:spacecmd-5.0.14-150000.3.139.1.noarch",
"SUSE Manager Client Tools 15:supportutils-plugin-susemanager-client-5.0.5-150000.3.30.1.noarch",
"SUSE Manager Client Tools for SLE Micro 5:dracut-saltboot-1.0.0-150000.1.62.1.noarch",
"SUSE Manager Client Tools for SLE Micro 5:mgrctl-0.1.37-150000.1.27.1.aarch64",
"SUSE Manager Client Tools for SLE Micro 5:mgrctl-0.1.37-150000.1.27.1.s390x",
"SUSE Manager Client Tools for SLE Micro 5:mgrctl-0.1.37-150000.1.27.1.x86_64",
"SUSE Manager Client Tools for SLE Micro 5:mgrctl-bash-completion-0.1.37-150000.1.27.1.noarch",
"SUSE Manager Client Tools for SLE Micro 5:mgrctl-lang-0.1.37-150000.1.27.1.noarch",
"SUSE Manager Client Tools for SLE Micro 5:mgrctl-zsh-completion-0.1.37-150000.1.27.1.noarch",
"openSUSE Leap 15.6:dracut-saltboot-1.0.0-150000.1.62.1.noarch",
"openSUSE Leap 15.6:spacecmd-5.0.14-150000.3.139.1.noarch",
"openSUSE Leap 15.6:supportutils-plugin-susemanager-client-5.0.5-150000.3.30.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-12-18T11:57:30Z",
"details": "moderate"
}
],
"title": "CVE-2025-3415"
},
{
"cve": "CVE-2025-6023",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-6023"
}
],
"notes": [
{
"category": "general",
"text": "An open redirect vulnerability has been identified in Grafana OSS that can be exploited to achieve XSS attacks. The vulnerability was introduced in Grafana v11.5.0.\n\nThe open redirect can be chained with path traversal vulnerabilities to achieve XSS.\n\nFixed in versions 12.0.2+security-01, 11.6.3+security-01, 11.5.6+security-01, 11.4.6+security-01 and 11.3.8+security-01",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Manager Client Tools 15:dracut-saltboot-1.0.0-150000.1.62.1.noarch",
"SUSE Manager Client Tools 15:grafana-11.5.10-150000.1.87.1.aarch64",
"SUSE Manager Client Tools 15:grafana-11.5.10-150000.1.87.1.ppc64le",
"SUSE Manager Client Tools 15:grafana-11.5.10-150000.1.87.1.s390x",
"SUSE Manager Client Tools 15:grafana-11.5.10-150000.1.87.1.x86_64",
"SUSE Manager Client Tools 15:mgr-push-5.0.3-150000.1.30.1.noarch",
"SUSE Manager Client Tools 15:mgrctl-0.1.37-150000.1.27.1.aarch64",
"SUSE Manager Client Tools 15:mgrctl-0.1.37-150000.1.27.1.ppc64le",
"SUSE Manager Client Tools 15:mgrctl-0.1.37-150000.1.27.1.s390x",
"SUSE Manager Client Tools 15:mgrctl-0.1.37-150000.1.27.1.x86_64",
"SUSE Manager Client Tools 15:mgrctl-bash-completion-0.1.37-150000.1.27.1.noarch",
"SUSE Manager Client Tools 15:mgrctl-lang-0.1.37-150000.1.27.1.noarch",
"SUSE Manager Client Tools 15:mgrctl-zsh-completion-0.1.37-150000.1.27.1.noarch",
"SUSE Manager Client Tools 15:python3-mgr-push-5.0.3-150000.1.30.1.noarch",
"SUSE Manager Client Tools 15:python3-rhnlib-5.0.6-150000.3.49.1.noarch",
"SUSE Manager Client Tools 15:spacecmd-5.0.14-150000.3.139.1.noarch",
"SUSE Manager Client Tools 15:supportutils-plugin-susemanager-client-5.0.5-150000.3.30.1.noarch",
"SUSE Manager Client Tools for SLE Micro 5:dracut-saltboot-1.0.0-150000.1.62.1.noarch",
"SUSE Manager Client Tools for SLE Micro 5:mgrctl-0.1.37-150000.1.27.1.aarch64",
"SUSE Manager Client Tools for SLE Micro 5:mgrctl-0.1.37-150000.1.27.1.s390x",
"SUSE Manager Client Tools for SLE Micro 5:mgrctl-0.1.37-150000.1.27.1.x86_64",
"SUSE Manager Client Tools for SLE Micro 5:mgrctl-bash-completion-0.1.37-150000.1.27.1.noarch",
"SUSE Manager Client Tools for SLE Micro 5:mgrctl-lang-0.1.37-150000.1.27.1.noarch",
"SUSE Manager Client Tools for SLE Micro 5:mgrctl-zsh-completion-0.1.37-150000.1.27.1.noarch",
"openSUSE Leap 15.6:dracut-saltboot-1.0.0-150000.1.62.1.noarch",
"openSUSE Leap 15.6:spacecmd-5.0.14-150000.3.139.1.noarch",
"openSUSE Leap 15.6:supportutils-plugin-susemanager-client-5.0.5-150000.3.30.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-6023",
"url": "https://www.suse.com/security/cve/CVE-2025-6023"
},
{
"category": "external",
"summary": "SUSE Bug 1246735 for CVE-2025-6023",
"url": "https://bugzilla.suse.com/1246735"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Manager Client Tools 15:dracut-saltboot-1.0.0-150000.1.62.1.noarch",
"SUSE Manager Client Tools 15:grafana-11.5.10-150000.1.87.1.aarch64",
"SUSE Manager Client Tools 15:grafana-11.5.10-150000.1.87.1.ppc64le",
"SUSE Manager Client Tools 15:grafana-11.5.10-150000.1.87.1.s390x",
"SUSE Manager Client Tools 15:grafana-11.5.10-150000.1.87.1.x86_64",
"SUSE Manager Client Tools 15:mgr-push-5.0.3-150000.1.30.1.noarch",
"SUSE Manager Client Tools 15:mgrctl-0.1.37-150000.1.27.1.aarch64",
"SUSE Manager Client Tools 15:mgrctl-0.1.37-150000.1.27.1.ppc64le",
"SUSE Manager Client Tools 15:mgrctl-0.1.37-150000.1.27.1.s390x",
"SUSE Manager Client Tools 15:mgrctl-0.1.37-150000.1.27.1.x86_64",
"SUSE Manager Client Tools 15:mgrctl-bash-completion-0.1.37-150000.1.27.1.noarch",
"SUSE Manager Client Tools 15:mgrctl-lang-0.1.37-150000.1.27.1.noarch",
"SUSE Manager Client Tools 15:mgrctl-zsh-completion-0.1.37-150000.1.27.1.noarch",
"SUSE Manager Client Tools 15:python3-mgr-push-5.0.3-150000.1.30.1.noarch",
"SUSE Manager Client Tools 15:python3-rhnlib-5.0.6-150000.3.49.1.noarch",
"SUSE Manager Client Tools 15:spacecmd-5.0.14-150000.3.139.1.noarch",
"SUSE Manager Client Tools 15:supportutils-plugin-susemanager-client-5.0.5-150000.3.30.1.noarch",
"SUSE Manager Client Tools for SLE Micro 5:dracut-saltboot-1.0.0-150000.1.62.1.noarch",
"SUSE Manager Client Tools for SLE Micro 5:mgrctl-0.1.37-150000.1.27.1.aarch64",
"SUSE Manager Client Tools for SLE Micro 5:mgrctl-0.1.37-150000.1.27.1.s390x",
"SUSE Manager Client Tools for SLE Micro 5:mgrctl-0.1.37-150000.1.27.1.x86_64",
