CVE-2025-3416

A flaw was found in OpenSSL's handling of the properties argument in certain functions. This vulnerability can allow use-after-free exploitation, which may result in undefined behavior or incorrect property parsing, leading to OpenSSL treating the input as an empty string.

rpm-ostree is a hybrid image/package system. It supports "composing" packages on a build server into an OSTree repository, which can then be replicated by client systems with atomic upgrades. Additionally, unlike many "pure" image systems, with rpm-ostree each client system can layer on additional packages, providing a "best of both worlds" approach.

Security Fix(es):

The openssl crate before 0.10.55 for Rust allows an out-of-bounds read via an empty string to X509VerifyParamRef::set_host.(CVE-2023-53159)

Improper Validation of Unsafe Equivalence in punycode by the idna crate from Servo rust-url allows an attacker to create a punycode hostname that one part of a system might treat as distinct while another part of that system would treat as equivalent to another hostname.(CVE-2024-12224)

A flaw was found in OpenSSL's handling of the properties argument in certain functions. This vulnerability can allow use-after-free exploitation, which may result in undefined behavior or incorrect property parsing, leading to OpenSSL treating the input as an empty string.(CVE-2025-3416)

rpm-ostree is a hybrid image/package system. It supports "composing" packages on a build server into an OSTree repository, which can then be replicated by client systems with atomic upgrades. Additionally, unlike many "pure" image systems, with rpm-ostree each client system can layer on additional packages, providing a "best of both worlds" approach.

Security Fix(es):

Improper Validation of Unsafe Equivalence in punycode by the idna crate from Servo rust-url allows an attacker to create a punycode hostname that one part of a system might treat as distinct while another part of that system would treat as equivalent to another hostname.(CVE-2024-12224)

A flaw was found in OpenSSL's handling of the properties argument in certain functions. This vulnerability can allow use-after-free exploitation, which may result in undefined behavior or incorrect property parsing, leading to OpenSSL treating the input as an empty string.(CVE-2025-3416)

rpm-ostree is a hybrid image/package system. It supports "composing" packages on a build server into an OSTree repository, which can then be replicated by client systems with atomic upgrades. Additionally, unlike many "pure" image systems, with rpm-ostree each client system can layer on additional packages, providing a "best of both worlds" approach.

Security Fix(es):

Improper Validation of Unsafe Equivalence in punycode by the idna crate from Servo rust-url allows an attacker to create a punycode hostname that one part of a system might treat as distinct while another part of that system would treat as equivalent to another hostname.(CVE-2024-12224)

A flaw was found in OpenSSL's handling of the properties argument in certain functions. This vulnerability can allow use-after-free exploitation, which may result in undefined behavior or incorrect property parsing, leading to OpenSSL treating the input as an empty string.(CVE-2025-3416)

A flaw was found in OpenSSL's handling of the properties argument in certain functions. This vulnerability can allow use-after-free exploitation, which may result in undefined behavior or incorrect property parsing, leading to OpenSSL treating the input as an empty string.

This update for kanidm fixes the following issues:

• Update to version 1.6.2~git0.a20663ea8:

  • Release 1.6.2
  • fix: clippy
  • maint: typo in log message
  • Set kid manually to prevent divergence
  • Order keys in application JWKS / Fix rotation bug
  • Fix toml issues with strings

• Update to version 1.6.1~git0.2e4429eca:

  • Release 1.6.1
  • Resolve reload of oauth2 on startup (#3604)

• CVE-2025-3416: Fixed openssl use after free (boo#1242642)

• Update to version 1.6.0~git0.d7ae0f336:

