CVE-2026-45784

CipherCtxRef::cipher_update_inplace incorrectly sized output buffers when used with AES key-wrap-with-padding ciphers (EVP_aes_{128,192,256}_wrap_pad). For a non-multiple-of-8 input, OpenSSL writes up to 7 bytes past the end of the caller's buffer or Vec, producing attacker-controllable heap corruption when the plaintext length is attacker-influenced.

This only impacts users using AES key-wrap-with-padding ciphers.

This method was missed in the fix for GHSA-xv59-967r-8726

rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.10.50 until 0.10.80, CipherCtxRef::cipher_update_inplace in openssl/src/cipher_ctx.rs incorrectly sized output buffers when used with AES key-wrap-with-padding ciphers EVP_aes_{128,192,256}_wrap_pad. For a non-multiple-of-8 input, OpenSSL writes up to 7 bytes past the end of the caller's buffer or Vec, producing attacker-controllable heap corruption when the plaintext length is attacker-influenced. This issue is fixed in version 0.10.80.

rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.10.50 until 0.10.80, CipherCtxRef::cipher_update_inplace in openssl/src/cipher_ctx.rs incorrectly sized output buffers when used with AES key-wrap-with-padding ciphers EVP_aes_{128,192,256}_wrap_pad. For a non-multiple-of-8 input, OpenSSL writes up to 7 bytes past the end of the caller's buffer or Vec, producing attacker-controllable heap corruption when the plaintext length is attacker-influenced. This issue is fixed in version 0.10.80.

These are all security issues fixed in the cargo-c-0.10.23-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the keylime-ima-policy-0.2.9+49-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the rustup-1.28.2~0-5.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the sccache-0.16.0~0-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the afterburn-5.10.0.git73.b97f772-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the sdbootutil-1+git20260713.d869cf8-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the agama-22+398.d23cf880d-49.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the aws-nitro-enclaves-binaryblobs-upstream-1.4.5~git0.18a5f6f-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the snpguest-0.10.0-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the snphost-0.7.0-3.1 package on the GA media of openSUSE Tumbleweed.

This update for rust-keylime fixes the following issues:

Update to version 0.2.9+49.

Security issues fixed:

• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270174).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length (bsc#1270614).
• CVE-2026-41678: openssl: out-of-bounds write due to incorrect bounds assertion in aes::unwrap_key() (bsc#1270699).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check (bsc#1270792).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory to the network (bsc#1270842).
• CVE-2026-42327: openssl: undefined behavior in X509Ref::ocsp_responders for certificates with non-UTF-8 OCSP URLs (bsc#1270523).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding due to incorrectly sized output buffers (bsc#1270903).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers due to incorrectly sized output buffer (bsc#1270999).

Other updates and bugfixes:

• Update openssl to 0.10.81.
• Make tss-esai-sys depend on bindgen 72.1 to support llvm > 21.
• Build with Clang <= 21 (bsc#1260596).
• Version 0.2.9+49:
  • build(deps): bump uuid from 1.23.3 to 1.23.4
  • build(deps): bump syn from 2.0.117 to 2.0.118
  • build(deps): bump openssl from 0.10.80 to 0.10.81
  • build(deps): bump rand from 0.9.4 to 0.10.1
  • Added new regression test into packit-ci.yaml
  • build(deps): bump actions/checkout from 6 to 7
  • build(deps): bump uuid from 1.23.1 to 1.23.3
  • build(deps): bump log from 0.4.29 to 0.4.32
  • build(deps): bump http from 1.4.0 to 1.4.2
  • build(deps): bump codecov/codecov-action from 6 to 7
  • build(deps): bump retry-policies from 0.5.1 to 0.5.2
  • fix: Remove unused base64::Engine import in context_info tests
  • build(deps): bump reqwest-middleware from 0.5.1 to 0.5.2
  • build(deps): bump serde_json from 1.0.149 to 1.0.150
  • build(deps): bump openssl from 0.10.79 to 0.10.80
  • agent: Hash agent ID before TPM2_Certify qualifying data
  • cargo: Bump tss-esapi, picky-asn1-x509, and picky-asn1-der
  • build(deps): bump openssl from 0.10.78 to 0.10.79
  • build(deps): bump once_cell from 1.21.3 to 1.21.4
  • build(deps): bump tempfile from 3.23.0 to 3.27.0
  • push-model: cache UEFI event log bytes at startup
  • build(deps): bump quote from 1.0.40 to 1.0.45
  • build(deps): bump chrono from 0.4.42 to 0.4.44
  • build(deps): bump openssl from 0.10.73 to 0.10.78
  • build(deps): bump serde_json from 1.0.143 to 1.0.149
  • build(deps): bump syn from 2.0.106 to 2.0.117
  • build(deps): bump libc from 0.2.175 to 0.2.184
  • build(deps): bump rand from 0.9.2 to 0.9.4
• Version 0.2.9+21:
  • tests: use Express-style named params in Mockoon endpoints
  • build(deps): bump pest_derive from 2.8.1 to 2.8.6
  • build(deps): bump trybuild from 1.0.110 to 1.0.115
  • build(deps): bump log from 0.4.28 to 0.4.29
  • build(deps): bump uuid from 1.19.0 to 1.20.0
  • build(deps): bump codecov/codecov-action from 5 to 6
  • build(deps): bump tracing-subscriber from 0.3.20 to 0.3.23
  • build(deps): bump cfg-if from 1.0.3 to 1.0.4
  • build(deps): bump tokio from 1.49.0 to 1.50.0
  • build(deps): bump actix-web from 4.12.1 to 4.13.0
  • build(deps): bump anyhow from 1.0.99 to 1.0.102
  • build(deps): bump clap from 4.5.57 to 4.5.60
  • build(deps): bump tracing from 0.1.36 to 0.1.44

This update for python-maturin fixes the following issues

• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270208).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length (bsc#1270620).
• CVE-2026-41678: openssl: out-of-bounds write due to incorrect bounds assertion in aes::unwrap_key() (bsc#1270706).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check (bsc#1270772).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory to the network (bsc#1270801).
• CVE-2026-42327: openssl: undefined behavior in X509Ref::ocsp_responders for certificates with non-UTF-8 OCSP URLs (bsc#1270515).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding due to incorrectly sized output buffers (bsc#1270936).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers due to incorrectly sized output buffer (bsc#1270994).