"SUSE Manager Client Tools for SLE Micro 5:mgrctl-bash-completion-0.1.37-150000.1.27.1.noarch",
"SUSE Manager Client Tools for SLE Micro 5:mgrctl-lang-0.1.37-150000.1.27.1.noarch",
"SUSE Manager Client Tools for SLE Micro 5:mgrctl-zsh-completion-0.1.37-150000.1.27.1.noarch",
"openSUSE Leap 15.6:dracut-saltboot-1.0.0-150000.1.62.1.noarch",
"openSUSE Leap 15.6:spacecmd-5.0.14-150000.3.139.1.noarch",
"openSUSE Leap 15.6:supportutils-plugin-susemanager-client-5.0.5-150000.3.30.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L",
"version": "3.1"
},
"products": [
"SUSE Manager Client Tools 15:dracut-saltboot-1.0.0-150000.1.62.1.noarch",
"SUSE Manager Client Tools 15:grafana-11.5.10-150000.1.87.1.aarch64",
"SUSE Manager Client Tools 15:grafana-11.5.10-150000.1.87.1.ppc64le",
"SUSE Manager Client Tools 15:grafana-11.5.10-150000.1.87.1.s390x",
"SUSE Manager Client Tools 15:grafana-11.5.10-150000.1.87.1.x86_64",
"SUSE Manager Client Tools 15:mgr-push-5.0.3-150000.1.30.1.noarch",
"SUSE Manager Client Tools 15:mgrctl-0.1.37-150000.1.27.1.aarch64",
"SUSE Manager Client Tools 15:mgrctl-0.1.37-150000.1.27.1.ppc64le",
"SUSE Manager Client Tools 15:mgrctl-0.1.37-150000.1.27.1.s390x",
"SUSE Manager Client Tools 15:mgrctl-0.1.37-150000.1.27.1.x86_64",
"SUSE Manager Client Tools 15:mgrctl-bash-completion-0.1.37-150000.1.27.1.noarch",
"SUSE Manager Client Tools 15:mgrctl-lang-0.1.37-150000.1.27.1.noarch",
"SUSE Manager Client Tools 15:mgrctl-zsh-completion-0.1.37-150000.1.27.1.noarch",
"SUSE Manager Client Tools 15:python3-mgr-push-5.0.3-150000.1.30.1.noarch",
"SUSE Manager Client Tools 15:python3-rhnlib-5.0.6-150000.3.49.1.noarch",
"SUSE Manager Client Tools 15:spacecmd-5.0.14-150000.3.139.1.noarch",
"SUSE Manager Client Tools 15:supportutils-plugin-susemanager-client-5.0.5-150000.3.30.1.noarch",
"SUSE Manager Client Tools for SLE Micro 5:dracut-saltboot-1.0.0-150000.1.62.1.noarch",
"SUSE Manager Client Tools for SLE Micro 5:mgrctl-0.1.37-150000.1.27.1.aarch64",
"SUSE Manager Client Tools for SLE Micro 5:mgrctl-0.1.37-150000.1.27.1.s390x",
"SUSE Manager Client Tools for SLE Micro 5:mgrctl-0.1.37-150000.1.27.1.x86_64",
"SUSE Manager Client Tools for SLE Micro 5:mgrctl-bash-completion-0.1.37-150000.1.27.1.noarch",
"SUSE Manager Client Tools for SLE Micro 5:mgrctl-lang-0.1.37-150000.1.27.1.noarch",
"SUSE Manager Client Tools for SLE Micro 5:mgrctl-zsh-completion-0.1.37-150000.1.27.1.noarch",
"openSUSE Leap 15.6:dracut-saltboot-1.0.0-150000.1.62.1.noarch",
"openSUSE Leap 15.6:spacecmd-5.0.14-150000.3.139.1.noarch",
"openSUSE Leap 15.6:supportutils-plugin-susemanager-client-5.0.5-150000.3.30.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-12-18T11:57:30Z",
"details": "important"
}
],
"title": "CVE-2025-6023"
},
{
"cve": "CVE-2025-6197",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-6197"
}
],
"notes": [
{
"category": "general",
"text": "An open redirect vulnerability has been identified in Grafana OSS organization switching functionality.\n\n\nPrerequisites for exploitation:\n\n- Multiple organizations must exist in the Grafana instance\n\n- Victim must be on a different organization than the one specified in the URL",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Manager Client Tools 15:dracut-saltboot-1.0.0-150000.1.62.1.noarch",
"SUSE Manager Client Tools 15:grafana-11.5.10-150000.1.87.1.aarch64",
"SUSE Manager Client Tools 15:grafana-11.5.10-150000.1.87.1.ppc64le",
"SUSE Manager Client Tools 15:grafana-11.5.10-150000.1.87.1.s390x",
"SUSE Manager Client Tools 15:grafana-11.5.10-150000.1.87.1.x86_64",
"SUSE Manager Client Tools 15:mgr-push-5.0.3-150000.1.30.1.noarch",
"SUSE Manager Client Tools 15:mgrctl-0.1.37-150000.1.27.1.aarch64",
"SUSE Manager Client Tools 15:mgrctl-0.1.37-150000.1.27.1.ppc64le",
"SUSE Manager Client Tools 15:mgrctl-0.1.37-150000.1.27.1.s390x",
"SUSE Manager Client Tools 15:mgrctl-0.1.37-150000.1.27.1.x86_64",
"SUSE Manager Client Tools 15:mgrctl-bash-completion-0.1.37-150000.1.27.1.noarch",
"SUSE Manager Client Tools 15:mgrctl-lang-0.1.37-150000.1.27.1.noarch",
"SUSE Manager Client Tools 15:mgrctl-zsh-completion-0.1.37-150000.1.27.1.noarch",
"SUSE Manager Client Tools 15:python3-mgr-push-5.0.3-150000.1.30.1.noarch",
"SUSE Manager Client Tools 15:python3-rhnlib-5.0.6-150000.3.49.1.noarch",
"SUSE Manager Client Tools 15:spacecmd-5.0.14-150000.3.139.1.noarch",
"SUSE Manager Client Tools 15:supportutils-plugin-susemanager-client-5.0.5-150000.3.30.1.noarch",
"SUSE Manager Client Tools for SLE Micro 5:dracut-saltboot-1.0.0-150000.1.62.1.noarch",
"SUSE Manager Client Tools for SLE Micro 5:mgrctl-0.1.37-150000.1.27.1.aarch64",
"SUSE Manager Client Tools for SLE Micro 5:mgrctl-0.1.37-150000.1.27.1.s390x",
"SUSE Manager Client Tools for SLE Micro 5:mgrctl-0.1.37-150000.1.27.1.x86_64",
"SUSE Manager Client Tools for SLE Micro 5:mgrctl-bash-completion-0.1.37-150000.1.27.1.noarch",
"SUSE Manager Client Tools for SLE Micro 5:mgrctl-lang-0.1.37-150000.1.27.1.noarch",
"SUSE Manager Client Tools for SLE Micro 5:mgrctl-zsh-completion-0.1.37-150000.1.27.1.noarch",
"openSUSE Leap 15.6:dracut-saltboot-1.0.0-150000.1.62.1.noarch",
"openSUSE Leap 15.6:spacecmd-5.0.14-150000.3.139.1.noarch",
"openSUSE Leap 15.6:supportutils-plugin-susemanager-client-5.0.5-150000.3.30.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-6197",
"url": "https://www.suse.com/security/cve/CVE-2025-6197"
},
{
"category": "external",
"summary": "SUSE Bug 1246736 for CVE-2025-6197",
"url": "https://bugzilla.suse.com/1246736"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Manager Client Tools 15:dracut-saltboot-1.0.0-150000.1.62.1.noarch",
