SUSE-SU-2026:21518-1

Vulnerability from csaf_suse - Published: 2026-05-05 06:49 - Updated: 2026-09-16 19:46
Summary
Security update for build, product-composer
Severity
Moderate
Notes
Title of the patch: Security update for build, product-composer
Description of the patch: This update for build, product-composer fixes the following issues: Changes in build: - Support a new "IgnoreRebuild" config. - build-recipe-kiwi: * Add support for oci containers * Avoid needlessly compressing container images * Detect container images based on build result file name - Fix queryrecipe to use the summary and the description from the main package - config: Add slfo-main build configuration - drop the inner quotes, not needed on bash 4 and breaks on bash 3 - build: in the ccache case, after test -e also accept -L - container: * Add microdnf package manager support * Add experimental support for the container-timestamp build option - sbom: * allow to create v1 intoto data * spdx: connect OPERATING-SYSTEM package to the root package * Transfer product vcs and disturl - Support --cms-nocerts and --cms-keyid in the signdummy - Support chroot builds inside of containers - runservice tool, allow to specify the modes. Can be used on plain git source now also - Support --mtime option for cpio creation - generate_sbom: * Support also unzck compressed repomd files * Fail when given --product directory is missing * support zstd compressed repomd data - build-vm-lxc: support lxc >= 5 - vc: Hide an annoying error message when not using NIS - added leap-16.0 and leap-16.1 build configs. (not named sl16.0 anymore, but using same string as the git branch) - Implement cmssign support in signdummy - pbuild: mark git assets with a fixed commit as immutable - mkosi * check if old parameters are supported before passing them * support old bash version - Do not crash on small files that start with the PE magic - Harden export_debian_orig_from_git (CVE-2024-22038, boo#1230469) Changes in product-composer: update to version 0.9.6: * Speed-up reading of rpm headers * Flush output lines to get get correct timestamps in OBS update to version 0.9.5: * Be a bit more verbose to track used times per step in OBS * Fix a crash when doing version compare with an epoch update to version 0.9.4: * Give an error when trying to add updateinfo meta data without all binary revisions. * Hand over vcs and disturl data to generate_sbom. (We require a recent build package therefore)
Patchnames: SUSE-SLE-Micro-Extras-6.2-678
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
CVE-2024-22038
7.3 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H
Affected products
Product Identifier Version Remediation
Unresolved product id: SUSE Linux Micro Extras 6.2:build-mkbaselibs-20260415-160000.1.1.noarch —
Vendor Fix
Threats
Impact important
References
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for build, product-composer",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for build, product-composer fixes the following issues:\n\nChanges in build:\n\n- Support a new \"IgnoreRebuild\" config.\n\n- build-recipe-kiwi:\n\n  * Add support for oci containers\n  * Avoid needlessly compressing container images\n  * Detect container images based on build result file name\n\n- Fix queryrecipe to use the summary and the description from the main package\n\n- config: Add slfo-main build configuration\n- drop the inner quotes, not needed on bash 4 and breaks on bash 3\n- build: in the ccache case, after test -e also accept -L\n\n- container:\n\n  * Add microdnf package manager support\n  * Add experimental support for the container-timestamp build option\n\n- sbom:\n\n  * allow to create v1 intoto data\n  * spdx: connect OPERATING-SYSTEM package to the root package\n  * Transfer product vcs and disturl\n\n- Support --cms-nocerts and --cms-keyid in the signdummy\n- Support chroot builds inside of containers\n- runservice tool, allow to specify the modes. Can be\n  used on plain git source now also\n- Support --mtime option for cpio creation\n- generate_sbom:\n\n   * Support also unzck compressed repomd files\n   * Fail when given --product directory is missing\n   * support zstd compressed repomd data\n\n- build-vm-lxc: support lxc \u003e= 5\n- vc: Hide an annoying error message when not using NIS\n\n- added leap-16.0 and leap-16.1 build configs.\n  (not named sl16.0 anymore, but using same string as the git branch)\n\n- Implement cmssign support in signdummy\n- pbuild: mark git assets with a fixed commit as immutable\n- mkosi\n  * check if old parameters are supported before passing them\n  * support old bash version\n- Do not crash on small files that start with the PE magic\n\n- Harden export_debian_orig_from_git (CVE-2024-22038, boo#1230469)\n\nChanges in product-composer:\n\nupdate to version 0.9.6:\n\n  * Speed-up reading of rpm headers\n  * Flush output lines to get get correct timestamps in OBS\n\nupdate to version 0.9.5:\n\n  * Be a bit more verbose to track used times per step in OBS\n  * Fix a crash when doing version compare with an epoch\n\nupdate to version 0.9.4:\n\n  * Give an error when trying to add updateinfo meta data\n    without all binary revisions.\n  * Hand over vcs and disturl data to generate_sbom.\n    (We require a recent build package therefore)\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "SUSE-SLE-Micro-Extras-6.2-678",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_21518-1.json"
      },
      {
        "category": "self",
        "summary": "URL for SUSE-SU-2026:21518-1",
        "url": "https://www.suse.com/support/update/announcement/2026/suse-su-202621518-1/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for SUSE-SU-2026:21518-1",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2026-May/025985.html"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1230469",
        "url": "https://bugzilla.suse.com/1230469"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-22038 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-22038/"
      }
    ],
    "title": "Security update for build, product-composer",
    "tracking": {
      "current_release_date": "2026-09-16T19:46:48Z",
      "generator": {
        "date": "2026-05-05T06:49:04Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "SUSE-SU-2026:21518-1",
      "initial_release_date": "2026-05-05T06:49:04Z",
      "revision_history": [
        {
          "date": "2026-05-05T06:49:04Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-16T18:57:17Z",
          "number": "2",
          "summary": "unknown changes"
        },
        {
          "date": "2026-09-16T19:46:48Z",
          "number": "3",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "build-mkbaselibs-20260415-160000.1.1.noarch",
                "product": {
                  "name": "build-mkbaselibs-20260415-160000.1.1.noarch",
                  "product_id": "build-mkbaselibs-20260415-160000.1.1.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/suse/build-mkbaselibs@20260415-160000.1.1?arch=noarch\u0026upstream=build-20260415-160000.1.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "SUSE Linux Micro Extras 6.2",
                "product": {
                  "name": "SUSE Linux Micro Extras 6.2",
                  "product_id": "SUSE Linux Micro Extras 6.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:suse:sl-micro-extras:6.2"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "build-mkbaselibs-20260415-160000.1.1.noarch as component of SUSE Linux Micro Extras 6.2",
          "product_id": "SUSE Linux Micro Extras 6.2:build-mkbaselibs-20260415-160000.1.1.noarch"
        },
        "product_reference": "build-mkbaselibs-20260415-160000.1.1.noarch",
        "relates_to_product_reference": "SUSE Linux Micro Extras 6.2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-22038",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-22038"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Various problems in obs-scm-bridge allows attackers that create specially crafted git repositories to leak information of cause denial of service.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "SUSE Linux Micro Extras 6.2:build-mkbaselibs-20260415-160000.1.1.noarch"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-22038",
          "url": "https://www.suse.com/security/cve/CVE-2024-22038"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1230469 for CVE-2024-22038",
          "url": "https://bugzilla.suse.com/1230469"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "SUSE Linux Micro Extras 6.2:build-mkbaselibs-20260415-160000.1.1.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "SUSE Linux Micro Extras 6.2:build-mkbaselibs-20260415-160000.1.1.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-05-05T06:49:04Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-22038"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.