CVE-2025-58160

Impact

Previous versions of tracing-subscriber were vulnerable to ANSI escape sequence injection attacks. Untrusted user input containing ANSI escape sequences could be injected into terminal output when logged, potentially allowing attackers to:

• Manipulate terminal title bars
• Clear screens or modify terminal display
• Potentially mislead users through terminal manipulation

In isolation, impact is minimal, however security issues have been found in terminal emulators that enabled an attacker to use ANSI escape sequences via logs to exploit vulnerabilities in the terminal emulator.

Patches

tracing-subscriber version 0.3.20 fixes this vulnerability by escaping ANSI control characters in when writing events to destinations that may be printed to the terminal.

Workarounds

Avoid printing logs to terminal emulators without escaping ANSI control sequences.

References

https://www.packetlabs.net/posts/weaponizing-ansi-escape-sequences/

Acknowledgments

We would like to thank zefr0x who responsibly reported the issue at [email protected].

If you believe you have found a security vulnerability in any tokio-rs project, please email us at [email protected].

tracing is a framework for instrumenting Rust programs to collect structured, event-based diagnostic information. Prior to version 0.3.20, tracing-subscriber was vulnerable to ANSI escape sequence injection attacks. Untrusted user input containing ANSI escape sequences could be injected into terminal output when logged, potentially allowing attackers to manipulate terminal title bars, clear screens or modify terminal display, and potentially mislead users through terminal manipulation. tracing-subscriber version 0.3.20 fixes this vulnerability by escaping ANSI control characters when writing events to destinations that may be printed to the terminal. A workaround involves avoiding printing logs to terminal emulators without escaping ANSI control sequences.

tracing is a framework for instrumenting Rust programs to collect structured, event-based diagnostic information. Prior to version 0.3.20, tracing-subscriber was vulnerable to ANSI escape sequence injection attacks. Untrusted user input containing ANSI escape sequences could be injected into terminal output when logged, potentially allowing attackers to manipulate terminal title bars, clear screens or modify terminal display, and potentially mislead users through terminal manipulation. tracing-subscriber version 0.3.20 fixes this vulnerability by escaping ANSI control characters when writing events to destinations that may be printed to the terminal. A workaround involves avoiding printing logs to terminal emulators without escaping ANSI control sequences.

tracing is a framework for instrumenting Rust programs to collect structured, event-based diagnostic information. Prior to version 0.3.20, tracing-subscriber was vulnerable to ANSI escape sequence injection attacks. Untrusted user input containing ANSI escape sequences could be injected into terminal output when logged, potentially allowing attackers to manipulate terminal title bars, clear screens or modify terminal display, and potentially mislead users through terminal manipulation. tracing-subscriber version 0.3.20 fixes this vulnerability by escaping ANSI control characters when writing events to destinations that may be printed to the terminal. A workaround involves avoiding printing logs to terminal emulators without escaping ANSI control sequences.

tracing is a framework for instrumenting Rust programs to collect structured, event-based diagnostic information. Prior to version 0.3.20, tracing-subscriber was vulnerable to ANSI escape sequence injection attacks. Untrusted user input containing ANSI escape sequences could be injected into terminal output when logged, potentially allowing attackers to manipulate terminal title bars, clear screens or modify terminal display, and potentially mislead users through terminal manipulation. tracing-subscriber version 0.3.20 fixes this vulnerability by escaping ANSI control characters when writing events to destinations that may be printed to the terminal. A workaround involves avoiding printing logs to terminal emulators without escaping ANSI control sequences.

tracing is a framework for instrumenting Rust programs to collect structured, event-based diagnostic information. Prior to version 0.3.20, tracing-subscriber was vulnerable to ANSI escape sequence injection attacks. Untrusted user input containing ANSI escape sequences could be injected into terminal output when logged, potentially allowing attackers to manipulate terminal title bars, clear screens or modify terminal display, and potentially mislead users through terminal manipulation. tracing-subscriber version 0.3.20 fixes this vulnerability by escaping ANSI control characters when writing events to destinations that may be printed to the terminal. A workaround involves avoiding printing logs to terminal emulators without escaping ANSI control sequences.