"SUSE Manager Client Tools 15:grafana-11.5.10-150000.1.87.1.aarch64",
"SUSE Manager Client Tools 15:grafana-11.5.10-150000.1.87.1.ppc64le",
"SUSE Manager Client Tools 15:grafana-11.5.10-150000.1.87.1.s390x",
"SUSE Manager Client Tools 15:grafana-11.5.10-150000.1.87.1.x86_64",
"SUSE Manager Client Tools 15:mgr-push-5.0.3-150000.1.30.1.noarch",
"SUSE Manager Client Tools 15:mgrctl-0.1.37-150000.1.27.1.aarch64",
"SUSE Manager Client Tools 15:mgrctl-0.1.37-150000.1.27.1.ppc64le",
"SUSE Manager Client Tools 15:mgrctl-0.1.37-150000.1.27.1.s390x",
"SUSE Manager Client Tools 15:mgrctl-0.1.37-150000.1.27.1.x86_64",
"SUSE Manager Client Tools 15:mgrctl-bash-completion-0.1.37-150000.1.27.1.noarch",
"SUSE Manager Client Tools 15:mgrctl-lang-0.1.37-150000.1.27.1.noarch",
"SUSE Manager Client Tools 15:mgrctl-zsh-completion-0.1.37-150000.1.27.1.noarch",
"SUSE Manager Client Tools 15:python3-mgr-push-5.0.3-150000.1.30.1.noarch",
"SUSE Manager Client Tools 15:python3-rhnlib-5.0.6-150000.3.49.1.noarch",
"SUSE Manager Client Tools 15:spacecmd-5.0.14-150000.3.139.1.noarch",
"SUSE Manager Client Tools 15:supportutils-plugin-susemanager-client-5.0.5-150000.3.30.1.noarch",
"SUSE Manager Client Tools for SLE Micro 5:dracut-saltboot-1.0.0-150000.1.62.1.noarch",
"SUSE Manager Client Tools for SLE Micro 5:mgrctl-0.1.37-150000.1.27.1.aarch64",
"SUSE Manager Client Tools for SLE Micro 5:mgrctl-0.1.37-150000.1.27.1.s390x",
"SUSE Manager Client Tools for SLE Micro 5:mgrctl-0.1.37-150000.1.27.1.x86_64",
"SUSE Manager Client Tools for SLE Micro 5:mgrctl-bash-completion-0.1.37-150000.1.27.1.noarch",
"SUSE Manager Client Tools for SLE Micro 5:mgrctl-lang-0.1.37-150000.1.27.1.noarch",
"SUSE Manager Client Tools for SLE Micro 5:mgrctl-zsh-completion-0.1.37-150000.1.27.1.noarch",
"openSUSE Leap 15.6:dracut-saltboot-1.0.0-150000.1.62.1.noarch",
"openSUSE Leap 15.6:spacecmd-5.0.14-150000.3.139.1.noarch",
"openSUSE Leap 15.6:supportutils-plugin-susemanager-client-5.0.5-150000.3.30.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.2,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"SUSE Manager Client Tools 15:dracut-saltboot-1.0.0-150000.1.62.1.noarch",
"SUSE Manager Client Tools 15:grafana-11.5.10-150000.1.87.1.aarch64",
"SUSE Manager Client Tools 15:grafana-11.5.10-150000.1.87.1.ppc64le",
"SUSE Manager Client Tools 15:grafana-11.5.10-150000.1.87.1.s390x",
"SUSE Manager Client Tools 15:grafana-11.5.10-150000.1.87.1.x86_64",
"SUSE Manager Client Tools 15:mgr-push-5.0.3-150000.1.30.1.noarch",
"SUSE Manager Client Tools 15:mgrctl-0.1.37-150000.1.27.1.aarch64",
"SUSE Manager Client Tools 15:mgrctl-0.1.37-150000.1.27.1.ppc64le",
"SUSE Manager Client Tools 15:mgrctl-0.1.37-150000.1.27.1.s390x",
"SUSE Manager Client Tools 15:mgrctl-0.1.37-150000.1.27.1.x86_64",
"SUSE Manager Client Tools 15:mgrctl-bash-completion-0.1.37-150000.1.27.1.noarch",
"SUSE Manager Client Tools 15:mgrctl-lang-0.1.37-150000.1.27.1.noarch",
"SUSE Manager Client Tools 15:mgrctl-zsh-completion-0.1.37-150000.1.27.1.noarch",
"SUSE Manager Client Tools 15:python3-mgr-push-5.0.3-150000.1.30.1.noarch",
"SUSE Manager Client Tools 15:python3-rhnlib-5.0.6-150000.3.49.1.noarch",
"SUSE Manager Client Tools 15:spacecmd-5.0.14-150000.3.139.1.noarch",
"SUSE Manager Client Tools 15:supportutils-plugin-susemanager-client-5.0.5-150000.3.30.1.noarch",
"SUSE Manager Client Tools for SLE Micro 5:dracut-saltboot-1.0.0-150000.1.62.1.noarch",
"SUSE Manager Client Tools for SLE Micro 5:mgrctl-0.1.37-150000.1.27.1.aarch64",
"SUSE Manager Client Tools for SLE Micro 5:mgrctl-0.1.37-150000.1.27.1.s390x",
"SUSE Manager Client Tools for SLE Micro 5:mgrctl-0.1.37-150000.1.27.1.x86_64",
"SUSE Manager Client Tools for SLE Micro 5:mgrctl-bash-completion-0.1.37-150000.1.27.1.noarch",
"SUSE Manager Client Tools for SLE Micro 5:mgrctl-lang-0.1.37-150000.1.27.1.noarch",
"SUSE Manager Client Tools for SLE Micro 5:mgrctl-zsh-completion-0.1.37-150000.1.27.1.noarch",
"openSUSE Leap 15.6:dracut-saltboot-1.0.0-150000.1.62.1.noarch",
"openSUSE Leap 15.6:spacecmd-5.0.14-150000.3.139.1.noarch",
"openSUSE Leap 15.6:supportutils-plugin-susemanager-client-5.0.5-150000.3.30.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-12-18T11:57:30Z",
"details": "moderate"
}
],
"title": "CVE-2025-6197"
}
]
}
SUSE-SU-2025:4444-1
Vulnerability from csaf_suse - Published: 2025-12-18 08:49 - Updated: 2025-12-18 08:49Summary
Security update 5.1.1.1 for Multi-Linux Manager Client Tools
Notes
Title of the patch
Security update 5.1.1.1 for Multi-Linux Manager Client Tools
Description of the patch
This update fixes the following issues:
grafana was updated from version 11.5.7 to 11.5.10:
- Security issues fixed:
* CVE-2025-64751: Drop experimental implementation of authorization Zanzana server/client (version 11.5.10)
(bsc#1254113)
* CVE-2025-47911: Fixed parsing HTML documents (version 11.5.10) (bsc#1251454)
* CVE-2025-58190: Fixed excessive memory consumption (version 11.5.10) (bsc#1251657)
* CVE-2025-11065: Fixed sensitive information leak in logs (version 11.5.9) (bsc#1250616)
- Other changes, new features and bugs fixed:
* Version 11.5.10:
+ Use forked wire from Grafana repository instead of external package (jsc#PED-14178)
+ Auth: Fix render user OAuth passthrough.
+ LDAP Authentication: Fix URL to propagate username context as parameter.
+ Plugins: Dependencies do not inherit parent URL for preinstall.
* Version 11.5.9:
+ Auditing: Document new options for recording datasource query request/response body.
+ Login: Fixed redirection after login when Grafana is served from subpath.