This update for agama fixes the following issues

• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length in rust- openssl crate (bsc#1270602).
• CVE-2026-41678: openssl: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270678).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check in rust-openssl crate (bsc#1270784).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory in rust-openssl crate (bsc#1270850).
• CVE-2026-42327: openssl: arbitrary code execution via specially crafted certificate in rust-openssl crate (bsc#1270526).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-openssl crate (bsc#1270891).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers in rust- openssl crate (bsc#1270992).

This update for python-cryptography fixes the following issues

• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270208).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length (bsc#1270620).
• CVE-2026-41678: openssl: out-of-bounds write due to incorrect bounds assertion in aes::unwrap_key() (bsc#1270706).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check (bsc#1270772).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory to the network (bsc#1270801).
• CVE-2026-42327: openssl: undefined behavior in X509Ref::ocsp_responders for certificates with non-UTF-8 OCSP URLs (bsc#1270515).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding due to incorrectly sized output buffers (bsc#1270936).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers due to incorrectly sized output buffer (bsc#1270994).

This update for afterburn fixes the following issues:

Update to version 5.10.0.git73.b97f772.

Security issues fixed:

• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270175).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length (bsc#1270555).
• CVE-2026-41678: openssl: incorrect bounds assertion in aes::unwrap_key() can lead to OOB write (bsc#1270651).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check (bsc#1270787).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory to network peers (bsc#1270817).
• CVE-2026-42327: openssl: undefined behavior in X509Ref::ocsp_responders when processing certificates with non-UTF-8 OCSP URLs (bsc#1270483).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding (bsc#1270886).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers (bsc#1270949).
• CVE-2026-25541: bytes: integer overflow in BytesMut:reserve can lead to undefined behavior and crashes (bsc#1271348).

Other updates and bugfixes:

• Version 5.10.0.git73.b97f772:
  • build(deps): bump anyhow from 1.0.99 to 1.0.103 https://github.com/coreos/afterburn/pull/1284
  • build(deps): bump libflate from 2.1.0 to 2.2.2 https://github.com/coreos/afterburn/pull/1283
  • build(deps): bump openssl from 0.10.79 to 0.10.80 https://github.com/coreos/afterburn/pull/1277
• Version 5.10.0.git70.9cc2a7b:
  • build(deps): bump openssl from 0.10.78 to 0.10.79
  • providers/hetzner: Add the HETZNER_PUBLIC_IPV6 attribute
  • providers/hetzner: Add support for network configuration
  • build(deps): bump rustls-webpki from 0.103.10 to 0.103.13
  • build(deps): bump openssl from 0.10.73 to 0.10.78
  • docs: Add AGENTS.md and CLAUDE.md for AI coding assistants
  • build(deps): bump rand from 0.9.2 to 0.9.4
  • opencode: add skills for provider scaffolding and release automation
  • ibmcloud-classic: Add missing network_id to fixture
  • kubevirt: Support static gateway and DNS with DHCP
  • build(deps): bump rustls-webpki from 0.103.6 to 0.103.10
  • fix(proxmoxve): Define DNS entries for every interface
  • Makefile: download 90-afterburn-authorized-keys-file.conf for rpm building
  • Sync repo templates ⚙
  • build(deps): bump bytes from 1.10.1 to 1.11.1
  • util/dhcp: Fix clippy lints
  • build(deps): bump actions/checkout from 4 to 6
  • build(deps): bump actions/upload-artifact from 4 to 5
  • kubevirt: modprobe for virtio_blk; remove dracut preload
  • kubevirt: Add NoCloud network configuration support
  • kubevirt: Support config drive network data
  • kubevirt: Refactor the provider to follow the proxmoxve structure
  • dracut: Add virtio_blk module preload to afterburn-network-kargs service
  • docs: Add release notes
  • cargo: Afterburn release 5.10.0
• Version 5.10.0:
  • docs/release-notes: update for release 5.10.0
  • cargo: update dependencies
  • microsoft/azure: Add XML attribute alias for serde-xml-rs Fedora compat
  • docs/release-notes: Add entry for Azure SharedConfig XML parsing fix
  • microsoft/azure: Fix SharedConfig parsing of XML attributes
  • microsoft/azure: Mock goalstate.SharedConfig output in tests
  • providers/azure: switch SSH key retrieval from certs endpoint to IMDS
  • build(deps): bump the build group with 8 updates
  • build(deps): bump slab from 0.4.10 to 0.4.11
  • build(deps): bump actions/checkout from 4 to 5
  • upcloud: implement UpCloud provider
  • build(deps): bump the build group with 4 updates

This update for aws-nitro-enclaves-cli fixes the following issues:

• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length in rust- openssl crate (bsc#1270542).
• CVE-2026-41678: openssl: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270705).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check in rust-openssl crate (bsc#1270747).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory in rust-openssl crate (bsc#1270839).
• CVE-2026-42327: openssl: arbitrary code execution via specially crafted certificate in rust-openssl crate (bsc#1270492).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-openssl crate (bsc#1270932).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers in rust- openssl crate (bsc#1270952).

Changes for aws-nitro-enclaves-cli:

• Update to version 1.4.5.

