CVE-2023-3978

Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack.

Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack.

Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack.

Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack.

Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack.

Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack.

Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack.

Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack.

Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack.

Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack.

Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack.

Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack.

Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack.

Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack.

Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack.

Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack.

Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack.

CLI and validation tools for Container Runtime Interface

Security Fix(es):

Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack.(CVE-2023-3978)

A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer() to log a single-line payload larger than 64KB without newline characters. Due to limitations in the internal bufio.Scanner, the read fails with "token too long" and the writer pipe is closed, leaving Writer() unusable and causing application unavailability (DoS). This affects versions < 1.8.3, 1.9.0, and 1.9.2. The issue is fixed in 1.8.3, 1.9.1, and 1.9.3+, where the input is chunked and the writer continues to function even if an error is logged.(CVE-2025-65637)

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

• go-yaml: Improve heuristics preventing CPU/memory abuse by parsing malicious or large YAML documents (CVE-2022-3064)

• golang: html/template: improper handling of JavaScript whitespace (CVE-2023-24540)

• net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding (CVE-2022-41723)

• golang: crypto/tls: large handshake records may cause panics (CVE-2022-41724)

• golang: net/http, mime/multipart: denial of service from excessive resource consumption (CVE-2022-41725)

• golang.org/x/net/html: Cross site scripting (CVE-2023-3978)

• golang: net/http, net/textproto: denial of service from excessive memory allocation (CVE-2023-24534)

• golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption (CVE-2023-24536)

• golang: go/parser: Infinite loop in parsing (CVE-2023-24537)

• golang: html/template: backticks not treated as string delimiters (CVE-2023-24538)

• golang: html/template: improper sanitization of CSS values (CVE-2023-24539)

• runc: Rootless runc makes /sys/fs/cgroup writable (CVE-2023-25809)

• runc: volume mount race condition (regression of CVE-2019-19921) (CVE-2023-27561)

• runc: AppArmor can be bypassed when /proc inside the container is symlinked with a specific mount configuration (CVE-2023-28642)

• golang: html/template: improper handling of empty HTML attributes (CVE-2023-29400)

• golang: net/http: insufficient sanitization of Host header (CVE-2023-29406)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.9 Release Notes linked from the References section.

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

• go-yaml: Improve heuristics preventing CPU/memory abuse by parsing malicious or large YAML documents (CVE-2022-3064)

• golang: html/template: improper handling of JavaScript whitespace (CVE-2023-24540)

• net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding (CVE-2022-41723)

• golang: crypto/tls: large handshake records may cause panics (CVE-2022-41724)

• golang: net/http, mime/multipart: denial of service from excessive resource consumption (CVE-2022-41725)

• golang.org/x/net/html: Cross site scripting (CVE-2023-3978)

• golang: net/http, net/textproto: denial of service from excessive memory allocation (CVE-2023-24534)

• golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption (CVE-2023-24536)

• golang: go/parser: Infinite loop in parsing (CVE-2023-24537)

• golang: html/template: backticks not treated as string delimiters (CVE-2023-24538)

• golang: html/template: improper sanitization of CSS values (CVE-2023-24539)

• containerd: Supplementary groups are not set up properly (CVE-2023-25173)

• runc: Rootless runc makes /sys/fs/cgroup writable (CVE-2023-25809)

• runc: volume mount race condition (regression of CVE-2019-19921) (CVE-2023-27561)

• runc: AppArmor can be bypassed when /proc inside the container is symlinked with a specific mount configuration (CVE-2023-28642)

• golang: html/template: improper handling of empty HTML attributes (CVE-2023-29400)

• golang: net/http: insufficient sanitization of Host header (CVE-2023-29406)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.9 Release Notes linked from the References section.

Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack.

The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.