  • Release 1.6.0
  • Avoid openssl for md4
  • Fixes #3586, inverts the navbar button color (#3593)
  • Release 1.6.0-pre
  • chore: Release Notes (#3588)
  • Do not require instances to exist during optional config load (#3591)
  • Fix std::fmt::Display for some objects (#3587)
  • Drop fernet in favour of JWE (#3577)
  • docs: document how to configure oauth2 for opkssh (#3566)
  • Add kanidm_ssh_authorizedkeys_direct to client deb (#3585)
  • Bump the all group in /pykanidm with 2 updates (#3581)
  • Update dependencies, fix a bunch of clippy lints (#3576)
  • Support spaces in ssh key comments (#3575)
  • 20250402 3423 proxy protocol (#3542)
  • fix(web): Preserve SSH key content on form validation error (#3574)
  • Bump the all group in /pykanidm with 3 updates (#3572)
  • Bump the all group in /pykanidm with 2 updates (#3564)
  • Bump crossbeam-channel from 0.5.14 to 0.5.15 in the cargo group (#3560)
  • Improve token handling (#3553)
  • Bump tokio from 1.44.1 to 1.44.2 in the cargo group (#3549)
  • Update fs4 and improve klock handling (#3551)
  • Less footguns (#3552)
  • Unify unix config parser (#3533)
  • Bump openssl from 0.10.71 to 0.10.72 in the cargo group (#3544)
  • Bump the all group in /pykanidm with 8 updates (#3547)
  • implement notify-reload protocol (#3540)
  • Allow versioning of server configs (#3515)
  • 20250314 remove protected plugin (#3504)
  • Bump the all group with 10 updates (#3539)
  • Bump mozilla-actions/sccache-action from 0.0.8 to 0.0.9 in the all group (#3538)
  • Bump the all group in /pykanidm with 4 updates (#3537)
  • Add max_ber_size to freeipa sync (#3530)
  • Bump the all group in /pykanidm with 5 updates (#3524)
  • Update Concread
  • Update developer_ethics.md (#3520)
  • Update examples.md (#3519)
  • Make schema indexing a boolean instead of index types (#3517)
  • Add missing lld dependency and fix syntax typo (#3490)
  • Update shell.nix to work with stable nixpkgs (#3514)
  • Improve unixd tasks channel comments (#3510)
  • Update kanidm_ppa_automation reference to latest (#3512)
  • Add set-description to group tooling (#3511)
  • packaging: Add kanidmd deb package, update documentation (#3506)
  • Bump the all group in /pykanidm with 5 updates (#3508)
  • 20250313 unixd system cache (#3501)
  • Support rfc2307 memberUid in sync operations. (#3466)
  • Bump mozilla-actions/sccache-action from 0.0.7 to 0.0.8 in the all group (#3496)
  • Update Traefik config example to remove invalid label (#3500)
  • Add uid/gid allocation table (#3498)
  • 20250225 ldap testing in testkit (#3460)
  • Bump the all group in /pykanidm with 5 updates (#3494)
  • Bump ring from 0.17.10 to 0.17.13 in the cargo group (#3491)
  • Handle form-post as a response mode (#3467)
  • book: fix english (#3487)
  • Correct paths with Kanidm Tools Container (#3486)
  • 20250225 improve test performance (#3459)
  • Bump the all group in /pykanidm with 8 updates (#3484)
  • Use lld by default on linux (#3477)
  • 20250213 patch used wrong acp (#3432)
  • Android support (#3475)
  • Changed all CI/CD builds to locked (#3471)
  • Make it a bit clearer that providers are needed (#3468)
  • Fix incorrect credential generation in radius docs (#3465)
  • Add crypt formats for password import (#3458)
  • build: Create daemon image from scratch (#3452)
  • address webfinger doc feedbacks (#3446)
  • Bump the all group across 1 directory with 5 updates (#3453)
  • [htmx] Admin ui for groups and users management (#3019)…

These are all security issues fixed in the 389-ds-3.1.2~git90.2bc7250be-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the cargo-c-0.10.3~git0.ee7d7ef-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the kanidm-1.6.0~git0.d7ae0f336-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the rustup-1.28.1~0-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the sccache-0.9.1~22-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the tealdeer-1.7.1-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the wasm-bindgen-0.2.97~0-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the ldap-proxy-0.1.0~90-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the sequoia-octopus-librnp-1.11.0-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the afterburn-5.7.0.git103.bae893c-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the s390-tools-2.37.0-4.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the flake-pilot-3.1.19-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the libetebase-devel-0.5.8-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the keylime-ima-policy-0.2.7+117-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the kak-lsp-21.0.2-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the shadowsocks-rust-1.25.0-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the pijul-1.0.0~beta.23-1.1 package on the GA media of openSUSE Tumbleweed.