tracing is a framework for instrumenting Rust programs to collect structured, event-based diagnostic information. Prior to version 0.3.20, tracing-subscriber was vulnerable to ANSI escape sequence injection attacks. Untrusted user input containing ANSI escape sequences could be injected into terminal output when logged, potentially allowing attackers to manipulate terminal title bars, clear screens or modify terminal display, and potentially mislead users through terminal manipulation. tracing-subscriber version 0.3.20 fixes this vulnerability by escaping ANSI control characters when writing events to destinations that may be printed to the terminal. A workaround involves avoiding printing logs to terminal emulators without escaping ANSI control sequences.

tracing is a framework for instrumenting Rust programs to collect structured, event-based diagnostic information. Prior to version 0.3.20, tracing-subscriber was vulnerable to ANSI escape sequence injection attacks. Untrusted user input containing ANSI escape sequences could be injected into terminal output when logged, potentially allowing attackers to manipulate terminal title bars, clear screens or modify terminal display, and potentially mislead users through terminal manipulation. tracing-subscriber version 0.3.20 fixes this vulnerability by escaping ANSI control characters when writing events to destinations that may be printed to the terminal. A workaround involves avoiding printing logs to terminal emulators without escaping ANSI control sequences.

tracing is a framework for instrumenting Rust programs to collect structured, event-based diagnostic information. Prior to version 0.3.20, tracing-subscriber was vulnerable to ANSI escape sequence injection attacks. Untrusted user input containing ANSI escape sequences could be injected into terminal output when logged, potentially allowing attackers to manipulate terminal title bars, clear screens or modify terminal display, and potentially mislead users through terminal manipulation. tracing-subscriber version 0.3.20 fixes this vulnerability by escaping ANSI control characters when writing events to destinations that may be printed to the terminal. A workaround involves avoiding printing logs to terminal emulators without escaping ANSI control sequences.

tracing is a framework for instrumenting Rust programs to collect structured, event-based diagnostic information. Prior to version 0.3.20, tracing-subscriber was vulnerable to ANSI escape sequence injection attacks. Untrusted user input containing ANSI escape sequences could be injected into terminal output when logged, potentially allowing attackers to manipulate terminal title bars, clear screens or modify terminal display, and potentially mislead users through terminal manipulation. tracing-subscriber version 0.3.20 fixes this vulnerability by escaping ANSI control characters when writing events to destinations that may be printed to the terminal. A workaround involves avoiding printing logs to terminal emulators without escaping ANSI control sequences.

This update for himmelblau fixes the following issues:

Update to himmelblau 2.3.8 (jsc#PED-14511):

Security issues:

• CVE-2025-54882: world readable cloud TGT token (bsc#1247735).
• CVE-2025-58160: tracing-subscriber: Tracing log pollution (bsc#1249013).
• CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion (bsc#1257904).
• CVE-2026-31979: race condition when accessiung /tmp/krb5cc_<uid> (bsc#1259548).

Non security issues:

• Fix SELinux module packaging to use standard policy macros (bsc#1258236).

Changelog:

Version 2.3.8:

• Add PrivateTmp back to Tasks Daemon
• Drop dead code
• Drop krb5 ccache dir code
• Add a TODO comment
• Drop non working packaged krb5 snippet file
• Write kerberos config snippet
• Extend resolver interface to return kerberos config together with TGTs
• Backport SELinux fixes from main
• Use libkrimes to store TGTs

Version 2.3.7:

• cargo vet
• Fix AWS-LC has PKCS7_verify Certificate Chain Validation Bypass
• Revert dependency change which broke the nightly build
• gen_dockerfiles: only himmelblaud has tpm feature, fix all others
• fix(build): gen_dockerfiles.py mutates shared features list mid-loop

Version 2.3.5:

• Better handle Intune API version
• Update make vet from main branch
• pam_himmelblau: call split_username once in chauthtok
• pam_himmelblau: return PAM_IGNORE in chauthtok for local users
• Don't attempt a DAG when Hello fails with SSPR demand

Version 2.3.4:

• deps(rust): bump the all-cargo-updates group across 1 directory with 8 updates
• Revert sketching update (which breaks SLE16 build)

Version 2.3.3:

• /var/cache/private/himmelblaud should not be created tmpfiles
• Updatee python vers for dataclasses dep
• deps(rust): bump the all-cargo-updates group across 1 directory with 3 updates
• Generate pin init service file systemd < 250
• Checkin missing himmelblaud.if file for SELinux
• Resolve typos in selinux package commands

Version 2.3.2:

• Compile SELinux policy at install time for cross-distro compatibility
• Improve PAM configuration on openSUSE/SLE
• Fix SELinux policy
• Add a git hook to ensure selinux policy is tested
• Ignore generated himmelblau-hsm-pin-init service file
• Refactor SELinux policy for cross-distro compatibility
• Fix NSS lookup for mapped local users
• Skip OS version compliance checks when min/max values are empty

Version 2.3.1:

• Remove references to qrcodegen (these are 3.x features)
• QR Greeter compatibility for old GNOME
• Enable QR greeter automatically
• ci: Use latest cargo-vet from git to fix CI
• Fix HSM pin migration failure on Debian/Ubuntu upgrades from v1.4.x

Version 2.3.0:

• Autostart the daemons on fresh install or upgrade
• Restart sshd when installing the ssh config
• Allow tasks daemon to write krb ccache
• Do not enumerate mapped users in NSS
• Update libhimmelblau to latest version
• Fix Tumbleweed build

Version 2.2.0:

• Update libhimmelblau to 0.8.x series
• deps(rust): bump the all-cargo-updates group with 17 updates
• Only use OpenSSH bug workaround for ssh service
• Fix debug noise from removing user from sudo group
• systemd: install files to /usr/lib/, not /etc/

Version 2.1.0:

• Fix nightly authselect build failure
• Generate the authselect profiles for each distro
• Improve pam config handling in aad-tool
• Make aad-tool configure-pam detect location of pam files

Version 2.0.5:

• /var/lib/private/himmelblaud should be owned by root
• Use tmpfiles.d to create himmelblaud private data directory
• deps(rust): bump the all-cargo-updates group with 13 updates

Version 2.0.4:

• Update kanidm_build_profiles mask version

• Utilize cargo vet from main

• Add policies cache patch via systemd-tmpfiles

• Fix man page comments about change idmap_range

• Stub picky-krb for osc build

• Stub a kanidm_build_profiles which builds in osc

• Ensure nss cache is created on Ubuntu/Debian

• Request a user…

These are all security issues fixed in the bpftop-0.7.1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python311-uv-0.8.14-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the himmelblau-1.2.2+git.0.2d04bca-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python311-maturin-1.9.4-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the python311-ruff-0.12.11-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the rustup-1.28.2~0-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the cargo-audit-0.21.2~git0.18e58c2-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the cargo-c-0.10.3~git0.ee7d7ef-4.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the cargo-packaging-1.3.0+0-2.1 package on the GA media of openSUSE Tumbleweed.

This update for himmelblau fixes the following issues:

• Update to version 0.9.23+git.0.9776141:
  • CVE-2025-59044: Fixed GID collision of same-name groups allowing privilege escalation (bsc#1250687)
  • deps(rust): bump the all-cargo-updates group
  • CVE-2025-58160: tracing-subscriber: Fixed log pollution (bsc#1249013)

This update for himmelblau fixes the following issues:

• Update to version 0.9.23+git.0.9776141:
  • CVE-2025-59044: Fixed GID collision of same-name groups allowing privilege escalation (bsc#1250687)
  • deps(rust): bump the all-cargo-updates group
  • CVE-2025-58160: tracing-subscriber: Fixed log pollution (bsc#1249013)

These are all security issues fixed in the librav1e0_8-0.8.1-2.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the agama-24+0.a836cced5-54.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the mdbook-0.5.4-1.1 package on the GA media of openSUSE Tumbleweed.

This update for python-uv fixes the following issues:

• CVE-2025-62518: astral-tokio-tar: Fixed boundary parsing issue allowing attackers to smuggle additional archive entries (bsc#1252399)
• CVE-2025-58160: tracing-subscriber: Fixed log pollution (bsc#1249011)

This update for cargo-c fixes the following issues:

• CVE-2025-4574: crossbeam-channel: Fixed double-free on drop in Channel::discard_all_messages (bsc#1243179)
• CVE-2025-58160: tracing-subscriber: Fixed log pollution (bsc#1249012)
• CVE-2024-12224: idna: Fixed improper validation of Punycode labels (bsc#1243851)

Other fixes:

• Fixed _service file to have proper versioning
• Update to version 0.10.15~git0.3e178d5:
  • Bump actions/download-artifact from 4 to 5
  • Update implib requirement from 0.3.5 to 0.4.0
  • Add rlib to the targets when building tests
  • Allow disabling emission of library version constants in header files
  • Bump to cargo 0.90
  • Fix static_libraries swallowing sequence of -framework flags
  • Fix non-POSIX paths in Libdir under Windows
  • Bump actions-rs-plus/clippy-check from 2.2.1 to 2.3.0
  • Fix clippy lints
  • Bump cargo-0.89, object-0.37.1, cbindgen-0.29

This update for python-maturin fixes the following issues:

• CVE-2025-58160: tracing-subscriber: Fixed log pollution (bsc#1249011)

This update for loupe fixes the following issue

• CVE-2025-58160: tracing-subscriber: untrusted input containing ANSI escape sequences can lead to terminal manipulation (bsc#1249009).

Changes for loupe:

• Update to version 48.2:

• Check if the is-hidden property is available before reading it.

• Considerably increased speed for listing other images in folders, especially for remote locations. This allows for switching to other images to become available much quicker.

• Fix panics, probably occuring when using an action like 'copy', and then closing the window. The crash causes all other windows to close.

• The creation date for images that don't provide a timezone was displayed as if the recorded date and time was in UTC.

• Zooming in would not work via the zoom menu, if the resulting zoom state would still fit the image inside the window.

• Update to version 48.1:

• Crash when closing the window, probably in the exact moment when the animnation for hiding controls starts.

• Editing does not work correctly if PNGs or JPEGs are already rotated via an Exif orientation entry before editing.

• Printed pages don't contain anything or garbled output. This is a temporary workaround for https://gitlab.gnome.org/GNOME/gtk/-/issues/7464, using the cairo renderer for the rotation and scaling of the image in the print preparation.

This update for glycin-loaders fixes the following issues

• CVE-2025-55159: slab: incorrect bounds check in get_disjoint_mut function can lead to undefined behavior or potential crash due to out-of-bounds access (bsc#1248035).
• CVE-2025-58160: tracing-subscriber: Tracing log pollution (bsc#1249010).

This update for rav1e fixes the following issue:

• CVE-2025-58160: tracing-subscriber: untrusted log input can allow ANSI escape sequence injection and terminal manipulation (bsc#1249016).

Changes for rav1e:

• Update cargo dependencies.

This update for gstreamer-devtools fixes the following issues:

• CVE-2025-4574: crossbeam-channel: internal Channel type's Drop method has a race condition that can lead to a double-free and memory corruption (bsc#1243178).
• CVE-2025-58160: tracing-subscriber: untrusted user input containing ANSI escape sequences can be injected into terminal output when logged and lead to terminal manipulation (bsc#1249015).
• CVE-2026-25541: bytes: integer overflow in BytesMut:reserve can lead to undefined behavior and crashes (bsc#1274306).
• CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion (bsc#1257914).
• CVE-2026-72813: actix-files: empty Range header in GET requests for static files can lead to a process crash (bsc#1275210).
• CVE-2026-72814: actix-files: non-existing folders passed as an argument to the actix_files::Files::new() method can lead to information disclosure (bsc#1275209).

This update for python-ruff fixes the following issue:

• CVE-2025-58160: tracing-subscriber: untrusted user input containing ANSI escape sequences can be injected into terminal output after being logged (bsc#1249011).

This update for rustup fixes the following issues:

• CVE-2024-12224: idna: idna accepts Punycode labels that do not produce any non-ASCII when decoded (bsc#1243862).
• CVE-2025-58160: tracing-subscriber: Tracing log pollution (bsc#1249008).
• CVE-2026-25541: bytes: integer overflow in 'BytesMut:reserve' can lead to undefined behavior and crashes (bsc#1274144).
• CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion (bsc#1257902).
• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270186).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length in rust- openssl crate (bsc#1270619).
• CVE-2026-41678: openssl: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270644).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check in rust-openssl crate (bsc#1270795).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory in rust-openssl crate (bsc#1270870).
• CVE-2026-42327: openssl: arbitrary code execution via specially crafted certificate in rust-openssl crate (bsc#1270521).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-openssl crate (bsc#1270874).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers in rust- openssl crate (bsc#1270989).
• CVE-2026-93599: rustls-webpki: panic via empty BIT STRING (bsc#1282217).
• CVE-2026-93600: rustls-webpki: name constraints URI validation bypass (bsc#1282217).
• CVE-2026-93601: rustls-webpki: name constraint bypass (bsc#1282217).
• CVE-2026-93602: rustls-webpki: CRL revocation check bypass (bsc#1282217).
• rust-shlex: Multiple issues involving quote API (RUSTSEC-2024-0006, GHSA-r7qv-8r2h-pg27) (bsc#1230032).