Security Fix(es):

• golang: html/template: improper handling of JavaScript whitespace (CVE-2023-24540)
• net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding (CVE-2022-41723)
• golang: crypto/tls: large handshake records may cause panics (CVE-2022-41724)
• golang: net/http, mime/multipart: denial of service from excessive resource consumption (CVE-2022-41725)
• golang.org/x/net/html: Cross site scripting (CVE-2023-3978)
• golang: net/http, net/textproto: denial of service from excessive memory allocation (CVE-2023-24534)
• golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption (CVE-2023-24536)
• golang: go/parser: Infinite loop in parsing (CVE-2023-24537)
• golang: html/template: backticks not treated as string delimiters (CVE-2023-24538)
• golang: html/template: improper sanitization of CSS values (CVE-2023-24539)
• containerd: Supplementary groups are not set up properly (CVE-2023-25173)
• golang: html/template: improper handling of empty HTML attributes (CVE-2023-29400)
• golang: net/http: insufficient sanitization of Host header (CVE-2023-29406)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

• go-yaml: Improve heuristics preventing CPU/memory abuse by parsing malicious or large YAML documents (CVE-2022-3064)
• golang: html/template: improper handling of JavaScript whitespace (CVE-2023-24540)
• net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding (CVE-2022-41723)
• golang: crypto/tls: large handshake records may cause panics (CVE-2022-41724)
• golang: net/http, mime/multipart: denial of service from excessive resource consumption (CVE-2022-41725)
• golang.org/x/net/html: Cross site scripting (CVE-2023-3978)
• golang: net/http, net/textproto: denial of service from excessive memory allocation (CVE-2023-24534)
• golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption (CVE-2023-24536)
• golang: go/parser: Infinite loop in parsing (CVE-2023-24537)
• golang: html/template: backticks not treated as string delimiters (CVE-2023-24538)
• golang: html/template: improper sanitization of CSS values (CVE-2023-24539)
• runc: Rootless runc makes /sys/fs/cgroup writable (CVE-2023-25809)
• runc: volume mount race condition (regression of CVE-2019-19921) (CVE-2023-27561)
• runc: AppArmor can be bypassed when /proc inside the container is symlinked with a specific mount configuration (CVE-2023-28642)
• golang: html/template: improper handling of empty HTML attributes (CVE-2023-29400)
• golang: net/http: insufficient sanitization of Host header (CVE-2023-29406)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

The container-tools module contains tools for working with containers, notably podman, buildah, skopeo, and runc.

Security Fix(es):

• go-yaml: Improve heuristics preventing CPU/memory abuse by parsing malicious or large YAML documents (CVE-2022-3064)
• golang: html/template: improper handling of JavaScript whitespace (CVE-2023-24540)
• net/http, golang.org/x/net/http2: avoid quadratic complexity in HPACK decoding (CVE-2022-41723)
• golang: crypto/tls: large handshake records may cause panics (CVE-2022-41724)
• golang: net/http, mime/multipart: denial of service from excessive resource consumption (CVE-2022-41725)
• golang.org/x/net/html: Cross site scripting (CVE-2023-3978)
• golang: net/http, net/textproto: denial of service from excessive memory allocation (CVE-2023-24534)
• golang: net/http, net/textproto, mime/multipart: denial of service from excessive resource consumption (CVE-2023-24536)
• golang: go/parser: Infinite loop in parsing (CVE-2023-24537)
• golang: html/template: backticks not treated as string delimiters (CVE-2023-24538)
• golang: html/template: improper sanitization of CSS values (CVE-2023-24539)
• containerd: Supplementary groups are not set up properly (CVE-2023-25173)
• runc: Rootless runc makes /sys/fs/cgroup writable (CVE-2023-25809)
• runc: volume mount race condition (regression of CVE-2019-19921) (CVE-2023-27561)
• runc: AppArmor can be bypassed when /proc inside the container is symlinked with a specific mount configuration (CVE-2023-28642)
• golang: html/template: improper handling of empty HTML attributes (CVE-2023-29400)
• golang: net/http: insufficient sanitization of Host header (CVE-2023-29406)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack.