This update for kak-lsp fixes the following issues:

Changes in kak-lsp:

• Update to version 21.0.2:

  • Fix a regression that broke compatibility with Kakoune versions older than 2026.05.21
  • Add a default configuration for Hare, using hare-lsp
  • Fix hangs after editing a file without a trailing newline, such as an empty file
  • Use nixd instead of nil as the default language server for nix
  • Fix buffer-sync corruption when .editorconfig sets insert_final_newline = false

• Refresh the vendored registry. Recording the state of the open vendored-crate CVEs against it, none of which this package is affected by:

  • CVE-2026-25541 (boo#1274502): bytes is 1.12.1, above the 1.11.1 fix
  • CVE-2025-3416 (boo#1242654): the openssl crate is 0.10.81, above the 0.10.72 fix; it was already 0.10.80 before this update
  • CVE-2025-55159 (boo#1248048): slab is 0.4.12, above the 0.4.11 fix; only 0.4.10 was ever affected and this package never shipped it

• Update to version 20.0.0:

  • v20.0.0
  • Update changelog
  • Fix tinymist documentation URL
  • Fix tinymist preview config key. previewFeature only works for the vscode plugin
  • Encode brackets for file paths
  • feat: swift/sourcekit-lsp support
  • Paal �ye-Str�mme Copyright Waiver
  • Make sure buffer synchronization works even when finaleol is missing
  • workspace/executeCommand: don't panic on invalid args JSON
  • servers.kak: update markdown-oxide root markers
  • Inline lsp-initial-goto-position
  • Fix function_casts_as_integer warning
  • lsp-capabilities: remove stale default mappings
  • changelog new erlang default server
  • fix(ci/commit-new-release.sh): interpolate version number
  • Change default language server for erlang
  • lsp-inlay-hint-apply-*: fix crash when no hints avail
  • Add inlay hint textedit support
  • start new cycle

• Update to version 19.0.1:

  • v19.0.1
  • Don't print Hover: prefix if there are no diagnostics
  • Changelog for regression fix
  • Fix lsp-find-error incorrectly handling --previous flag
  • ci/commit-new-release.sh: support jj
  • start new cycle

• Update to version 18.2.0:

  • v18.2.0
  • Update changelog
  • Remove misleading debug log in SessionRenamed hook
  • Make diagnostics buffer one-line-per diagnostics
  • test/gopls-dynamic-settings.sh: fix for recent gopls
  • clippy
  • controller: consume entire request before checking for user errors
  • Add support vuejs
  • Fix crash on invalid text edit ranges
  • Send initializationOptions and workspace/didChangeConfiguration as expected by jdtls
  • cargo update
  • Fix type inference errors with deranged 0.4.1
  • Fix symbol name prefix for breadcrumbs
  • Work around breaking change in deranged crate
  • Simplify recursive breadcrumbs calculation
  • Language-specific SymbolKind rendering
  • lsp-goto-document-symbol: remove symbol kind suffix
  • start new cycle

• Update to version 18.1.3:

  • v18.1.3
  • Use the right language ID when [language.foo] is in effect
  • Remove unused line-specs option
  • Better variable name for code lens line-specs value
  • lsp-object: don't send documentSymbol to servers that don't support it
  • Include language server name in stderr logs
  • Use rust-analyzer from PATH
  • Work around lsp-rename didChange failing when using window scope
  • Send texlab-specific requests only to servers that support them
  • Fix dart language server command
  • Add kak-lsp server PID to the closing log message
  • Report more diagnostics information, in multiple lines
  • Fix regression causing spurious/missing server name in hover
  • Address clippy lints
  • Config knob to override magic single-instance setting
  • Back out "Add curly underline to DiagnosticError face"
  • start new cycle

• Update to version 18.1.2:

  • Silence errors from non-default hooks
  • Fix languageId for JSX/TSX files
  • Silence deprecation warning
  • Add curly underline to DiagnosticError face

• Update to version 18.1.1: …

This update for forgejo-cli fixes the following issues:

Changes in forgejo-cli:

• Update vendored bytes crate to 1.12.1

  • CVE-2026-25541: Fixed an integer overflow in BytesMut::reserve that could corrupt the tracked capacity and lead to out-of-bounds slices (boo#1274529).