This update for himmelblau fixes the following issues:

Update to version 2.3.14+git0.e23b4c54.

Security issues fixed:

• CVE-2026-45784: incorrect sizing of output buffers in CipherCtxRef::cipher_update_inplace when used with AES key-wrap-with-padding ciphers can lead to attacker-controlled heap corruption (bsc#1270985).
• Arbitrary HTTP or HTTPS URLs classified as Office documents based on an attacker-controlled file query parameters are forwarded to Electron applications and allow for code execution through Electron (bsc#1273910).
• Directory-provided RFC2307 user identifiers accepted without exclusion of systemd's dynamic-user range allows for daemon impersonation and command execution through the task helper (bsc#1273911).
• Daemon acts on Hello PIN enrollment requests whose identity claims it never cryptographically verifies and allows for local authentication bypass (bsc#1273912).

Other updates and bugfixes:

• Version 2.3.14+git0.e23b4c54:
  • fix(nss): avoid locked shadow entries
  • fix(deps): update libhimmelblau lockfile
  • fix(pam): make account denials terminal
  • debian: make the pam_allow_groups denial terminal in the account phase
• Version 2.3.13:
  • Update cargo vet audits for backport
  • Fix cargo-fuzz install in fuzz CI
  • cargo vet
  • Update ldap3_proto to 0.7.1
  • Update openssl
• Version 2.3.12:
  • Remove invalid himmelblau.conf example info
  • Fix SSHd configuration load order on Fedora/RHEL systems
  • himmelblau-init-hsm-pin: don't bind the hsm-pin to PCR7
  • qr-greeter: support GNOME Shell 50
  • Update libhimmelblau to latest version
  • deps(rust): bump tonic in the all-cargo-updates group across 1 directory
  • cargo audit

This update for snpguest fixes the following issues:

• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length (bsc#1270541).
• CVE-2026-41678: openssl: OOB write due to incorrect bounds assertion in aes::unwrap_key() (bsc#1270642).
• CVE-2026-41681: openssl: stack corruption due to MdCtxRef::digest_final() writing past caller buffer with no length check (bsc#1270720).
• CVE-2026-41898: openssl: information leak to network peers due to unchecked callback-returned length in PSK and cookie generate trampolines (bsc#1270799).
• CVE-2026-42327: openssl: undefined behavior in X509Ref::ocsp_responders when processing certificates with non-UTF-8 OCSP URLs (bsc#1270527).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding (bsc#1270873).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers (bsc#1270947).

This update for snphost fixes the following issues:

• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length (bsc#1270541).
• CVE-2026-41678: openssl: OOB write due to incorrect bounds assertion in aes::unwrap_key() (bsc#1270642).
• CVE-2026-41681: openssl: stack corruption due to MdCtxRef::digest_final() writing past caller buffer with no length check (bsc#1270720).
• CVE-2026-41898: openssl: information leak to network peers due to unchecked callback-returned length in PSK and cookie generate trampolines (bsc#1270799).
• CVE-2026-42327: openssl: undefined behavior in X509Ref::ocsp_responders when processing certificates with non-UTF-8 OCSP URLs (bsc#1270527).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding (bsc#1270873).
• CVE-2026-45784: openssl: OOB write due to incorrectly sized output buffers in CipherCtxRef::cipher_update_inplace when it is used with AES key-wrap-with-padding ciphers (bsc#1270947).

This update for sdbootutil fixes the following issues:

Security issues fixed:

• CVE-2026-41676: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270192).
• CVE-2026-41677: out-of-bounds read in PEM password callback when returning an oversized length in rust-openssl crate (bsc#1270616).
• CVE-2026-41678: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270670).
• CVE-2026-41681: MdCtxRef::digest_final() writes past caller buffer with no length check in rust-openssl crate (bsc#1270742).
• CVE-2026-41898: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory in rust-openssl crate (bsc#1270863).
• CVE-2026-42327: arbitrary code execution via specially crafted certificate in rust-openssl crate (bsc#1270471).
• CVE-2026-44662: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-openssl crate (bsc#1270922).
• CVE-2026-45784: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers in rust- openssl crate (bsc#1270995).

Non security issues fixed:

• sdbootutil-update-predictions.service fails with Failed to start Update TPM predictions (bsc#1273384).
• systemd ordering cycle and other service problems with snapshot 20260722 (bsc#1272525).
• Unable to unlock multiple encrypted partitions with FIDO2 Key, Systemdboot+LUKS (bsc#1234010).

Changes for sdbootutil:

• Update to version 1+git20260908.c641fc2:

• Update the shim when required
• Warn when recovery PIN is different from recovery key
• Improves extra boot entries support
• Better report when the default snapshot diverges
• Explain how to do re-enrolling if recovery PIN fails
• Explain why update-prediction fails and how to solve it
• Hide comparison output
• Add bootctl default entry in the prediction

• Update to version 1+git20260903.f91f636:

• Include FIDO2 unlocked devices for ordering (bsc#1234010)
• Test in parallel for speed up
• Add --repair parameter to cleanup
• Fix shellcheck complain
• Report entries with missing files
• Avoid duplicate entries in non-snapper systems
• Add initial tests for sdbootutil
• Report the error if bootctl clean fails

• Update to version 1+git20260901.41540d5:

• No warn if a component is not in the event log
• Add status command
• Select the new sdbootutil if available
• Skip blank lines in measure-pcr-generator.sh
• Do not change crypttab for unrelated entries
• Report the bad PCR when update-prediction fail
• Do not write the recovery PIN in the journal
• Improves non snapshot system support
• Update help message for --measure-pcr
• Report when PCR 7 is dropped because shim update
• Add --strict parameter for --pcr policy
• Report dropped PCRs via a warn
• Adjust the limits for PolicyOR issues
• Avoid update predictions if the service is up
• Keep the exit status of sdbootutil call