Text nodes not in the HTML namespace are incorrectly literally rendered, causing text which should be escaped to not be. This could lead to an XSS attack.

These are all security issues fixed in the golang-github-lusitaniae-apache_exporter-1.0.8-1.1 package on the GA media of openSUSE Tumbleweed.

This update fixes the following issues:

golang-github-lusitaniae-apache_exporter was updated from version 1.0.1 to 1.0.8:

• Security issues fixed:

  • CVE-2023-3978: Fixed security bug in x/net dependency in version 1.0.2 (bsc#1213933)

• Bugs fixed:

  • Require Go 1.20 when building for RedHat derivatives

  • Version 1.0.8 (bsc#1227341):

    • Update prometheus/client_golang to version 1.19.1
    • Update x/net to version 0.23.0

  • Version 1.0.7:

    • Update protobuf to version 1.33.0
    • Update prometheus/client_golang to version 1.19.0
    • Update prometheus/common to version 0.46.0
    • Standardize landing page

  • Version 1.0.6:

    • Update prometheus/exporter-toolkit to version 0.11.0
    • Update prometheus/client_golang to version 1.18.0
    • Added User-Agent header

  • Version 1.0.4:

    • Update x/crypto to version 0.17.0
    • Update alecthomas/kingpin/v2 to version 2.4.0
    • Update prometheus/common to version 0.45.0

  • Version 1.0.3:

    • Update prometheus/client_golang to version 1.17.0
    • Update x/net 0.17.0

  • Version 1.0.1:

    • Update prometheus/exporter-toolkit to version 0.10.0
    • Update prometheus/common to version 0.44.0
    • Update prometheus/client_golang to version 1.16.0

scap-security-guide was updated from version 0.1.73 to 0.1.74:

• Version 0.1.74 (jsc#ECO-3319):

  • Added Amazon Linux 2023 product
  • Introduce new remediation type Kickstart
  • Make PAM macros more flexible to variables
  • Remove Debian 10 Product
  • Remove Red Hat Enterprise Linux 7 product
  • Update CIS RHEL9 control file to v2.0.0

spacecmd was updated from version 5.0.9-0 to 5.0.10-0:

• Version 5.0.10-0:

  • Speed up softwarechannel_removepackages (bsc#1227606)
  • Fixed error in 'kickstart_delete' when using wildcards (bsc#1227578)
  • Spacecmd bootstrap now works with specified port (bsc#1229437)
  • Fixed sls backup creation as directory with spacecmd (bsc#1230745)

uyuni-tools was updated from version 0.1.21-0 to 0.1.23-0:

• Version 0.1.23-0:

  • Ensure namespace is defined in all kubernetes commands
  • Use SCC credentials to authenticate against registry.suse.com for kubernetes (bsc#1231157)
  • Fixed namespace usage on mgrctl cp command

• Version 0.1.22-0:

  • Set projectId also for test packages/images
  • mgradm migration should not pull Confidential Computing and Hub image is replicas == 0 (bsc#1229432, bsc#1230136)
  • Do not allow SUSE Manager downgrade
  • Prevent completion issue when /var/log/uyuni-tools.log is missing
  • Fixed proxy shared volume flag
  • During migration, exclude mgr-sync configuration file (bsc#1228685)
  • Migrate from PostgreSQL 14 to PostgreSQL 16 pg_hba.conf and postgresql.conf files (bsc#1231206)
  • During migration, handle empty autoinstallation path (bsc#1230285)
  • During migration, handle symlinks (bsc#1230288)
  • During migration, trust the remote sender's file list (bsc#1228424)
  • Use SCC flags during podman pull
  • Restore SELinux permission after migration (bsc#1229501)
  • Share volumes between containers (bsc#1223142)
  • Save supportconfig in current directory (bsc#1226759)
  • Fixed error code handling on reinstallation (bsc#1230139)
  • Fixed creation of first user and organization
  • Added missing variable quotes for install vars (bsc#1229108)
  • Added API login and logout calls to allow persistent login