* Update to version 11.5.8:
+ No relevant changes
uyuni-tools:
- version 5.1.23-0
* Update the default tag to 5.1.1.1
- version 5.1.22-0
* Fix cobbler config migration to standalone files
* Fix generated DB certificate subject alternate names
- version 5.1.21-0
* Remove extraneous quotes when getting the running image (bsc#1249434)
Patchnames
SUSE-2025-4444,SUSE-MultiLinuxManagerTools-SLE-12-2025-4444
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update 5.1.1.1 for Multi-Linux Manager Client Tools",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update fixes the following issues:\n\ngrafana was updated from version 11.5.7 to 11.5.10:\n\n- Security issues fixed:\n\n * CVE-2025-64751: Drop experimental implementation of authorization Zanzana server/client (version 11.5.10)\n (bsc#1254113)\n * CVE-2025-47911: Fixed parsing HTML documents (version 11.5.10) (bsc#1251454)\n * CVE-2025-58190: Fixed excessive memory consumption (version 11.5.10) (bsc#1251657)\n * CVE-2025-11065: Fixed sensitive information leak in logs (version 11.5.9) (bsc#1250616)\n\n- Other changes, new features and bugs fixed:\n\n * Version 11.5.10:\n + Use forked wire from Grafana repository instead of external package (jsc#PED-14178)\n + Auth: Fix render user OAuth passthrough.\n + LDAP Authentication: Fix URL to propagate username context as parameter.\n + Plugins: Dependencies do not inherit parent URL for preinstall.\n * Version 11.5.9:\n + Auditing: Document new options for recording datasource query request/response body.\n + Login: Fixed redirection after login when Grafana is served from subpath.\n * Update to version 11.5.8:\n + No relevant changes\n\nuyuni-tools:\n\n- version 5.1.23-0\n * Update the default tag to 5.1.1.1\n- version 5.1.22-0\n * Fix cobbler config migration to standalone files\n * Fix generated DB certificate subject alternate names\n- version 5.1.21-0\n * Remove extraneous quotes when getting the running image (bsc#1249434)\n\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-2025-4444,SUSE-MultiLinuxManagerTools-SLE-12-2025-4444",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2025_4444-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2025:4444-1",
"url": "https://www.suse.com/support/update/announcement/2025/suse-su-20254444-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2025:4444-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2025-December/023608.html"
},
{
"category": "self",
"summary": "SUSE Bug 1249434",
"url": "https://bugzilla.suse.com/1249434"
},
{
"category": "self",
"summary": "SUSE Bug 1250616",
"url": "https://bugzilla.suse.com/1250616"
},
{
"category": "self",
"summary": "SUSE Bug 1251454",
"url": "https://bugzilla.suse.com/1251454"
},
{
"category": "self",
"summary": "SUSE Bug 1251657",
"url": "https://bugzilla.suse.com/1251657"
},
{
"category": "self",
"summary": "SUSE Bug 1254113",
"url": "https://bugzilla.suse.com/1254113"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-11065 page",
"url": "https://www.suse.com/security/cve/CVE-2025-11065/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-47911 page",
"url": "https://www.suse.com/security/cve/CVE-2025-47911/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-58190 page",
"url": "https://www.suse.com/security/cve/CVE-2025-58190/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-64751 page",
"url": "https://www.suse.com/security/cve/CVE-2025-64751/"
}
],
"title": "Security update 5.1.1.1 for Multi-Linux Manager Client Tools",
"tracking": {
"current_release_date": "2025-12-18T08:49:35Z",
"generator": {
"date": "2025-12-18T08:49:35Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2025:4444-1",
"initial_release_date": "2025-12-18T08:49:35Z",
"revision_history": [
{
"date": "2025-12-18T08:49:35Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "Multi-Linux-ManagerTools-SLE-release-12-120002.1.11.1.aarch64",
"product": {
"name": "Multi-Linux-ManagerTools-SLE-release-12-120002.1.11.1.aarch64",
"product_id": "Multi-Linux-ManagerTools-SLE-release-12-120002.1.11.1.aarch64"
}
},
{
"category": "product_version",
"name": "Multi-Linux-ManagerTools-SLE-release-POOL-12-120002.1.11.1.aarch64",
"product": {
"name": "Multi-Linux-ManagerTools-SLE-release-POOL-12-120002.1.11.1.aarch64",
"product_id": "Multi-Linux-ManagerTools-SLE-release-POOL-12-120002.1.11.1.aarch64"
}
},
{
"category": "product_version",
"name": "grafana-11.5.10-120002.4.6.1.aarch64",
"product": {
"name": "grafana-11.5.10-120002.4.6.1.aarch64",
"product_id": "grafana-11.5.10-120002.4.6.1.aarch64"
}
},
{
"category": "product_version",
"name": "mgrctl-5.1.23-120002.3.6.1.aarch64",
"product": {
"name": "mgrctl-5.1.23-120002.3.6.1.aarch64",
"product_id": "mgrctl-5.1.23-120002.3.6.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "mgrctl-bash-completion-5.1.23-120002.3.6.1.noarch",
"product": {
"name": "mgrctl-bash-completion-5.1.23-120002.3.6.1.noarch",
"product_id": "mgrctl-bash-completion-5.1.23-120002.3.6.1.noarch"
}
},
{
"category": "product_version",
"name": "mgrctl-lang-5.1.23-120002.3.6.1.noarch",
"product": {
"name": "mgrctl-lang-5.1.23-120002.3.6.1.noarch",
"product_id": "mgrctl-lang-5.1.23-120002.3.6.1.noarch"
}
},
{
"category": "product_version",
"name": "mgrctl-zsh-completion-5.1.23-120002.3.6.1.noarch",
"product": {
"name": "mgrctl-zsh-completion-5.1.23-120002.3.6.1.noarch",
"product_id": "mgrctl-zsh-completion-5.1.23-120002.3.6.1.noarch"
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "Multi-Linux-ManagerTools-SLE-release-12-120002.1.11.1.ppc64le",
"product": {
"name": "Multi-Linux-ManagerTools-SLE-release-12-120002.1.11.1.ppc64le",
"product_id": "Multi-Linux-ManagerTools-SLE-release-12-120002.1.11.1.ppc64le"
}
},
{
"category": "product_version",
"name": "Multi-Linux-ManagerTools-SLE-release-POOL-12-120002.1.11.1.ppc64le",
"product": {
"name": "Multi-Linux-ManagerTools-SLE-release-POOL-12-120002.1.11.1.ppc64le",
"product_id": "Multi-Linux-ManagerTools-SLE-release-POOL-12-120002.1.11.1.ppc64le"
}
},
{
"category": "product_version",
"name": "grafana-11.5.10-120002.4.6.1.ppc64le",
"product": {
"name": "grafana-11.5.10-120002.4.6.1.ppc64le",
"product_id": "grafana-11.5.10-120002.4.6.1.ppc64le"
}
},
{
"category": "product_version",
"name": "mgrctl-5.1.23-120002.3.6.1.ppc64le",
"product": {
"name": "mgrctl-5.1.23-120002.3.6.1.ppc64le",
"product_id": "mgrctl-5.1.23-120002.3.6.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "Multi-Linux-ManagerTools-SLE-release-12-120002.1.11.1.s390x",
"product": {
"name": "Multi-Linux-ManagerTools-SLE-release-12-120002.1.11.1.s390x",
"product_id": "Multi-Linux-ManagerTools-SLE-release-12-120002.1.11.1.s390x"
}
},
{
"category": "product_version",
"name": "Multi-Linux-ManagerTools-SLE-release-POOL-12-120002.1.11.1.s390x",
"product": {
"name": "Multi-Linux-ManagerTools-SLE-release-POOL-12-120002.1.11.1.s390x",
"product_id": "Multi-Linux-ManagerTools-SLE-release-POOL-12-120002.1.11.1.s390x"
}
},
{
"category": "product_version",
"name": "grafana-11.5.10-120002.4.6.1.s390x",
"product": {
"name": "grafana-11.5.10-120002.4.6.1.s390x",
"product_id": "grafana-11.5.10-120002.4.6.1.s390x"
}
},
{
"category": "product_version",
"name": "mgrctl-5.1.23-120002.3.6.1.s390x",
"product": {
"name": "mgrctl-5.1.23-120002.3.6.1.s390x",
"product_id": "mgrctl-5.1.23-120002.3.6.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "Multi-Linux-ManagerTools-SLE-release-12-120002.1.11.1.x86_64",
"product": {
"name": "Multi-Linux-ManagerTools-SLE-release-12-120002.1.11.1.x86_64",
"product_id": "Multi-Linux-ManagerTools-SLE-release-12-120002.1.11.1.x86_64"
}
},
{
"category": "product_version",
"name": "Multi-Linux-ManagerTools-SLE-release-POOL-12-120002.1.11.1.x86_64",
"product": {
"name": "Multi-Linux-ManagerTools-SLE-release-POOL-12-120002.1.11.1.x86_64",
"product_id": "Multi-Linux-ManagerTools-SLE-release-POOL-12-120002.1.11.1.x86_64"
}
},
{
"category": "product_version",
"name": "grafana-11.5.10-120002.4.6.1.x86_64",
"product": {
"name": "grafana-11.5.10-120002.4.6.1.x86_64",
"product_id": "grafana-11.5.10-120002.4.6.1.x86_64"
}
},
{
"category": "product_version",
"name": "mgrctl-5.1.23-120002.3.6.1.x86_64",
"product": {
"name": "mgrctl-5.1.23-120002.3.6.1.x86_64",
"product_id": "mgrctl-5.1.23-120002.3.6.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Multi Linux Manager Tools SLE-12",
"product": {
"name": "SUSE Multi Linux Manager Tools SLE-12",
"product_id": "SUSE Multi Linux Manager Tools SLE-12"
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "Multi-Linux-ManagerTools-SLE-release-12-120002.1.11.1.aarch64 as component of SUSE Multi Linux Manager Tools SLE-12",
"product_id": "SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-12-120002.1.11.1.aarch64"
},
"product_reference": "Multi-Linux-ManagerTools-SLE-release-12-120002.1.11.1.aarch64",
"relates_to_product_reference": "SUSE Multi Linux Manager Tools SLE-12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "Multi-Linux-ManagerTools-SLE-release-12-120002.1.11.1.ppc64le as component of SUSE Multi Linux Manager Tools SLE-12",
"product_id": "SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-12-120002.1.11.1.ppc64le"