Changes for rustup:

• Update to version 1.29.1~0:

• dist(rustup-init/sh): update commit shasum in help string
• style(bin/rustup-init): reformat code
• docs(changelog): update for v1.29.1 stable release
• warn how to switch away from the deprecated complete profile
• fix(cli/help): fix wording in rustup run --help
• ci(docker/android): stop building OpenSSL
• refactor(cli/docs): use tracing for docs opening status messages
• refactor(self-update): rename Windows uninstall registry helpers
• feat(test): isolate Windows registry state per test
• docs(dev-guide): mention how to support new compilation targets
• Fix funding link
• chore(deps): lock file maintenance
• refactor(cli/self-update): move current_install_opts() to InstallOpts::display()
• refactor(cli/self-update): move process out of InstallOpts
• fix(cli/self-update): postpone initialization of Cfg in setup_mode
• refactor(cli/self-update): take Process in check_existence_of_settings_file()
• fix(settings): prevent creating new file with SettingsFile::read_settings()
• test(cli-inst-interactive): test file creation on cancelled installation
• refactor(toolchain/names): inline validate() aliases into FromStr
• refactor(toolchain/names): rename validate() to normalize_name()
• fix minor typos
• www: align copy icon
• refactor(toolchain/names)!: remove try_from_str!()
• refactor(toolchain/names)!: remove from_variant!()
• Add rustup doc --serve to serve docs over local HTTP
• Move doc() and man() into a new docs module
• chore(github): comment out instructions in PR template
• docs(dev-guide): reapply abandoned changes from #4970
• Add riscv64 unknown linux musl support
• fix(deps): update rust crate enum-map to v3
• refactor(cli/self-update)!: rename install() to InstallOpts::install()
• refactor(cli/self-update)!: rename maybe_install_rust() to InstallOpts::install_rust()
• refactor(cli/self-update)!: rename…

This update for agama fixes the following issues:

Changes in agama:

• Added support for the "inst.listen_on" boot parameter

  • The "inst.remote=0" option disables remote access (needed for CC compliant installation jsc#PED-16702)
  • It is possible to specify IP address (both IPv4 and IPv6) or network interface, accepts comma separated list
  • agama-web-server --address2 option removed, --address can now be repeated (jsc#AGM-153)

Update runtime dependencies to:

• tracing-subscriber 0.3.20, CVE-2025-58160 (bsc#1249014)

• bytes 1.12.1, CVE-2026-25541 (bsc#1274203)

• serde_with 3.21.0, GHSA-7gcf-g7xr-8hxj (bsc#1271854)

• Clear the IP configuration (dns-search, addresses, gateway, ...) for disabled IP protocols, including values kept from the existing connection, to avoid errors in NetworkManager (bsc#1271644).

• Handle VLAN flags properly, using the kernel default value of VLAN_FLAG_REORDER_HDR when not specified (bsc#1271079).

• Rename the network device match settings attribute to "match" (bsc#1271235).

Previous versions of tracing-subscriber were vulnerable to ANSI escape sequence injection attacks. Untrusted user input containing ANSI escape sequences could be injected into terminal output when logged, potentially allowing attackers to:

• Manipulate terminal title bars
• Clear screens or modify terminal display
• Potentially mislead users through terminal manipulation

In isolation, impact is minimal, however security issues have been found in terminal emulators that enabled an attacker to use ANSI escape sequences via logs to exploit vulnerabilities in the terminal emulator.

This was patched in PR #3368 to escape ANSI control characters from user input.

This update for himmelblau fixes the following issues:

Update to himmelblau 2.3.8 (jsc#PED-14511):

Security issues:

• CVE-2025-54882: world readable cloud TGT token (bsc#1247735).
• CVE-2025-58160: tracing-subscriber: Tracing log pollution (bsc#1249013).
• CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion (bsc#1257904).
• CVE-2026-31979: race condition when accessiung /tmp/krb5cc_<uid> (bsc#1259548).

Non security issues:

• Fix SELinux module packaging to use standard policy macros (bsc#1258236).