This update fixes the following issues:

golang-github-lusitaniae-apache_exporter:

• Security issues fixed:

  • CVE-2023-3978: Fixed security bug in x/net dependency (bsc#1213933)

• Other changes and issues fixed:

  • Delete unpackaged debug files for RHEL
  • Do not include source files in the package for RHEL 9
  • Require Go 1.20 when building for RedHat derivatives
  • Drop EnvironmentFile from the service definition
  • Explicitly unset $ARGS environment variable. Setting environment variables should be done in drop-in systemd configuration files.
  • Drop go_nostrip macro. It is not needed with current binutils and Go.
  • Migrate from disabled to manual source service type
  • Drop BuildRequires: golang-packaging
  • Upgrade to version 1.0.8 (bsc#1227341)
    • Update prometheus/client_golang to version 1.19.1
    • Update x/net to version 0.23.0
  • Upgrade to version 1.0.7
    • Update protobuf to version 1.33.0
    • Update prometheus/client_golang to version 1.19.0
    • Update prometheus/common to version 0.46.0
    • Standardize landing page
  • Upgrade to version 1.0.6
    • Update prometheus/exporter-toolkit to version 0.11.0
    • Update prometheus/client_golang to version 1.18.0
    • Add User-Agent header
  • Upgrade to version 1.0.4
    • Update x/crypto to version 0.17.0
    • Update alecthomas/kingpin/v2 to version 2.4.0
    • Update prometheus/common to version 0.45.0
  • Upgrade to version 1.0.3
    • Update prometheus/client_golang to version 1.17.0
    • Update x/net 0.17.0
  • Upgrade to version 1.0.1
    • Update prometheus/exporter-toolkit to version 0.10.0
    • Update prometheus/common to version 0.44.0
    • Update prometheus/client_golang to version 1.16.0

golang-github-prometheus-promu:

• Require Go >= 1.21 for building
• Packaging improvements:
  • Drop export CGO_ENABLED='0'. Use the default unless there is a defined requirement or benefit (bsc#1230623).
• Update to version 0.16.0:
  • Do not discover user/host for reproducible builds
  • Fix example/prometheus build error
• Update to version 0.15.0:
  • Add linux/riscv64 to default platforms
  • Use yaml.Unmarshalstrict to validate configuration files

spacecmd:

• Version 5.0.10-0
  • Speed up softwarechannel_removepackages (bsc#1227606)
  • Fix error in 'kickstart_delete' when using wildcards (bsc#1227578)
  • Spacecmd bootstrap now works with specified port (bsc#1229437)
  • Fix sls backup creation as directory with spacecmd (bsc#1230745)

uyuni-common-libs:

• Version 5.0.5-0
  • Enforce directory permissions at repo-sync when creating directories (bsc#1229260)

uyuni-tools:

• Version 0.1.23-0
  • Ensure namespace is defined in all kubernetes commands
  • Use SCC credentials to authenticate against registry.suse.com for kubernetes (bsc#1231157)
  • Fix namespace usage on mgrctl cp command
• Version 0.1.22-0
  • Set projectId also for test packages/images
  • mgradm migration should not pull Confidential Computing and Hub image is replicas == 0 (bsc#1229432, bsc#1230136)
  • Do not allow SUSE Manager downgrade
  • Prevent completion issue when /var/log/uyuni-tools.log is missing
  • Fix proxy shared volume flag
  • During migration, exclude mgr-sync configuration file (bsc#1228685)
  • Migrate from PostgreSQL 14 to PostgreSQL 16 pg_hba.conf and postgresql.conf files (bsc#1231206)
  • During migration, handle empty autoinstallation path (bsc#1230285)
  • During migration, handle symlinks (bsc#1230288)
  • During migration, trust the remote sender's file list (bsc#1228424)
  • Use SCC flags during podman pull
  • Restore SELinux permission after migration (bsc#1229501)
  • Share volumes between containers (bsc#1223142)
  • Save supportconfig in current directory (bsc#1226759)
  • Fix error code handling on reinstallation (bsc#1230139)
  • Fix creating first user and organization
  • Add missing variable quotes for install vars (bsc#1229108)
  • Add API login and logout calls to allow persistent…