• Update to version 1+git20260827.786f9a8:

• Do not accept empty passwords
• jeos-firstboot-enroll: report errors also in the journal
• Restore old crypttab via the exit trap
• Update CLAUDE data
• Detect half created openssl keys
• check_enrolled report when something was written in the LUKS2 header
• Improve a bit the disk-encryption-tool keyslot detection
• Avoid leak of env var secrets
• Wipe the d-e-t key in the enroll service and jeos module
• Remove the correct keyslot left by d-e-t
• Differentiate tpm2 and tpm2+pin for unattended unlock
• Use is_same_device in detect_tracked_device and drop greps
• Refactor check to avoid shellcheck complain
• Parse the entry file in a sigle place
• Validate the entry with the new kernel name
• Refactor enrollment interface and deprecate the old one
• New kernels will have different hash
• Warn If no crypttab entry found
• Extend is_same_device
• jeos-firstboot-enroll: validate the passwords
• sdbootutil-enroll: report when no encryption method is provided
• Write recovery pin after enrollment in…

This update for sccache fixes the following issues:

• CVE-2024-12224: idna: idna accepts Punycode labels that do not produce any non-ASCII when decoded (bsc#1243868).
• CVE-2026-25541: bytes: integer overflow in 'BytesMut:reserve' can lead to undefined behavior and crashes (bsc#1274146).
• CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion (bsc#1257923).
• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270206).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length in rust- openssl crate (bsc#1270559).
• CVE-2026-41678: openssl: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270693).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check in rust-openssl crate (bsc#1270736).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory in rust-openssl crate (bsc#1270869).
• CVE-2026-42327: openssl: arbitrary code execution via specially crafted certificate in rust-openssl crate (bsc#1270512).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-openssl crate (bsc#1270938).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers in rust- openssl crate (bsc#1270948).
• CVE-2026-66746: rouille: HTTP Response Splitting via Unvalidated Response Header Values (bsc#1273881).
• CVE-2026-66754: rouille: remove_prefix function that allows remote unauthenticated attackers to crash the server by sending a crafted percent-encoded URL (bsc#1273884).
• CVE-2026-67181: rouille: HTTP Request Smuggling via Transfer-Encoding Desynchronization (bsc#1273886).
• CVE-2026-67182: rouille: HTTP Request Smuggling Enables Front-End Access Control Bypass (bsc#1273888).
• CVE-2026-93599: rustls-webpki: panic via empty BIT STRING (bsc#1282211).
• CVE-2026-93600: rustls-webpki: name constraints URI validation bypass (bsc#1282211).
• CVE-2026-93601: rustls-webpki: name constraint bypass (bsc#1282211).
• CVE-2026-93602: rustls-webpki: CRL revocation check bypass (bsc#1282211).

Changes for sccache:

Update to version 0.18.0~2:

• Add experimental concurrent cache support
• chore: Remove dependency status badge (#2856)
• Don't hand the jobserver to children that can't use it
• dist: refuse to trim rlibs from crates that also emit a cdylib
• fix(cache): avoid duplicate multilevel reads
• Strip basedirs from the compiler arguments too
• tests/integration: replace MinIO with Silo
• ci: dump sccache logs on integration failures
• multilevel: a chain with any writable level is writable
• Fix parsing of #line directives
• Release 0.18.0
• daemonize: use an allow-list approach to inherited FDs
• gcc, clang: make the assembler part of the cache key
• support cl.exe /openmp:llvm
• support all current /fsanitize*, /fsanitize-coverage*, and /fno-sanitize* args
• support MSVC /feature argument
• msvc: support lots of flags (#2832)
• Update shlex dependency to version 2 (#2836)
• gcc: mark flags as TooHard if need to cache something else (#2833)
• clang: support more CLI options (#2834)
• msvc: support arm64EC and fastfail flags (#2830)
• chore: fix typo in comment (#2829)
• nvcc: accept the --diag-error/--diag-suppress/--diag-warn family (#2816)
• cache: allow skipping capability checks (#2822)
• Bump opendal to 0.58.1 and fix fallout (fixes local GCS cache usage) (#2715)
• nvcc (Windows): protect escaped quotes in dryrun lines before flattening backslashes (#2811)
• Add an agent (#2812)
• Add support for d20bforceinline. (#2807)
• feat: add Microsoft Entra ID (passwordless) auth for the Azure Blob backend (#2802)
• Bump MSRV to 1.91.0 (#2793)
• Fix nvcc dryrun parsing for CUDA 13.3 (#2722)
• test: Fixed…

This update for rustup fixes the following issues:

• CVE-2024-12224: idna: idna accepts Punycode labels that do not produce any non-ASCII when decoded (bsc#1243862).
• CVE-2025-58160: tracing-subscriber: Tracing log pollution (bsc#1249008).
• CVE-2026-25541: bytes: integer overflow in 'BytesMut:reserve' can lead to undefined behavior and crashes (bsc#1274144).
• CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion (bsc#1257902).
• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270186).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length in rust- openssl crate (bsc#1270619).
• CVE-2026-41678: openssl: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270644).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check in rust-openssl crate (bsc#1270795).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory in rust-openssl crate (bsc#1270870).
• CVE-2026-42327: openssl: arbitrary code execution via specially crafted certificate in rust-openssl crate (bsc#1270521).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-openssl crate (bsc#1270874).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers in rust- openssl crate (bsc#1270989).
• CVE-2026-93599: rustls-webpki: panic via empty BIT STRING (bsc#1282217).
• CVE-2026-93600: rustls-webpki: name constraints URI validation bypass (bsc#1282217).
• CVE-2026-93601: rustls-webpki: name constraint bypass (bsc#1282217).
• CVE-2026-93602: rustls-webpki: CRL revocation check bypass (bsc#1282217).
• rust-shlex: Multiple issues involving quote API (RUSTSEC-2024-0006, GHSA-r7qv-8r2h-pg27) (bsc#1230032).