Changelog:

Version 2.3.8:

• Add PrivateTmp back to Tasks Daemon
• Drop dead code
• Drop krb5 ccache dir code
• Add a TODO comment
• Drop non working packaged krb5 snippet file
• Write kerberos config snippet
• Extend resolver interface to return kerberos config together with TGTs
• Backport SELinux fixes from main
• Use libkrimes to store TGTs

Version 2.3.7:

• cargo vet
• Fix AWS-LC has PKCS7_verify Certificate Chain Validation Bypass
• Revert dependency change which broke the nightly build
• gen_dockerfiles: only himmelblaud has tpm feature, fix all others
• fix(build): gen_dockerfiles.py mutates shared features list mid-loop

Version 2.3.5:

• Better handle Intune API version
• Update make vet from main branch
• pam_himmelblau: call split_username once in chauthtok
• pam_himmelblau: return PAM_IGNORE in chauthtok for local users
• Don't attempt a DAG when Hello fails with SSPR demand

Version 2.3.4:

• deps(rust): bump the all-cargo-updates group across 1 directory with 8 updates
• Revert sketching update (which breaks SLE16 build)

Version 2.3.3:

• /var/cache/private/himmelblaud should not be created tmpfiles
• Updatee python vers for dataclasses dep
• deps(rust): bump the all-cargo-updates group across 1 directory with 3 updates
• Generate pin init service file systemd < 250
• Checkin missing himmelblaud.if file for SELinux
• Resolve typos in selinux package commands

Version 2.3.2:

• Compile SELinux policy at install time for cross-distro compatibility
• Improve PAM configuration on openSUSE/SLE
• Fix SELinux policy
• Add a git hook to ensure selinux policy is tested
• Ignore generated himmelblau-hsm-pin-init service file
• Refactor SELinux policy for cross-distro compatibility
• Fix NSS lookup for mapped local users
• Skip OS version compliance checks when min/max values are empty

Version 2.3.1:

• Remove references to qrcodegen (these are 3.x features)
• QR Greeter compatibility for old GNOME
• Enable QR greeter automatically
• ci: Use latest cargo-vet from git to fix CI
• Fix HSM pin migration failure on Debian/Ubuntu upgrades from v1.4.x

Version 2.3.0:

• Autostart the daemons on fresh install or upgrade
• Restart sshd when installing the ssh config
• Allow tasks daemon to write krb ccache
• Do not enumerate mapped users in NSS
• Update libhimmelblau to latest version
• Fix Tumbleweed build

Version 2.2.0:

• Update libhimmelblau to 0.8.x series
• deps(rust): bump the all-cargo-updates group with 17 updates
• Only use OpenSSH bug workaround for ssh service
• Fix debug noise from removing user from sudo group
• systemd: install files to /usr/lib/, not /etc/

Version 2.1.0:

• Fix nightly authselect build failure
• Generate the authselect profiles for each distro
• Improve pam config handling in aad-tool
• Make aad-tool configure-pam detect location of pam files

Version 2.0.5:

• /var/lib/private/himmelblaud should be owned by root
• Use tmpfiles.d to create himmelblaud private data directory
• deps(rust): bump the all-cargo-updates group with 13 updates

Version 2.0.4:

• Update kanidm_build_profiles mask version

• Utilize cargo vet from main

• Add policies cache patch via systemd-tmpfiles

• Fix man page comments about change idmap_range

• Stub picky-krb for osc build

• Stub a kanidm_build_profiles which builds in osc

• Ensure nss cache is created on Ubuntu/Debian

• Request a user…

This update for python-maturin fixes the following issues:

• CVE-2025-58160: terminal escape injection via ANSI sequences from untrusted input (bsc#1249011).

This update for himmelblau fixes the following issues:

• Update to version 0.9.23+git.0.9776141:
  • CVE-2025-59044: Fixed GID collision of same-name groups allowing privilege escalation (bsc#1250687)
  • deps(rust): bump the all-cargo-updates group
  • CVE-2025-58160: tracing-subscriber: Fixed log pollution (bsc#1249013)

This update for himmelblau fixes the following issues:

Update to version 0.7.18+git.0.8485a75.

• CVE-2025-58160: tracing-subscriber: untrusted user input containing ANSI escape sequences could be injected into terminal output when logged (bsc#1249013).