This update fixes the following issues:

golang-github-lusitaniae-apache_exporter:

• Security issues fixed:

  • CVE-2023-3978: Fixed security bug in x/net dependency (bsc#1213933)

• Other changes and issues fixed:

  • Delete unpackaged debug files for RHEL
  • Do not include source files in the package for RHEL 9
  • Require Go 1.20 when building for RedHat derivatives
  • Drop EnvironmentFile from the service definition
  • Explicitly unset $ARGS environment variable. Setting environment variables should be done in drop-in systemd configuration files.
  • Drop go_nostrip macro. It is not needed with current binutils and Go.
  • Migrate from disabled to manual source service type
  • Drop BuildRequires: golang-packaging
  • Upgrade to version 1.0.8 (bsc#1227341)
    • Update prometheus/client_golang to version 1.19.1
    • Update x/net to version 0.23.0
  • Upgrade to version 1.0.7
    • Update protobuf to version 1.33.0
    • Update prometheus/client_golang to version 1.19.0
    • Update prometheus/common to version 0.46.0
    • Standardize landing page
  • Upgrade to version 1.0.6
    • Update prometheus/exporter-toolkit to version 0.11.0
    • Update prometheus/client_golang to version 1.18.0
    • Add User-Agent header
  • Upgrade to version 1.0.4
    • Update x/crypto to version 0.17.0
    • Update alecthomas/kingpin/v2 to version 2.4.0
    • Update prometheus/common to version 0.45.0
  • Upgrade to version 1.0.3
    • Update prometheus/client_golang to version 1.17.0
    • Update x/net 0.17.0
  • Upgrade to version 1.0.1
    • Update prometheus/exporter-toolkit to version 0.10.0
    • Update prometheus/common to version 0.44.0
    • Update prometheus/client_golang to version 1.16.0

golang-github-prometheus-promu:

• Require Go >= 1.21 for building
• Packaging improvements:
  • Drop export CGO_ENABLED='0'. Use the default unless there is a defined requirement or benefit (bsc#1230623).
• Update to version 0.16.0:
  • Do not discover user/host for reproducible builds
  • Fix example/prometheus build error
• Update to version 0.15.0:
  • Add linux/riscv64 to default platforms
  • Use yaml.Unmarshalstrict to validate configuration files

spacecmd:

• Version 5.0.10-0
  • Speed up softwarechannel_removepackages (bsc#1227606)
  • Fix error in 'kickstart_delete' when using wildcards (bsc#1227578)
  • Spacecmd bootstrap now works with specified port (bsc#1229437)
  • Fix sls backup creation as directory with spacecmd (bsc#1230745)

uyuni-common-libs:

• Version 5.0.5-0
  • Enforce directory permissions at repo-sync when creating directories (bsc#1229260)

uyuni-tools:

• version 0.1.23-0
  • Ensure namespace is defined in all kubernetes commands
  • Use SCC credentials to authenticate against registry.suse.com for kubernetes (bsc#1231157)
  • Fix namespace usage on mgrctl cp command
• version 0.1.22-0
  • Set projectId also for test packages/images
  • mgradm migration should not pull Confidential Computing and Hub image is replicas == 0 (bsc#1229432, bsc#1230136)
  • Do not allow SUSE Manager downgrade
  • Prevent completion issue when /var/log/uyuni-tools.log is missing
  • Fix proxy shared volume flag
  • During migration, exclude mgr-sync configuration file (bsc#1228685)
  • Migrate from PostgreSQL 14 to PostgreSQL 16 pg_hba.conf and postgresql.conf files (bsc#1231206)
  • During migration, handle empty autoinstallation path (bsc#1230285)
  • During migration, handle symlinks (bsc#1230288)
  • During migration, trust the remote sender's file list (bsc#1228424)
  • Use SCC flags during podman pull
  • Restore SELinux permission after migration (bsc#1229501)
  • Share volumes between containers (bsc#1223142)
  • Save supportconfig in current directory (bsc#1226759)
  • Fix error code handling on reinstallation (bsc#1230139)
  • Fix creating first user and organization
  • Add missing variable quotes for install vars (bsc#1229108)
  • Add API login and logout calls to allow persistent…

This update fixes the following issues:

golang-github-lusitaniae-apache_exporter was updated from version 1.0.1 to 1.0.8:

• Security issues fixed:

  • CVE-2023-3978: Fixed security bug in x/net dependency in version 1.0.2 (bsc#1213933)

• Bugs fixed:

  • Require Go 1.20 when building for RedHat derivatives

  • Version 1.0.8 (bsc#1227341):

    • Update prometheus/client_golang to version 1.19.1
    • Update x/net to version 0.23.0

  • Version 1.0.7:

    • Update protobuf to version 1.33.0
    • Update prometheus/client_golang to version 1.19.0
    • Update prometheus/common to version 0.46.0
    • Standardize landing page

  • Version 1.0.6:

    • Update prometheus/exporter-toolkit to version 0.11.0
    • Update prometheus/client_golang to version 1.18.0
    • Added User-Agent header

  • Version 1.0.4:

    • Update x/crypto to version 0.17.0
    • Update alecthomas/kingpin/v2 to version 2.4.0
    • Update prometheus/common to version 0.45.0

  • Version 1.0.3:

    • Update prometheus/client_golang to version 1.17.0
    • Update x/net 0.17.0

  • Version 1.0.1:

    • Update prometheus/exporter-toolkit to version 0.10.0
    • Update prometheus/common to version 0.44.0
    • Update prometheus/client_golang to version 1.16.0

scap-security-guide was updated from version 0.1.73 to 0.1.74:

• Version 0.1.74 (jsc#ECO-3319):

  • Added Amazon Linux 2023 product
  • Introduce new remediation type Kickstart
  • Make PAM macros more flexible to variables
  • Remove Debian 10 Product
  • Remove Red Hat Enterprise Linux 7 product
  • Update CIS RHEL9 control file to v2.0.0

spacecmd was updated from version 5.0.9-0 to 5.0.10-0:

• Version 5.0.10-0:

  • Speed up softwarechannel_removepackages (bsc#1227606)
  • Fixed error in 'kickstart_delete' when using wildcards (bsc#1227578)
  • Spacecmd bootstrap now works with specified port (bsc#1229437)
  • Fixed sls backup creation as directory with spacecmd (bsc#1230745)

uyuni-tools was updated from version 0.1.21-0 to 0.1.23-0:

• Version 0.1.23-0:

  • Ensure namespace is defined in all kubernetes commands
  • Use SCC credentials to authenticate against registry.suse.com for kubernetes (bsc#1231157)
  • Fixed namespace usage on mgrctl cp command

• Version 0.1.22-0:

  • Set projectId also for test packages/images
  • mgradm migration should not pull Confidential Computing and Hub image is replicas == 0 (bsc#1229432, bsc#1230136)
  • Do not allow SUSE Manager downgrade
  • Prevent completion issue when /var/log/uyuni-tools.log is missing
  • Fixed proxy shared volume flag
  • During migration, exclude mgr-sync configuration file (bsc#1228685)
  • Migrate from PostgreSQL 14 to PostgreSQL 16 pg_hba.conf and postgresql.conf files (bsc#1231206)
  • During migration, handle empty autoinstallation path (bsc#1230285)
  • During migration, handle symlinks (bsc#1230288)
  • During migration, trust the remote sender's file list (bsc#1228424)
  • Use SCC flags during podman pull
  • Restore SELinux permission after migration (bsc#1229501)
  • Share volumes between containers (bsc#1223142)
  • Save supportconfig in current directory (bsc#1226759)
  • Fixed error code handling on reinstallation (bsc#1230139)
  • Fixed creation of first user and organization
  • Added missing variable quotes for install vars (bsc#1229108)
  • Added API login and logout calls to allow persistent login

Bahruz Jabiyev, Tommaso Innocenti, Anthony Gavazzi, Steven Sprecher, and Kaan Onarlioglu discovered that servers using Go Networking could hang during shutdown if preempted by a fatal error. An attacker could possibly use this to cause a denial of service. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-27664)

Arpad Ryszka and Jakob Ackermann discovered that a maliciously crafted stream could cause excessive CPU usage in Go Networking's HPACK decoder. An attacker could possibly use this to cause a denial of service. This issue only affected Ubuntu 22.04 LTS. (CVE-2022-41723)

Mohammad Thoriq Aziz discovered that Go Networking did not properly sanitize some text nodes. An attacker could possibly use this to execute arbitrary code. This issue only affected Ubuntu 22.04 LTS. (CVE-2023-3978)

Sean Ng discovered an error in Go Networking's HTML tag handling. An attacker could possibly use this to cause a denial of service. (CVE-2025-22872)

Guido Vranken and Jakub Ciolek discovered that a maliciously crafted HTML document could exhaust system resources on servers using Go Networking. An attacker could possibly use this to cause a denial of service. (CVE-2025-47911)

Guido Vranken discovered that a maliciously crafted HTML document could put servers using Go Networking into an infinite loop. An attacker could possibly use this to cause a denial of service. (CVE-2025-58190)

It was discovered that Go Networking did not properly handle server errors after sending a GOAWAY frame during HTTP/2 connection shutdown, which could cause the connection to hang. A remote attacker could possibly use this issue to cause a denial of service. (CVE-2022-27664)

It was discovered that Go Networking had quadratic complexity when decoding HPACK headers in HTTP/2 streams. A remote attacker could possibly use this issue to cause Go Networking to use excessive resources, leading to a denial of service. (CVE-2022-41723)

It was discovered that Go Networking incorrectly rendered text nodes outside of the HTML namespace literally, causing text that should be escaped to not be escaped. A remote attacker could possibly use this issue to perform cross-site scripting attacks. (CVE-2023-3978)

Guido Vranken discovered that Go Networking processed certain inputs to the HTML parsing functions non-linearly with respect to their length. A remote attacker could possibly use this issue to cause Go Networking to use excessive resources, leading to a denial of service. (CVE-2024-45338)

Sean Ng discovered that Go Networking incorrectly interpreted tags in foreign content with unquoted attribute values ending with a solidus character as self-closing, which could result in content being placed in the wrong scope during DOM construction. A remote attacker could possibly use this issue to perform cross-site scripting attacks. (CVE-2025-22872)

It was discovered that Go Networking had quadratic parsing complexity when processing certain HTML inputs. A remote attacker could possibly use this issue to cause Go Networking to use excessive resources, leading to a denial of service. (CVE-2025-47911)

It was discovered that Go Networking could enter an infinite loop when parsing certain HTML inputs. A remote attacker could possibly use this issue to cause Go Networking to use excessive resources, leading to a denial of service. (CVE-2025-58190)

It was discovered that Go Networking incorrectly accepted Punycode-encoded labels that decoded to ASCII-only labels when processing internationalized domain names. A remote attacker could possibly use this issue to bypass access control restrictions and escalate privileges. (CVE-2026-39821)