},
"product_reference": "Multi-Linux-ManagerTools-SLE-release-12-120002.1.11.1.ppc64le",
"relates_to_product_reference": "SUSE Multi Linux Manager Tools SLE-12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "Multi-Linux-ManagerTools-SLE-release-12-120002.1.11.1.s390x as component of SUSE Multi Linux Manager Tools SLE-12",
"product_id": "SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-12-120002.1.11.1.s390x"
},
"product_reference": "Multi-Linux-ManagerTools-SLE-release-12-120002.1.11.1.s390x",
"relates_to_product_reference": "SUSE Multi Linux Manager Tools SLE-12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "Multi-Linux-ManagerTools-SLE-release-12-120002.1.11.1.x86_64 as component of SUSE Multi Linux Manager Tools SLE-12",
"product_id": "SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-12-120002.1.11.1.x86_64"
},
"product_reference": "Multi-Linux-ManagerTools-SLE-release-12-120002.1.11.1.x86_64",
"relates_to_product_reference": "SUSE Multi Linux Manager Tools SLE-12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "Multi-Linux-ManagerTools-SLE-release-POOL-12-120002.1.11.1.aarch64 as component of SUSE Multi Linux Manager Tools SLE-12",
"product_id": "SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-POOL-12-120002.1.11.1.aarch64"
},
"product_reference": "Multi-Linux-ManagerTools-SLE-release-POOL-12-120002.1.11.1.aarch64",
"relates_to_product_reference": "SUSE Multi Linux Manager Tools SLE-12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "Multi-Linux-ManagerTools-SLE-release-POOL-12-120002.1.11.1.ppc64le as component of SUSE Multi Linux Manager Tools SLE-12",
"product_id": "SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-POOL-12-120002.1.11.1.ppc64le"
},
"product_reference": "Multi-Linux-ManagerTools-SLE-release-POOL-12-120002.1.11.1.ppc64le",
"relates_to_product_reference": "SUSE Multi Linux Manager Tools SLE-12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "Multi-Linux-ManagerTools-SLE-release-POOL-12-120002.1.11.1.s390x as component of SUSE Multi Linux Manager Tools SLE-12",
"product_id": "SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-POOL-12-120002.1.11.1.s390x"
},
"product_reference": "Multi-Linux-ManagerTools-SLE-release-POOL-12-120002.1.11.1.s390x",
"relates_to_product_reference": "SUSE Multi Linux Manager Tools SLE-12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "Multi-Linux-ManagerTools-SLE-release-POOL-12-120002.1.11.1.x86_64 as component of SUSE Multi Linux Manager Tools SLE-12",
"product_id": "SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-POOL-12-120002.1.11.1.x86_64"
},
"product_reference": "Multi-Linux-ManagerTools-SLE-release-POOL-12-120002.1.11.1.x86_64",
"relates_to_product_reference": "SUSE Multi Linux Manager Tools SLE-12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-11.5.10-120002.4.6.1.aarch64 as component of SUSE Multi Linux Manager Tools SLE-12",
"product_id": "SUSE Multi Linux Manager Tools SLE-12:grafana-11.5.10-120002.4.6.1.aarch64"
},
"product_reference": "grafana-11.5.10-120002.4.6.1.aarch64",
"relates_to_product_reference": "SUSE Multi Linux Manager Tools SLE-12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-11.5.10-120002.4.6.1.ppc64le as component of SUSE Multi Linux Manager Tools SLE-12",
"product_id": "SUSE Multi Linux Manager Tools SLE-12:grafana-11.5.10-120002.4.6.1.ppc64le"
},
"product_reference": "grafana-11.5.10-120002.4.6.1.ppc64le",
"relates_to_product_reference": "SUSE Multi Linux Manager Tools SLE-12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-11.5.10-120002.4.6.1.s390x as component of SUSE Multi Linux Manager Tools SLE-12",
"product_id": "SUSE Multi Linux Manager Tools SLE-12:grafana-11.5.10-120002.4.6.1.s390x"
},
"product_reference": "grafana-11.5.10-120002.4.6.1.s390x",
"relates_to_product_reference": "SUSE Multi Linux Manager Tools SLE-12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "grafana-11.5.10-120002.4.6.1.x86_64 as component of SUSE Multi Linux Manager Tools SLE-12",
"product_id": "SUSE Multi Linux Manager Tools SLE-12:grafana-11.5.10-120002.4.6.1.x86_64"
},
"product_reference": "grafana-11.5.10-120002.4.6.1.x86_64",
"relates_to_product_reference": "SUSE Multi Linux Manager Tools SLE-12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mgrctl-5.1.23-120002.3.6.1.aarch64 as component of SUSE Multi Linux Manager Tools SLE-12",
"product_id": "SUSE Multi Linux Manager Tools SLE-12:mgrctl-5.1.23-120002.3.6.1.aarch64"
},
"product_reference": "mgrctl-5.1.23-120002.3.6.1.aarch64",
"relates_to_product_reference": "SUSE Multi Linux Manager Tools SLE-12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mgrctl-5.1.23-120002.3.6.1.ppc64le as component of SUSE Multi Linux Manager Tools SLE-12",
"product_id": "SUSE Multi Linux Manager Tools SLE-12:mgrctl-5.1.23-120002.3.6.1.ppc64le"
},
"product_reference": "mgrctl-5.1.23-120002.3.6.1.ppc64le",
"relates_to_product_reference": "SUSE Multi Linux Manager Tools SLE-12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mgrctl-5.1.23-120002.3.6.1.s390x as component of SUSE Multi Linux Manager Tools SLE-12",
"product_id": "SUSE Multi Linux Manager Tools SLE-12:mgrctl-5.1.23-120002.3.6.1.s390x"
},
"product_reference": "mgrctl-5.1.23-120002.3.6.1.s390x",
"relates_to_product_reference": "SUSE Multi Linux Manager Tools SLE-12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mgrctl-5.1.23-120002.3.6.1.x86_64 as component of SUSE Multi Linux Manager Tools SLE-12",
"product_id": "SUSE Multi Linux Manager Tools SLE-12:mgrctl-5.1.23-120002.3.6.1.x86_64"
},
"product_reference": "mgrctl-5.1.23-120002.3.6.1.x86_64",
"relates_to_product_reference": "SUSE Multi Linux Manager Tools SLE-12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mgrctl-bash-completion-5.1.23-120002.3.6.1.noarch as component of SUSE Multi Linux Manager Tools SLE-12",
"product_id": "SUSE Multi Linux Manager Tools SLE-12:mgrctl-bash-completion-5.1.23-120002.3.6.1.noarch"
},
"product_reference": "mgrctl-bash-completion-5.1.23-120002.3.6.1.noarch",
"relates_to_product_reference": "SUSE Multi Linux Manager Tools SLE-12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mgrctl-lang-5.1.23-120002.3.6.1.noarch as component of SUSE Multi Linux Manager Tools SLE-12",
"product_id": "SUSE Multi Linux Manager Tools SLE-12:mgrctl-lang-5.1.23-120002.3.6.1.noarch"
},
"product_reference": "mgrctl-lang-5.1.23-120002.3.6.1.noarch",
"relates_to_product_reference": "SUSE Multi Linux Manager Tools SLE-12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mgrctl-zsh-completion-5.1.23-120002.3.6.1.noarch as component of SUSE Multi Linux Manager Tools SLE-12",
"product_id": "SUSE Multi Linux Manager Tools SLE-12:mgrctl-zsh-completion-5.1.23-120002.3.6.1.noarch"
},
"product_reference": "mgrctl-zsh-completion-5.1.23-120002.3.6.1.noarch",
"relates_to_product_reference": "SUSE Multi Linux Manager Tools SLE-12"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-11065",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-11065"
}
],
"notes": [
{
"category": "general",
"text": "unknown",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-12-120002.1.11.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-12-120002.1.11.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-12-120002.1.11.1.s390x",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-12-120002.1.11.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-POOL-12-120002.1.11.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-POOL-12-120002.1.11.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-POOL-12-120002.1.11.1.s390x",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-POOL-12-120002.1.11.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-12:grafana-11.5.10-120002.4.6.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-12:grafana-11.5.10-120002.4.6.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-12:grafana-11.5.10-120002.4.6.1.s390x",
"SUSE Multi Linux Manager Tools SLE-12:grafana-11.5.10-120002.4.6.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-5.1.23-120002.3.6.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-5.1.23-120002.3.6.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-5.1.23-120002.3.6.1.s390x",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-5.1.23-120002.3.6.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-bash-completion-5.1.23-120002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-lang-5.1.23-120002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-zsh-completion-5.1.23-120002.3.6.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-11065",
"url": "https://www.suse.com/security/cve/CVE-2025-11065"
},
{
"category": "external",
"summary": "SUSE Bug 1250608 for CVE-2025-11065",