• update to 0.6.0:

  • Localization!
    • forgejo-cli has gained localization support! You can now use it in your preferred language, just like Forgejo itself. Currently de-DE and zh-Hans are included, with several more being in-progress. See the project on Codeberg Translate if you want to help out with any languages you know! https://translate.codeberg.org/projects/forgejo-cli/forgejo-cli/
  • Additions
    • (!586) fj issue/pr view assignees to see who is assigned to an issue or pull request
    • (!582) --avatar/--unset-avatar options on fj repo edit
    • (!554) fj repo star-status to check if you've starred a repo
    • (!547) --cwd option to set the working directory a command is run in
    • (!533, !561) Commands to watch and unwatch repos
    • (!462) Resolve SSH host names from SSH config
    • (!279, !464, !472, !489, !491, !513, !594) Localization
    • Added fj auth login support for the following instances:
      • v16.next.forgejo.org
      • v17.next.forgejo.org
    • Removed fj auth login support for the following instances that have shut down:
      • v7.next.forgejo.org
      • v12.next.forgejo.org
  • Changes
    • (!535) Added an error message when fj auth login fails to open the browser
    • (!523) fj auth add-key was renamed to fj auth add-token. An alias still exists to add-key, so this isn't a breaking change.
    • (!514) The --host flag can now be anywhere in the command, instead of only the beginning
    • (!504) fj auth add-token no longer takes a username argument.
  • Fixes
    • (!579) Fixed fj issue unassign incorrectly unassigning everyone except the intended users
    • (!569) Fixed display of labels failing when a label is marked as exclusive but does not contain a slash
    • (!542) Fixed parsing of SSH shorthand urls
    • (!510) Fixed fj pr checkout failing when the instance URL contained a port
    • (!437) Fixed incorrect parsing of activity info
  • Other
    • (!573) Use rust 2024 edition
    • (!560) Simplify determining repo owner
    • (!531) Fix clippy warnings
    • (!527) Remove unused dependencies, narrow tokio features
    • (!526) Replace crossterm with terminal_size
    • (!520) Optimize cargo release profile
    • (!469) Fix typo
    • (!449) Restricted file permissions at creation time
    • (!443) Add oneline helptext to 'repo migrate' command

• update to 0.5.0:

  • Additions
    • (!334) Support for managing labels on issues and repos.
    • (!349) repo edit and repo units for modifying settings on a repo and repo units.
    • (!373) Use the needed CLI flags for more editors when opening them.
    • (!385) Use the editor defined in git's core.editor config option by default (falling back to $EDITOR if it is not set).
    • (!414) Add commands to assign and unassign users to issues and PRs.
    • (!415) Support all README files in fj repo readme, regardless of case or extension.
    • (!416) Add the option to choose what repo to own the new repo to fj repo migrate.
    • (!419) Show a warning when viewing an archived repo.
    • (!420) Add a notice about git push --force not being supported on AGit PRs.
    • Added fj auth login support for the following instances:
      • v15.next.forgejo.org
      • codefloe.com
  • Fixes
    • (!393) Don't include pull requests in fj issues search.
    • (!407) Guarantee opening the browser in fj auth login doesn't block.
    • (!417) Prevent incorrectly reusing the refresh token when refreshing OAuth tokens.
  • Other
    • (!278) Improved "no repo info" error message.
    • (!403) Build aarch64…

This update for shadowsocks-rust, shadowsocks-libev fixes the following issues:

Changes in shadowsocks-rust:

• Fix SELinux denial (name_connect) when forwarding outbound TCP traffic (boo#1284975)

• Fix: Unable to bind ports below 1024 with SELinux enabled (boo#1284025)

• Update version to 1.25.0

  • Allow chaining ssserver to another SOCKS5/HTTP/HTTPS proxy

  • Expose user_key() on CryptoStream and ProxyServerStream, lets callers identify which multi-user identity was authenticated after an AEAD-2022 handshake

  • EIH (Extended Identity Header) support

  • local-http: Support HTTP Basic auth

  • service: Outbound UDP relay through SOCKS5-only chains. UDP traffic can now be relayed through proxy chains when all hops are SOCKS5. Chains containing HTTP/HTTPS hops will emit a startup warning and UDP traffic will bypass the chain.