Changes for rustup:

• Update to version 1.29.1~0:

• dist(rustup-init/sh): update commit shasum in help string
• style(bin/rustup-init): reformat code
• docs(changelog): update for v1.29.1 stable release
• warn how to switch away from the deprecated complete profile
• fix(cli/help): fix wording in rustup run --help
• ci(docker/android): stop building OpenSSL
• refactor(cli/docs): use tracing for docs opening status messages
• refactor(self-update): rename Windows uninstall registry helpers
• feat(test): isolate Windows registry state per test
• docs(dev-guide): mention how to support new compilation targets
• Fix funding link
• chore(deps): lock file maintenance
• refactor(cli/self-update): move current_install_opts() to InstallOpts::display()
• refactor(cli/self-update): move process out of InstallOpts
• fix(cli/self-update): postpone initialization of Cfg in setup_mode
• refactor(cli/self-update): take Process in check_existence_of_settings_file()
• fix(settings): prevent creating new file with SettingsFile::read_settings()
• test(cli-inst-interactive): test file creation on cancelled installation
• refactor(toolchain/names): inline validate() aliases into FromStr
• refactor(toolchain/names): rename validate() to normalize_name()
• fix minor typos
• www: align copy icon
• refactor(toolchain/names)!: remove try_from_str!()
• refactor(toolchain/names)!: remove from_variant!()
• Add rustup doc --serve to serve docs over local HTTP
• Move doc() and man() into a new docs module
• chore(github): comment out instructions in PR template
• docs(dev-guide): reapply abandoned changes from #4970
• Add riscv64 unknown linux musl support
• fix(deps): update rust crate enum-map to v3
• refactor(cli/self-update)!: rename install() to InstallOpts::install()
• refactor(cli/self-update)!: rename maybe_install_rust() to InstallOpts::install_rust()
• refactor(cli/self-update)!: rename…

This update for rust-keylime fixes the following issues:

Update to version 0.2.9+49.

Security issues fixed:

• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270174).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length (bsc#1270614).
• CVE-2026-41678: openssl: out-of-bounds write due to incorrect bounds assertion in aes::unwrap_key() (bsc#1270699).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check (bsc#1270792).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory to the network (bsc#1270842).
• CVE-2026-42327: openssl: undefined behavior in X509Ref::ocsp_responders for certificates with non-UTF-8 OCSP URLs (bsc#1270523).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding due to incorrectly sized output buffers (bsc#1270903).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers due to incorrectly sized output buffer (bsc#1270999).

Other updates and bugfixes:

• Update openssl to 0.10.81.
• Make tss-esai-sys depend on bindgen 72.1 to support llvm > 21.
• Build with Clang <= 21 (bsc#1260596).
• Version 0.2.9+49:
  • build(deps): bump uuid from 1.23.3 to 1.23.4
  • build(deps): bump syn from 2.0.117 to 2.0.118
  • build(deps): bump openssl from 0.10.80 to 0.10.81
  • build(deps): bump rand from 0.9.4 to 0.10.1
  • Added new regression test into packit-ci.yaml
  • build(deps): bump actions/checkout from 6 to 7
  • build(deps): bump uuid from 1.23.1 to 1.23.3
  • build(deps): bump log from 0.4.29 to 0.4.32
  • build(deps): bump http from 1.4.0 to 1.4.2
  • build(deps): bump codecov/codecov-action from 6 to 7
  • build(deps): bump retry-policies from 0.5.1 to 0.5.2
  • fix: Remove unused base64::Engine import in context_info tests
  • build(deps): bump reqwest-middleware from 0.5.1 to 0.5.2
  • build(deps): bump serde_json from 1.0.149 to 1.0.150
  • build(deps): bump openssl from 0.10.79 to 0.10.80
  • agent: Hash agent ID before TPM2_Certify qualifying data
  • cargo: Bump tss-esapi, picky-asn1-x509, and picky-asn1-der
  • build(deps): bump openssl from 0.10.78 to 0.10.79
  • build(deps): bump once_cell from 1.21.3 to 1.21.4
  • build(deps): bump tempfile from 3.23.0 to 3.27.0
  • push-model: cache UEFI event log bytes at startup
  • build(deps): bump quote from 1.0.40 to 1.0.45
  • build(deps): bump chrono from 0.4.42 to 0.4.44
  • build(deps): bump openssl from 0.10.73 to 0.10.78
  • build(deps): bump serde_json from 1.0.143 to 1.0.149
  • build(deps): bump syn from 2.0.106 to 2.0.117
  • build(deps): bump libc from 0.2.175 to 0.2.184
  • build(deps): bump rand from 0.9.2 to 0.9.4
• Version 0.2.9+21:
  • tests: use Express-style named params in Mockoon endpoints
  • build(deps): bump pest_derive from 2.8.1 to 2.8.6
  • build(deps): bump trybuild from 1.0.110 to 1.0.115
  • build(deps): bump log from 0.4.28 to 0.4.29
  • build(deps): bump uuid from 1.19.0 to 1.20.0
  • build(deps): bump codecov/codecov-action from 5 to 6
  • build(deps): bump tracing-subscriber from 0.3.20 to 0.3.23
  • build(deps): bump cfg-if from 1.0.3 to 1.0.4
  • build(deps): bump tokio from 1.49.0 to 1.50.0
  • build(deps): bump actix-web from 4.12.1 to 4.13.0
  • build(deps): bump anyhow from 1.0.99 to 1.0.102
  • build(deps): bump clap from 4.5.57 to 4.5.60
  • build(deps): bump tracing from 0.1.36 to 0.1.44

This update for rust-keylime fixes the following issues:

Update to version 0.2.9+49.