"url": "https://bugzilla.suse.com/1250608"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-12-120002.1.11.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-12-120002.1.11.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-12-120002.1.11.1.s390x",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-12-120002.1.11.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-POOL-12-120002.1.11.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-POOL-12-120002.1.11.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-POOL-12-120002.1.11.1.s390x",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-POOL-12-120002.1.11.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-12:grafana-11.5.10-120002.4.6.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-12:grafana-11.5.10-120002.4.6.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-12:grafana-11.5.10-120002.4.6.1.s390x",
"SUSE Multi Linux Manager Tools SLE-12:grafana-11.5.10-120002.4.6.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-5.1.23-120002.3.6.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-5.1.23-120002.3.6.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-5.1.23-120002.3.6.1.s390x",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-5.1.23-120002.3.6.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-bash-completion-5.1.23-120002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-lang-5.1.23-120002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-zsh-completion-5.1.23-120002.3.6.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-12-120002.1.11.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-12-120002.1.11.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-12-120002.1.11.1.s390x",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-12-120002.1.11.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-POOL-12-120002.1.11.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-POOL-12-120002.1.11.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-POOL-12-120002.1.11.1.s390x",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-POOL-12-120002.1.11.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-12:grafana-11.5.10-120002.4.6.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-12:grafana-11.5.10-120002.4.6.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-12:grafana-11.5.10-120002.4.6.1.s390x",
"SUSE Multi Linux Manager Tools SLE-12:grafana-11.5.10-120002.4.6.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-5.1.23-120002.3.6.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-5.1.23-120002.3.6.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-5.1.23-120002.3.6.1.s390x",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-5.1.23-120002.3.6.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-bash-completion-5.1.23-120002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-lang-5.1.23-120002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-zsh-completion-5.1.23-120002.3.6.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-12-18T08:49:35Z",
"details": "moderate"
}
],
"title": "CVE-2025-11065"
},
{
"cve": "CVE-2025-47911",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-47911"
}
],
"notes": [
{
"category": "general",
"text": "unknown",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-12-120002.1.11.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-12-120002.1.11.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-12-120002.1.11.1.s390x",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-12-120002.1.11.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-POOL-12-120002.1.11.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-POOL-12-120002.1.11.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-POOL-12-120002.1.11.1.s390x",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-POOL-12-120002.1.11.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-12:grafana-11.5.10-120002.4.6.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-12:grafana-11.5.10-120002.4.6.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-12:grafana-11.5.10-120002.4.6.1.s390x",
"SUSE Multi Linux Manager Tools SLE-12:grafana-11.5.10-120002.4.6.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-5.1.23-120002.3.6.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-5.1.23-120002.3.6.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-5.1.23-120002.3.6.1.s390x",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-5.1.23-120002.3.6.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-bash-completion-5.1.23-120002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-lang-5.1.23-120002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-zsh-completion-5.1.23-120002.3.6.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-47911",
"url": "https://www.suse.com/security/cve/CVE-2025-47911"
},
{
"category": "external",
"summary": "SUSE Bug 1251308 for CVE-2025-47911",
"url": "https://bugzilla.suse.com/1251308"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-12-120002.1.11.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-12-120002.1.11.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-12-120002.1.11.1.s390x",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-12-120002.1.11.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-POOL-12-120002.1.11.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-POOL-12-120002.1.11.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-POOL-12-120002.1.11.1.s390x",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-POOL-12-120002.1.11.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-12:grafana-11.5.10-120002.4.6.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-12:grafana-11.5.10-120002.4.6.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-12:grafana-11.5.10-120002.4.6.1.s390x",
"SUSE Multi Linux Manager Tools SLE-12:grafana-11.5.10-120002.4.6.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-5.1.23-120002.3.6.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-5.1.23-120002.3.6.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-5.1.23-120002.3.6.1.s390x",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-5.1.23-120002.3.6.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-bash-completion-5.1.23-120002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-lang-5.1.23-120002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-zsh-completion-5.1.23-120002.3.6.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-12-120002.1.11.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-12-120002.1.11.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-12-120002.1.11.1.s390x",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-12-120002.1.11.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-POOL-12-120002.1.11.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-POOL-12-120002.1.11.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-POOL-12-120002.1.11.1.s390x",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-POOL-12-120002.1.11.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-12:grafana-11.5.10-120002.4.6.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-12:grafana-11.5.10-120002.4.6.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-12:grafana-11.5.10-120002.4.6.1.s390x",
"SUSE Multi Linux Manager Tools SLE-12:grafana-11.5.10-120002.4.6.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-5.1.23-120002.3.6.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-5.1.23-120002.3.6.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-5.1.23-120002.3.6.1.s390x",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-5.1.23-120002.3.6.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-bash-completion-5.1.23-120002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-lang-5.1.23-120002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-zsh-completion-5.1.23-120002.3.6.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-12-18T08:49:35Z",
"details": "moderate"
}
],
"title": "CVE-2025-47911"
},
{
"cve": "CVE-2025-58190",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-58190"
}
],
"notes": [
{
"category": "general",
"text": "unknown",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-12-120002.1.11.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-12-120002.1.11.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-12-120002.1.11.1.s390x",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-12-120002.1.11.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-POOL-12-120002.1.11.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-POOL-12-120002.1.11.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-POOL-12-120002.1.11.1.s390x",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-POOL-12-120002.1.11.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-12:grafana-11.5.10-120002.4.6.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-12:grafana-11.5.10-120002.4.6.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-12:grafana-11.5.10-120002.4.6.1.s390x",
"SUSE Multi Linux Manager Tools SLE-12:grafana-11.5.10-120002.4.6.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-5.1.23-120002.3.6.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-5.1.23-120002.3.6.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-5.1.23-120002.3.6.1.s390x",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-5.1.23-120002.3.6.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-bash-completion-5.1.23-120002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-lang-5.1.23-120002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-zsh-completion-5.1.23-120002.3.6.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-58190",