  • socket2::Socket with socket2::SockRef

  • Fix bugs

    • CVE-2026-25541 and boo#1274441
    • CVE-2026-93599, CVE-2026-93602, CVE-2026-93601, CVE-2026-93600 and boo#1282208
    • CVE-2026-25541 and boo#1274441

  • Fix some issues (CVE-2025-3416, boo#1242615)

• Update vendor, fix boo#1215658 and CVE-2023-42811

Changes in shadowsocks-libev:

• Fix SELinux denial (name_connect) when forwarding outbound TCP traffic (boo#1284975)

• Fix build for Leap 16.1+: switch BuildRequires from mbedtls-devel to mbedtls-3-devel Tumbleweed, don't do this work on Leap 16

This update for python-maturin fixes the following issues:

• CVE-2025-3416: openssl: use-after-free in Md::fetch and Cipher::fetch when Some(...) value passed as properties argument to either function (bsc#1242631).
• CVE-2025-4574: crossbeam-channel: double-free leading to possible memory corruption in Channel::drop when dropping a channel (bsc#1243177).

This update for s390-tools rebuilds the existing package with the new 4k RSA secure boot key.

Security issues fixed:

• CVE-2025-3416: Fixed Use-After-Free in Md::fetch and Cipher::fetch in rust-openssl crate. (bsc#1242622)

Other issues:

• Added the new IBM z17 (9175) processor type

This update for s390-tools rebuilds the existing package with the new 4k RSA secure boot key.

Security issues fixed:

• CVE-2025-3416: Fixed Use-After-Free in Md::fetch and Cipher::fetch in rust-openssl crate. (bsc#1242622)

Other issues:

• Added the new IBM z17 (9175) processor type

This update for python-cryptography fixes the following issues:

• CVE-2025-3416: openssl: use-after-free in Md::fetch and Cipher::fetch when Some(...) value passed as properties argument to either function (bsc#1242631).

This update for python-cryptography fixes the following issues:

• CVE-2025-3416: openssl: use-after-free in Md::fetch and Cipher::fetch when Some(...) value passed as properties argument to either function (bsc#1242631).

This update for 389-ds fixes the following issues:

Security fixes:

• CVE-2025-3416: Fixed use-After-Free in Md::fetch and Cipher::fetch in rust-openssl crate (bsc#1242666)

Other fixes:

• Enable memory accounting as SUSE disables it by default (bsc#1241016).
• Fix dsidm service get_dn option failing (bsc#1241988)
• Version update 2.2.10~git99.aa5d0ecbf Various fixes and solved issues from github repository

This update for 389-ds fixes the following issues:

Security fixes:

• CVE-2025-3416: Fixed use-After-Free in Md::fetch and Cipher::fetch in rust-openssl crate (bsc#1242666)

Other fixes:

• Enable memory accounting as SUSE disables it by default (bsc#1241016).
• Fix dsidm service get_dn option failing (bsc#1241988)
• Version update 2.2.10~git99.aa5d0ecbf Various fixes and solved issues from github repository

This update for python-cryptography fixes the following issues:

• CVE-2025-3416: openssl: use-after-free in Md::fetch and Cipher::fetch when Some(...) value passed as properties argument to either function (bsc#1242631).

This update for s390-tools fixes the following issues:

Security issues fixed:

• CVE-2025-3416: Fixed Use-After-Free in Md::fetch and Cipher::fetch in rust-openssl crate. (bsc#1242622)

Other issues:

• Added the new IBM z17 (9175) processor type.