This update for cargo-packaging and rust-bindgen fixes the following issues:

cargo-packaging was updated to version 1.3.0+0:

• CVE-2025-58160: Fixed tracing log pollution in tracing-subscriber (bsc#1249012)

Other fixes:

• Prevent stripping debug info (bsc#1222175)

rust-bindgen was updated to 0.72.0.

This update for himmelblau fixes the following issues:

Update to version 2.3.9+git0.a9fd29b; (jsc#PED-14511):

• CVE-2026-34397: Fix LPE due to name collision during NSS fake-primary group lookup (bsc#1261324).
• CVE-2026-31979: Fix race condition when accessiung /tmp/krb5cc_uid (bsc#1259548).
• CVE-2026-25727: deps(rust): Bump the all-cargo-updates group with 8 updates (bsc#1257904).
• CVE-2025-58160: deps(rust): Bump tracing-subscriber in the cargo group (bsc#1249013).
• CVE-2025-54882: Fix Kerberos credential cache permissions (bsc#1247735).
• CVE-2025-53013: Fix permitted authentication with invalid Hello PIN (bsc#1245437).
• CVE-2024-11738: Fix rustls network-reachable panic in Acceptor::accept (bsc#1233949).

Other bug fixes:

• Fix SELinux module packaging to use standard policy macros (bsc#1258236).

This update for python-uv fixes the following issues:

• CVE-2025-62518: astral-tokio-tar: Fixed boundary parsing issue allowing attackers to smuggle additional archive entries (bsc#1252399)
• CVE-2025-58160: tracing-subscriber: Fixed log pollution (bsc#1249011)

This update for cargo-c fixes the following issues:

• CVE-2025-4574: crossbeam-channel: Fixed double-free on drop in Channel::discard_all_messages (bsc#1243179)
• CVE-2025-58160: tracing-subscriber: Fixed log pollution (bsc#1249012)
• CVE-2024-12224: idna: Fixed improper validation of Punycode labels (bsc#1243851)

Other fixes:

• Fixed _service file to have proper versioning
• Update to version 0.10.15~git0.3e178d5:
  • Bump actions/download-artifact from 4 to 5
  • Update implib requirement from 0.3.5 to 0.4.0
  • Add rlib to the targets when building tests
  • Allow disabling emission of library version constants in header files
  • Bump to cargo 0.90
  • Fix static_libraries swallowing sequence of -framework flags
  • Fix non-POSIX paths in Libdir under Windows
  • Bump actions-rs-plus/clippy-check from 2.2.1 to 2.3.0
  • Fix clippy lints
  • Bump cargo-0.89, object-0.37.1, cbindgen-0.29

This update for python-maturin fixes the following issues:

• CVE-2025-58160: tracing-subscriber: Fixed log pollution (bsc#1249011)

This update for python-maturin fixes the following issues:

• CVE-2025-58160: tracing-subscriber: Fixed log pollution (bsc#1249011)

This update for glycin-loaders fixes the following issues

• CVE-2025-55159: slab: incorrect bounds check in get_disjoint_mut function can lead to undefined behavior or potential crash due to out-of-bounds access (bsc#1248035).
• CVE-2025-58160: tracing-subscriber: Tracing log pollution (bsc#1249010).

This update for loupe fixes the following issue

• CVE-2025-58160: tracing-subscriber: untrusted input containing ANSI escape sequences can lead to terminal manipulation (bsc#1249009).

Changes for loupe:

• Update to version 48.2:

• Check if the is-hidden property is available before reading it.

• Considerably increased speed for listing other images in folders, especially for remote locations. This allows for switching to other images to become available much quicker.

• Fix panics, probably occuring when using an action like 'copy', and then closing the window. The crash causes all other windows to close.

• The creation date for images that don't provide a timezone was displayed as if the recorded date and time was in UTC.

• Zooming in would not work via the zoom menu, if the resulting zoom state would still fit the image inside the window.

• Update to version 48.1:

• Crash when closing the window, probably in the exact moment when the animnation for hiding controls starts.

• Editing does not work correctly if PNGs or JPEGs are already rotated via an Exif orientation entry before editing.

• Printed pages don't contain anything or garbled output. This is a temporary workaround for https://gitlab.gnome.org/GNOME/gtk/-/issues/7464, using the cairo renderer for the rotation and scaling of the image in the print preparation.