"url": "https://www.suse.com/security/cve/CVE-2025-58190"
},
{
"category": "external",
"summary": "SUSE Bug 1251309 for CVE-2025-58190",
"url": "https://bugzilla.suse.com/1251309"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-12-120002.1.11.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-12-120002.1.11.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-12-120002.1.11.1.s390x",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-12-120002.1.11.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-POOL-12-120002.1.11.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-POOL-12-120002.1.11.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-POOL-12-120002.1.11.1.s390x",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-POOL-12-120002.1.11.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-12:grafana-11.5.10-120002.4.6.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-12:grafana-11.5.10-120002.4.6.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-12:grafana-11.5.10-120002.4.6.1.s390x",
"SUSE Multi Linux Manager Tools SLE-12:grafana-11.5.10-120002.4.6.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-5.1.23-120002.3.6.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-5.1.23-120002.3.6.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-5.1.23-120002.3.6.1.s390x",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-5.1.23-120002.3.6.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-bash-completion-5.1.23-120002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-lang-5.1.23-120002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-zsh-completion-5.1.23-120002.3.6.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-12-120002.1.11.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-12-120002.1.11.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-12-120002.1.11.1.s390x",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-12-120002.1.11.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-POOL-12-120002.1.11.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-POOL-12-120002.1.11.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-POOL-12-120002.1.11.1.s390x",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-POOL-12-120002.1.11.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-12:grafana-11.5.10-120002.4.6.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-12:grafana-11.5.10-120002.4.6.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-12:grafana-11.5.10-120002.4.6.1.s390x",
"SUSE Multi Linux Manager Tools SLE-12:grafana-11.5.10-120002.4.6.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-5.1.23-120002.3.6.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-5.1.23-120002.3.6.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-5.1.23-120002.3.6.1.s390x",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-5.1.23-120002.3.6.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-bash-completion-5.1.23-120002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-lang-5.1.23-120002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-zsh-completion-5.1.23-120002.3.6.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-12-18T08:49:35Z",
"details": "moderate"
}
],
"title": "CVE-2025-58190"
},
{
"cve": "CVE-2025-64751",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-64751"
}
],
"notes": [
{
"category": "general",
"text": "OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA v1.4.0 to v1.11.0 ( openfga-0.1.34 \u003c= Helm chart \u003c= openfga-0.2.48, v.1.4.0 \u003c= docker \u003c= v.1.11.0) are vulnerable to improper policy enforcement when certain Check and ListObject calls are executed. This issue has been patched in version 1.11.1.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-12-120002.1.11.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-12-120002.1.11.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-12-120002.1.11.1.s390x",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-12-120002.1.11.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-POOL-12-120002.1.11.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-POOL-12-120002.1.11.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-POOL-12-120002.1.11.1.s390x",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-POOL-12-120002.1.11.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-12:grafana-11.5.10-120002.4.6.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-12:grafana-11.5.10-120002.4.6.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-12:grafana-11.5.10-120002.4.6.1.s390x",
"SUSE Multi Linux Manager Tools SLE-12:grafana-11.5.10-120002.4.6.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-5.1.23-120002.3.6.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-5.1.23-120002.3.6.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-5.1.23-120002.3.6.1.s390x",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-5.1.23-120002.3.6.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-bash-completion-5.1.23-120002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-lang-5.1.23-120002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-zsh-completion-5.1.23-120002.3.6.1.noarch"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-64751",
"url": "https://www.suse.com/security/cve/CVE-2025-64751"
},
{
"category": "external",
"summary": "SUSE Bug 1254112 for CVE-2025-64751",
"url": "https://bugzilla.suse.com/1254112"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-12-120002.1.11.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-12-120002.1.11.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-12-120002.1.11.1.s390x",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-12-120002.1.11.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-POOL-12-120002.1.11.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-POOL-12-120002.1.11.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-POOL-12-120002.1.11.1.s390x",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-POOL-12-120002.1.11.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-12:grafana-11.5.10-120002.4.6.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-12:grafana-11.5.10-120002.4.6.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-12:grafana-11.5.10-120002.4.6.1.s390x",
"SUSE Multi Linux Manager Tools SLE-12:grafana-11.5.10-120002.4.6.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-5.1.23-120002.3.6.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-5.1.23-120002.3.6.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-5.1.23-120002.3.6.1.s390x",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-5.1.23-120002.3.6.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-bash-completion-5.1.23-120002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-lang-5.1.23-120002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-zsh-completion-5.1.23-120002.3.6.1.noarch"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-12-120002.1.11.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-12-120002.1.11.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-12-120002.1.11.1.s390x",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-12-120002.1.11.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-POOL-12-120002.1.11.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-POOL-12-120002.1.11.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-POOL-12-120002.1.11.1.s390x",
"SUSE Multi Linux Manager Tools SLE-12:Multi-Linux-ManagerTools-SLE-release-POOL-12-120002.1.11.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-12:grafana-11.5.10-120002.4.6.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-12:grafana-11.5.10-120002.4.6.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-12:grafana-11.5.10-120002.4.6.1.s390x",
"SUSE Multi Linux Manager Tools SLE-12:grafana-11.5.10-120002.4.6.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-5.1.23-120002.3.6.1.aarch64",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-5.1.23-120002.3.6.1.ppc64le",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-5.1.23-120002.3.6.1.s390x",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-5.1.23-120002.3.6.1.x86_64",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-bash-completion-5.1.23-120002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-lang-5.1.23-120002.3.6.1.noarch",
"SUSE Multi Linux Manager Tools SLE-12:mgrctl-zsh-completion-5.1.23-120002.3.6.1.noarch"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-12-18T08:49:35Z",
"details": "important"
}
],
"title": "CVE-2025-64751"
}
]
}
SUSE-SU-2025:21137-1
Vulnerability from csaf_suse - Published: 2025-11-20 17:15 - Updated: 2025-11-20 17:15Summary
Security update for alloy
Notes
Title of the patch
Security update for alloy
Description of the patch
This update for alloy fixes the following issues:
- CVE-2025-58058: Removed dependency on vulnerable github.com/ulikunitz/xz (bsc#1248960).
- CVE-2025-11065: Fixed sensitive information leak in logs (bsc#1250621).