This update for himmelblau fixes the following issues:

• CVE-2025-5791: Fixed using deprecated users crate (bsc#1244202)
• CVE-2025-3416: Fixed use-After-Free in Md::fetch and Cipher::fetch in rust-openssl crate (bsc#1242648)

Update to version 0.7.17+git.0.1ebdab0

• Update sccache-action version to use new cache service

This update for rust-keylime fixes the following issues:

• Update to version 0.2.7+141:

  • CVE-2025-58266: shlex: Fixed command injection (bsc#1247193)

• Update to version 0.2.7+117:

  • CVE-2023-26964: rust-keylime: hyper,h2: stream stacking when H2 processing HTTP2 RST_STREAM frames (bsc#1210344).
  • CVE-2024-12224: rust-keylime: idna: idna accepts Punycode labels that do not produce any non-ASCII when decoded (bsc#1243861).
  • CVE-2024-32650: rust-keylime: rust-rustls: Infinite loop in rustls::conn::ConnectionCommon:complete_io() with proper client input (bsc#1223234).
  • CVE-2024-43806: rust-keylime: rustix: rustix::fs::Dir iterator with the linux_raw backend can cause memory explosion (bsc#1229952).
  • CVE-2025-3416: rust-keylime: openssl: Use-After-Free in Md::fetch and Cipher::fetch in rust-openssl crate (bsc#1242623).
  • rust-shlex: Multiple issues involving quote API ( RUSTSEC-2024-0006, GHSA-r7qv-8r2h-pg27, bsc#1230029)

This update for rust-keylime fixes the following issues:

• Update to version 0.2.7+141:

  • CVE-2025-58266: shlex: Fixed command injection (bsc#1247193)

• Update to version 0.2.7+117:

  • CVE-2023-26964: rust-keylime: hyper,h2: stream stacking when H2 processing HTTP2 RST_STREAM frames (bsc#1210344).
  • CVE-2024-12224: rust-keylime: idna: idna accepts Punycode labels that do not produce any non-ASCII when decoded (bsc#1243861).
  • CVE-2024-32650: rust-keylime: rust-rustls: Infinite loop in rustls::conn::ConnectionCommon:complete_io() with proper client input (bsc#1223234).
  • CVE-2024-43806: rust-keylime: rustix: rustix::fs::Dir iterator with the linux_raw backend can cause memory explosion (bsc#1229952).
  • CVE-2025-3416: rust-keylime: openssl: Use-After-Free in Md::fetch and Cipher::fetch in rust-openssl crate (bsc#1242623).
  • rust-shlex: Multiple issues involving quote API ( RUSTSEC-2024-0006, GHSA-r7qv-8r2h-pg27, bsc#1230029)

This update for rust-keylime fixes the following issues:

• Update to version 0.2.7+141:

  • CVE-2025-58266: shlex: Fixed command injection (bsc#1247193)

• Update to version 0.2.7+117:

  • CVE-2023-26964: rust-keylime: hyper,h2: stream stacking when H2 processing HTTP2 RST_STREAM frames (bsc#1210344).
  • CVE-2024-12224: rust-keylime: idna: idna accepts Punycode labels that do not produce any non-ASCII when decoded (bsc#1243861).
  • CVE-2024-32650: rust-keylime: rust-rustls: Infinite loop in rustls::conn::ConnectionCommon:complete_io() with proper client input (bsc#1223234).
  • CVE-2024-43806: rust-keylime: rustix: rustix::fs::Dir iterator with the linux_raw backend can cause memory explosion (bsc#1229952).
  • CVE-2025-3416: rust-keylime: openssl: Use-After-Free in Md::fetch and Cipher::fetch in rust-openssl crate (bsc#1242623).
  • rust-shlex: Multiple issues involving quote API ( RUSTSEC-2024-0006, GHSA-r7qv-8r2h-pg27, bsc#1230029)

This update for 389-ds fixes the following issues:

Update to version 2.0.20~git64.628a24b68:

Security fixes:

• CVE-2025-3416: Fixed openssl use after free (bsc#1242666)

Other fixes:

• resolve infinite loop due when loading RUV entryrdn (bsc#1243428)

Upstream changelog:

• Issue 6119 - Synchronise accept_thread with slapd_daemon (#6120)
• Issue 6825 - RootDN Access Control Plugin with wildcards for IP addre… (#6826)
• Issue 6819 - Incorrect pwdpolicysubentry returned for an entry with user password policy
• Issue 6641 - modrdn fails when a user is member of multiple groups (#6643)
• Issue 6534 - CI fails with Fedora 41 and DNF5
• Revert 'Issue 5120 - ns-slapd doesn't start in referral mode (#6763)'
• Issue 6438 - Add basic dsidm organizational unit tests
• Issue 6439 - Fix dsidm service get_dn option
• Issue 5120 - ns-slapd doesn't start in referral mode (#6763)
• Issue 6740 Certificate verify fails in FIPS mode
• Issue 5356 - Set DEFAULT_PASSWORD_STORAGE_SCHEME to PBKDF2-SHA512 in tests
• Issue 6603 - Release tarballs ship a different Cargo.lock
• Issue 4982 - BUG - missing inttypes.h (#4983)
• Issue 6571 - (2nd) Nested group does not receive memberOf attribute (#6697)
• Issue 6686 - CLI - Re-enabling user accounts that reached inactivity limit fails with error (#6687)
• Issue 6288 - dsidm crash with account policy when alt-state-attr is disabled (#6292)
• Issue 6571 - Nested group does not receive memberOf attribute (#6679)
• Issue 6676 - Add GitHub workflow action and fix pbkdf2 tests (#6677)
• Issue 6155 - ldap-agent fails to start because of permission error (#6179)
• Issue 6632 - Replication init fails with ASAN build
• Issue 6561 - TLS 1.2 stickiness in FIPS mode
• Bump openssl from 0.10.66 to 0.10.70 in /src
• Issue 6004 - (2nd) idletimeout may be ignored (#6569)

This update for rustup fixes the following issues:

• CVE-2024-12224: Fixed improper validation of unsafe equivalence in punycode (bsc#1243862)
• CVE-2025-3416: Fixed use-After-Free in Md::fetch and Cipher::fetch in rust-openssl crate (bsc#1242617)

This update for sevctl fixes the following issues:

• CVE-2024-12224: idna: Fixed improper validation of unsafe equivalence in punycode. (bsc#1243860)
• CVE-2025-3416: openssl: Fixed use-after-free in Md::fetch and Cipher::fetch (bsc#1242618)

This update for sevctl fixes the following issues:

• CVE-2024-12224: idna: Fixed improper validation of unsafe equivalence in punycode. (bsc#1243860)
• CVE-2025-3416: openssl: Fixed use-after-free in Md::fetch and Cipher::fetch (bsc#1242618)

This update for snpguest fixes the following issues:

• CVE-2024-12224: idna: acceptance of Punycode labels that do not produce any non-ASCII output may lead to incorrect hostname comparisons and incorrect URL parsing (bsc#1243869).
• CVE-2025-3416: openssl: use-after-free in Md::fetch and Cipher::fetch when Some(...) value is passed to the properties argument (bsc#1242601).

This update for rustup fixes the following issues:

• CVE-2025-3416: Fixed use-After-Free in Md::fetch and Cipher::fetch in rust-openssl crate (bsc#1242617)

This update for cargo-c fixes the following issues:

• CVE-2025-3416: use-after-free in Md::fetch and Cipher::fetch of rust-openssl crate (bsc#1242675).

This update for s390-tools fixes the following issues:

• CVE-2025-3416: s390-tools: openssl: Fixed Use-After-Free in Md::fetch and Cipher::fetch in rust-openssl crate (bsc#1242622)
• Amended the .spec file
• Updated the '_service' file
• Removed the obsolete file 'cargo_config'
• Updated 'cputype' and 'read_value.c'

• Added the new IBM z17 (9175) processor type

This update for s390-tools fixes the following issues:

• Revendored vendor.tar.zst (CVE-2025-3416: Fixed use-after-free in Md::fetch and Cipher::fetch in rust-openssl crate (bsc#1242622)
• Added the new IBM z17 (9175) processor type

The package is built with the new 4096bit RSA secure boot signing key.