Security issues fixed:

• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270174).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length (bsc#1270614).
• CVE-2026-41678: openssl: out-of-bounds write due to incorrect bounds assertion in aes::unwrap_key() (bsc#1270699).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check (bsc#1270792).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory to the network (bsc#1270842).
• CVE-2026-42327: openssl: undefined behavior in X509Ref::ocsp_responders for certificates with non-UTF-8 OCSP URLs (bsc#1270523).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding due to incorrectly sized output buffers (bsc#1270903).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers due to incorrectly sized output buffer (bsc#1270999).

Other updates and bugfixes:

• Update openssl to 0.10.81.
• Make tss-esai-sys depend on bindgen 72.1 to support llvm > 21.
• Build with Clang <= 21 (bsc#1260596).
• Version 0.2.9+49:
  • build(deps): bump uuid from 1.23.3 to 1.23.4
  • build(deps): bump syn from 2.0.117 to 2.0.118
  • build(deps): bump openssl from 0.10.80 to 0.10.81
  • build(deps): bump rand from 0.9.4 to 0.10.1
  • Added new regression test into packit-ci.yaml
  • build(deps): bump actions/checkout from 6 to 7
  • build(deps): bump uuid from 1.23.1 to 1.23.3
  • build(deps): bump log from 0.4.29 to 0.4.32
  • build(deps): bump http from 1.4.0 to 1.4.2
  • build(deps): bump codecov/codecov-action from 6 to 7
  • build(deps): bump retry-policies from 0.5.1 to 0.5.2
  • fix: Remove unused base64::Engine import in context_info tests
  • build(deps): bump reqwest-middleware from 0.5.1 to 0.5.2
  • build(deps): bump serde_json from 1.0.149 to 1.0.150
  • build(deps): bump openssl from 0.10.79 to 0.10.80
  • agent: Hash agent ID before TPM2_Certify qualifying data
  • cargo: Bump tss-esapi, picky-asn1-x509, and picky-asn1-der
  • build(deps): bump openssl from 0.10.78 to 0.10.79
  • build(deps): bump once_cell from 1.21.3 to 1.21.4
  • build(deps): bump tempfile from 3.23.0 to 3.27.0
  • push-model: cache UEFI event log bytes at startup
  • build(deps): bump quote from 1.0.40 to 1.0.45
  • build(deps): bump chrono from 0.4.42 to 0.4.44
  • build(deps): bump openssl from 0.10.73 to 0.10.78
  • build(deps): bump serde_json from 1.0.143 to 1.0.149
  • build(deps): bump syn from 2.0.106 to 2.0.117
  • build(deps): bump libc from 0.2.175 to 0.2.184
  • build(deps): bump rand from 0.9.2 to 0.9.4
• Version 0.2.9+21:
  • tests: use Express-style named params in Mockoon endpoints
  • build(deps): bump pest_derive from 2.8.1 to 2.8.6
  • build(deps): bump trybuild from 1.0.110 to 1.0.115
  • build(deps): bump log from 0.4.28 to 0.4.29
  • build(deps): bump uuid from 1.19.0 to 1.20.0
  • build(deps): bump codecov/codecov-action from 5 to 6
  • build(deps): bump tracing-subscriber from 0.3.20 to 0.3.23
  • build(deps): bump cfg-if from 1.0.3 to 1.0.4
  • build(deps): bump tokio from 1.49.0 to 1.50.0
  • build(deps): bump actix-web from 4.12.1 to 4.13.0
  • build(deps): bump anyhow from 1.0.99 to 1.0.102
  • build(deps): bump clap from 4.5.57 to 4.5.60
  • build(deps): bump tracing from 0.1.36 to 0.1.44

This update for python-maturin fixes the following issues

• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270208).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length (bsc#1270620).
• CVE-2026-41678: openssl: out-of-bounds write due to incorrect bounds assertion in aes::unwrap_key() (bsc#1270706).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check (bsc#1270772).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory to the network (bsc#1270801).
• CVE-2026-42327: openssl: undefined behavior in X509Ref::ocsp_responders for certificates with non-UTF-8 OCSP URLs (bsc#1270515).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding due to incorrectly sized output buffers (bsc#1270936).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers due to incorrectly sized output buffer (bsc#1270994).

This update for python-cryptography fixes the following issues

• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270208).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length (bsc#1270620).
• CVE-2026-41678: openssl: out-of-bounds write due to incorrect bounds assertion in aes::unwrap_key() (bsc#1270706).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check (bsc#1270772).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory to the network (bsc#1270801).
• CVE-2026-42327: openssl: undefined behavior in X509Ref::ocsp_responders for certificates with non-UTF-8 OCSP URLs (bsc#1270515).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding due to incorrectly sized output buffers (bsc#1270936).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers due to incorrectly sized output buffer (bsc#1270994).

This update for python-maturin fixes the following issues

• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270208).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length (bsc#1270620).
• CVE-2026-41678: openssl: out-of-bounds write due to incorrect bounds assertion in aes::unwrap_key() (bsc#1270706).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check (bsc#1270772).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory to the network (bsc#1270801).
• CVE-2026-42327: openssl: undefined behavior in X509Ref::ocsp_responders for certificates with non-UTF-8 OCSP URLs (bsc#1270515).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding due to incorrectly sized output buffers (bsc#1270936).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers due to incorrectly sized output buffer (bsc#1270994).