Patchnames
SUSE-SLES-16.0-47
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for alloy",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update for alloy fixes the following issues:\n\n- CVE-2025-58058: Removed dependency on vulnerable github.com/ulikunitz/xz (bsc#1248960).\n- CVE-2025-11065: Fixed sensitive information leak in logs (bsc#1250621).\n",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-SLES-16.0-47",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2025_21137-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2025:21137-1",
"url": "https://www.suse.com/support/update/announcement/2025/suse-su-202521137-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2025:21137-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2025-December/023517.html"
},
{
"category": "self",
"summary": "SUSE Bug 1248960",
"url": "https://bugzilla.suse.com/1248960"
},
{
"category": "self",
"summary": "SUSE Bug 1250621",
"url": "https://bugzilla.suse.com/1250621"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-11065 page",
"url": "https://www.suse.com/security/cve/CVE-2025-11065/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2025-58058 page",
"url": "https://www.suse.com/security/cve/CVE-2025-58058/"
}
],
"title": "Security update for alloy",
"tracking": {
"current_release_date": "2025-11-20T17:15:36Z",
"generator": {
"date": "2025-11-20T17:15:36Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2025:21137-1",
"initial_release_date": "2025-11-20T17:15:36Z",
"revision_history": [
{
"date": "2025-11-20T17:15:36Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "alloy-1.11.3-160000.1.1.aarch64",
"product": {
"name": "alloy-1.11.3-160000.1.1.aarch64",
"product_id": "alloy-1.11.3-160000.1.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "alloy-1.11.3-160000.1.1.ppc64le",
"product": {
"name": "alloy-1.11.3-160000.1.1.ppc64le",
"product_id": "alloy-1.11.3-160000.1.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "alloy-1.11.3-160000.1.1.s390x",
"product": {
"name": "alloy-1.11.3-160000.1.1.s390x",
"product_id": "alloy-1.11.3-160000.1.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "alloy-1.11.3-160000.1.1.x86_64",
"product": {
"name": "alloy-1.11.3-160000.1.1.x86_64",
"product_id": "alloy-1.11.3-160000.1.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server 16.0",
"product": {
"name": "SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:16.0"
}
}
},
{
"category": "product_name",
"name": "SUSE Linux Enterprise Server for SAP applications 16.0",
"product": {
"name": "SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0",
"product_identification_helper": {
"cpe": "cpe:/o:suse:sles:16:16.0:server-sap"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "alloy-1.11.3-160000.1.1.aarch64 as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:alloy-1.11.3-160000.1.1.aarch64"
},
"product_reference": "alloy-1.11.3-160000.1.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "alloy-1.11.3-160000.1.1.ppc64le as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:alloy-1.11.3-160000.1.1.ppc64le"
},
"product_reference": "alloy-1.11.3-160000.1.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "alloy-1.11.3-160000.1.1.s390x as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:alloy-1.11.3-160000.1.1.s390x"
},
"product_reference": "alloy-1.11.3-160000.1.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "alloy-1.11.3-160000.1.1.x86_64 as component of SUSE Linux Enterprise Server 16.0",
"product_id": "SUSE Linux Enterprise Server 16.0:alloy-1.11.3-160000.1.1.x86_64"
},
"product_reference": "alloy-1.11.3-160000.1.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "alloy-1.11.3-160000.1.1.aarch64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.11.3-160000.1.1.aarch64"
},
"product_reference": "alloy-1.11.3-160000.1.1.aarch64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "alloy-1.11.3-160000.1.1.ppc64le as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.11.3-160000.1.1.ppc64le"
},
"product_reference": "alloy-1.11.3-160000.1.1.ppc64le",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "alloy-1.11.3-160000.1.1.s390x as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.11.3-160000.1.1.s390x"
},
"product_reference": "alloy-1.11.3-160000.1.1.s390x",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "alloy-1.11.3-160000.1.1.x86_64 as component of SUSE Linux Enterprise Server for SAP applications 16.0",
"product_id": "SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.11.3-160000.1.1.x86_64"
},
"product_reference": "alloy-1.11.3-160000.1.1.x86_64",
"relates_to_product_reference": "SUSE Linux Enterprise Server for SAP applications 16.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-11065",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-11065"
}
],
"notes": [
{
"category": "general",
"text": "unknown",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:alloy-1.11.3-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:alloy-1.11.3-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:alloy-1.11.3-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:alloy-1.11.3-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.11.3-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.11.3-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.11.3-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.11.3-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-11065",
"url": "https://www.suse.com/security/cve/CVE-2025-11065"
},
{
"category": "external",
"summary": "SUSE Bug 1250608 for CVE-2025-11065",
"url": "https://bugzilla.suse.com/1250608"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:alloy-1.11.3-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:alloy-1.11.3-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:alloy-1.11.3-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:alloy-1.11.3-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.11.3-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.11.3-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.11.3-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.11.3-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:alloy-1.11.3-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:alloy-1.11.3-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:alloy-1.11.3-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:alloy-1.11.3-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.11.3-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.11.3-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.11.3-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.11.3-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-11-20T17:15:36Z",
"details": "moderate"
}
],
"title": "CVE-2025-11065"
},
{
"cve": "CVE-2025-58058",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2025-58058"
}
],
"notes": [
{
"category": "general",
"text": "xz is a pure golang package for reading and writing xz-compressed files. Prior to version 0.5.14, it is possible to put data in front of an LZMA-encoded byte stream without detecting the situation while reading the header. This can lead to increased memory consumption because the current implementation allocates the full decoding buffer directly after reading the header. The LZMA header doesn\u0027t include a magic number or has a checksum to detect such an issue according to the specification. Note that the code recognizes the issue later while reading the stream, but at this time the memory allocation has already been done. This issue has been patched in version 0.5.14.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Linux Enterprise Server 16.0:alloy-1.11.3-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:alloy-1.11.3-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:alloy-1.11.3-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:alloy-1.11.3-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.11.3-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.11.3-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.11.3-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.11.3-160000.1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2025-58058",
"url": "https://www.suse.com/security/cve/CVE-2025-58058"
},
{
"category": "external",
"summary": "SUSE Bug 1248889 for CVE-2025-58058",
"url": "https://bugzilla.suse.com/1248889"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Linux Enterprise Server 16.0:alloy-1.11.3-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:alloy-1.11.3-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:alloy-1.11.3-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:alloy-1.11.3-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.11.3-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.11.3-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.11.3-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.11.3-160000.1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"SUSE Linux Enterprise Server 16.0:alloy-1.11.3-160000.1.1.aarch64",
"SUSE Linux Enterprise Server 16.0:alloy-1.11.3-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server 16.0:alloy-1.11.3-160000.1.1.s390x",
"SUSE Linux Enterprise Server 16.0:alloy-1.11.3-160000.1.1.x86_64",
"SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.11.3-160000.1.1.aarch64",
"SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.11.3-160000.1.1.ppc64le",
"SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.11.3-160000.1.1.s390x",
"SUSE Linux Enterprise Server for SAP applications 16.0:alloy-1.11.3-160000.1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2025-11-20T17:15:36Z",
"details": "moderate"
}
],
"title": "CVE-2025-58058"
}
]
}
FKIE_CVE-2025-11065
Vulnerability from fkie_nvd - Published: 2026-01-26 20:16 - Updated: 2026-01-27 14:59
Severity ?
Summary
A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts.
References
| URL | Tags | ||
|---|---|---|---|
| secalert@redhat.com | https://access.redhat.com/security/cve/CVE-2025-11065 | ||
| secalert@redhat.com | https://bugzilla.redhat.com/show_bug.cgi?id=2391829 | ||
| secalert@redhat.com | https://github.com/go-viper/mapstructure/commit/742921c9ba2854d27baa64272487fc5075d2c39c | ||
| secalert@redhat.com | https://github.com/go-viper/mapstructure/security/advisories/GHSA-2464-8j7c-4cjm |
Impacted products
| Vendor | Product | Version |
|---|
{
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in github.com/go-viper/mapstructure/v2, in the field processing component using mapstructure.WeakDecode. This vulnerability allows information disclosure through detailed error messages that may leak sensitive input values via malformed user-supplied data processed in security-critical contexts."
}
],
"id": "CVE-2025-11065",
"lastModified": "2026-01-27T14:59:34.073",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.6,
"impactScore": 3.6,
"source": "secalert@redhat.com",
"type": "Primary"
}
]
},
"published": "2026-01-26T20:16:06.840",
"references": [
{
"source": "secalert@redhat.com",
"url": "https://access.redhat.com/security/cve/CVE-2025-11065"
},
{
"source": "secalert@redhat.com",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2391829"
},
{
"source": "secalert@redhat.com",
"url": "https://github.com/go-viper/mapstructure/commit/742921c9ba2854d27baa64272487fc5075d2c39c"
},
{
"source": "secalert@redhat.com",
"url": "https://github.com/go-viper/mapstructure/security/advisories/GHSA-2464-8j7c-4cjm"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Awaiting Analysis",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-209"
}
],
"source": "secalert@redhat.com",
"type": "Primary"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…