This update for agama fixes the following issues

• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length in rust- openssl crate (bsc#1270602).
• CVE-2026-41678: openssl: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270678).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check in rust-openssl crate (bsc#1270784).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory in rust-openssl crate (bsc#1270850).
• CVE-2026-42327: openssl: arbitrary code execution via specially crafted certificate in rust-openssl crate (bsc#1270526).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-openssl crate (bsc#1270891).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers in rust- openssl crate (bsc#1270992).

This update for python-cryptography fixes the following issues

• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270208).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length (bsc#1270620).
• CVE-2026-41678: openssl: out-of-bounds write due to incorrect bounds assertion in aes::unwrap_key() (bsc#1270706).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check (bsc#1270772).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory to the network (bsc#1270801).
• CVE-2026-42327: openssl: undefined behavior in X509Ref::ocsp_responders for certificates with non-UTF-8 OCSP URLs (bsc#1270515).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding due to incorrectly sized output buffers (bsc#1270936).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers due to incorrectly sized output buffer (bsc#1270994).

This update for afterburn fixes the following issues:

Update to version 5.10.0.git73.b97f772.

Security issues fixed:

• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270175).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length (bsc#1270555).
• CVE-2026-41678: openssl: incorrect bounds assertion in aes::unwrap_key() can lead to OOB write (bsc#1270651).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check (bsc#1270787).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory to network peers (bsc#1270817).
• CVE-2026-42327: openssl: undefined behavior in X509Ref::ocsp_responders when processing certificates with non-UTF-8 OCSP URLs (bsc#1270483).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding (bsc#1270886).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers (bsc#1270949).
• CVE-2026-25541: bytes: integer overflow in BytesMut:reserve can lead to undefined behavior and crashes (bsc#1271348).

Other updates and bugfixes:

• Version 5.10.0.git73.b97f772:
  • build(deps): bump anyhow from 1.0.99 to 1.0.103 https://github.com/coreos/afterburn/pull/1284
  • build(deps): bump libflate from 2.1.0 to 2.2.2 https://github.com/coreos/afterburn/pull/1283
  • build(deps): bump openssl from 0.10.79 to 0.10.80 https://github.com/coreos/afterburn/pull/1277
• Version 5.10.0.git70.9cc2a7b:
  • build(deps): bump openssl from 0.10.78 to 0.10.79
  • providers/hetzner: Add the HETZNER_PUBLIC_IPV6 attribute
  • providers/hetzner: Add support for network configuration
  • build(deps): bump rustls-webpki from 0.103.10 to 0.103.13
  • build(deps): bump openssl from 0.10.73 to 0.10.78
  • docs: Add AGENTS.md and CLAUDE.md for AI coding assistants
  • build(deps): bump rand from 0.9.2 to 0.9.4
  • opencode: add skills for provider scaffolding and release automation
  • ibmcloud-classic: Add missing network_id to fixture
  • kubevirt: Support static gateway and DNS with DHCP
  • build(deps): bump rustls-webpki from 0.103.6 to 0.103.10
  • fix(proxmoxve): Define DNS entries for every interface
  • Makefile: download 90-afterburn-authorized-keys-file.conf for rpm building
  • Sync repo templates ⚙
  • build(deps): bump bytes from 1.10.1 to 1.11.1
  • util/dhcp: Fix clippy lints
  • build(deps): bump actions/checkout from 4 to 6
  • build(deps): bump actions/upload-artifact from 4 to 5
  • kubevirt: modprobe for virtio_blk; remove dracut preload
  • kubevirt: Add NoCloud network configuration support
  • kubevirt: Support config drive network data
  • kubevirt: Refactor the provider to follow the proxmoxve structure
  • dracut: Add virtio_blk module preload to afterburn-network-kargs service
  • docs: Add release notes
  • cargo: Afterburn release 5.10.0
• Version 5.10.0:
  • docs/release-notes: update for release 5.10.0
  • cargo: update dependencies
  • microsoft/azure: Add XML attribute alias for serde-xml-rs Fedora compat
  • docs/release-notes: Add entry for Azure SharedConfig XML parsing fix
  • microsoft/azure: Fix SharedConfig parsing of XML attributes
  • microsoft/azure: Mock goalstate.SharedConfig output in tests
  • providers/azure: switch SSH key retrieval from certs endpoint to IMDS
  • build(deps): bump the build group with 8 updates
  • build(deps): bump slab from 0.4.10 to 0.4.11
  • build(deps): bump actions/checkout from 4 to 5
  • upcloud: implement UpCloud provider
  • build(deps): bump the build group with 4 updates

This update for python-cryptography fixes the following issues

• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270208).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length in rust- openssl crate (bsc#1270620).
• CVE-2026-41678: openssl: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270706).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check in rust-openssl crate (bsc#1270772).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory in rust-openssl crate (bsc#1270801).
• CVE-2026-42327: openssl: arbitrary code execution via specially crafted certificate in rust-openssl crate (bsc#1270515).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-openssl crate (bsc#1270936).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers in rust- openssl crate (bsc#1270994).

This update for afterburn fixes the following issues:

Update to version 5.10.0.git73.b97f772.

Security issues fixed:

• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270175).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length (bsc#1270555).
• CVE-2026-41678: openssl: incorrect bounds assertion in aes::unwrap_key() can lead to OOB write (bsc#1270651).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check (bsc#1270787).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory to network peers (bsc#1270817).
• CVE-2026-42327: openssl: undefined behavior in X509Ref::ocsp_responders when processing certificates with non-UTF-8 OCSP URLs (bsc#1270483).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding (bsc#1270886).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers (bsc#1270949).
• CVE-2026-25541: bytes: integer overflow in BytesMut:reserve can lead to undefined behavior and crashes (bsc#1271348).

Other updates and bugfixes:

• Version 5.10.0.git73.b97f772:
  • build(deps): bump anyhow from 1.0.99 to 1.0.103 https://github.com/coreos/afterburn/pull/1284
  • build(deps): bump libflate from 2.1.0 to 2.2.2 https://github.com/coreos/afterburn/pull/1283
  • build(deps): bump openssl from 0.10.79 to 0.10.80 https://github.com/coreos/afterburn/pull/1277
• Version 5.10.0.git70.9cc2a7b:
  • build(deps): bump openssl from 0.10.78 to 0.10.79
  • providers/hetzner: Add the HETZNER_PUBLIC_IPV6 attribute
  • providers/hetzner: Add support for network configuration
  • build(deps): bump rustls-webpki from 0.103.10 to 0.103.13
  • build(deps): bump openssl from 0.10.73 to 0.10.78
  • docs: Add AGENTS.md and CLAUDE.md for AI coding assistants
  • build(deps): bump rand from 0.9.2 to 0.9.4
  • opencode: add skills for provider scaffolding and release automation
  • ibmcloud-classic: Add missing network_id to fixture
  • kubevirt: Support static gateway and DNS with DHCP
  • build(deps): bump rustls-webpki from 0.103.6 to 0.103.10
  • fix(proxmoxve): Define DNS entries for every interface
  • Makefile: download 90-afterburn-authorized-keys-file.conf for rpm building
  • Sync repo templates ⚙
  • build(deps): bump bytes from 1.10.1 to 1.11.1
  • util/dhcp: Fix clippy lints
  • build(deps): bump actions/checkout from 4 to 6
  • build(deps): bump actions/upload-artifact from 4 to 5
  • kubevirt: modprobe for virtio_blk; remove dracut preload
  • kubevirt: Add NoCloud network configuration support
  • kubevirt: Support config drive network data
  • kubevirt: Refactor the provider to follow the proxmoxve structure
  • dracut: Add virtio_blk module preload to afterburn-network-kargs service
  • docs: Add release notes
  • cargo: Afterburn release 5.10.0
• Version 5.10.0:
  • docs/release-notes: update for release 5.10.0
  • cargo: update dependencies
  • microsoft/azure: Add XML attribute alias for serde-xml-rs Fedora compat
  • docs/release-notes: Add entry for Azure SharedConfig XML parsing fix
  • microsoft/azure: Fix SharedConfig parsing of XML attributes
  • microsoft/azure: Mock goalstate.SharedConfig output in tests
  • providers/azure: switch SSH key retrieval from certs endpoint to IMDS
  • build(deps): bump the build group with 8 updates
  • build(deps): bump slab from 0.4.10 to 0.4.11
  • build(deps): bump actions/checkout from 4 to 5
  • upcloud: implement UpCloud provider
  • build(deps): bump the build group with 4 updates

This update for aws-nitro-enclaves-cli fixes the following issues:

• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length in rust- openssl crate (bsc#1270542).
• CVE-2026-41678: openssl: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270705).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check in rust-openssl crate (bsc#1270747).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory in rust-openssl crate (bsc#1270839).
• CVE-2026-42327: openssl: arbitrary code execution via specially crafted certificate in rust-openssl crate (bsc#1270492).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-openssl crate (bsc#1270932).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers in rust- openssl crate (bsc#1270952).

Changes for aws-nitro-enclaves-cli:

• Update to version 1.4.5.

This update for python-cryptography fixes the following issues

• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270208).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length in rust- openssl crate (bsc#1270620).
• CVE-2026-41678: openssl: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270706).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check in rust-openssl crate (bsc#1270772).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory in rust-openssl crate (bsc#1270801).
• CVE-2026-42327: openssl: arbitrary code execution via specially crafted certificate in rust-openssl crate (bsc#1270515).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-openssl crate (bsc#1270936).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers in rust- openssl crate (bsc#1270994).

This update for rust-keylime fixes the following issues:

Update to version 0.2.9+49.

Security issues fixed:

• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270174).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length (bsc#1270614).
• CVE-2026-41678: openssl: out-of-bounds write due to incorrect bounds assertion in aes::unwrap_key() (bsc#1270699).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check (bsc#1270792).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory to the network (bsc#1270842).
• CVE-2026-42327: openssl: undefined behavior in X509Ref::ocsp_responders for certificates with non-UTF-8 OCSP URLs (bsc#1270523).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding due to incorrectly sized output buffers (bsc#1270903).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers due to incorrectly sized output buffer (bsc#1270999).

Other updates and bugfixes:

• Update openssl to 0.10.81.
• Make tss-esai-sys depend on bindgen 72.1 to support llvm > 21.
• Build with Clang <= 21 (bsc#1260596).
• Version 0.2.9+49:
  • build(deps): bump uuid from 1.23.3 to 1.23.4
  • build(deps): bump syn from 2.0.117 to 2.0.118
  • build(deps): bump openssl from 0.10.80 to 0.10.81
  • build(deps): bump rand from 0.9.4 to 0.10.1
  • Added new regression test into packit-ci.yaml
  • build(deps): bump actions/checkout from 6 to 7
  • build(deps): bump uuid from 1.23.1 to 1.23.3
  • build(deps): bump log from 0.4.29 to 0.4.32
  • build(deps): bump http from 1.4.0 to 1.4.2
  • build(deps): bump codecov/codecov-action from 6 to 7
  • build(deps): bump retry-policies from 0.5.1 to 0.5.2
  • fix: Remove unused base64::Engine import in context_info tests
  • build(deps): bump reqwest-middleware from 0.5.1 to 0.5.2
  • build(deps): bump serde_json from 1.0.149 to 1.0.150
  • build(deps): bump openssl from 0.10.79 to 0.10.80
  • agent: Hash agent ID before TPM2_Certify qualifying data
  • cargo: Bump tss-esapi, picky-asn1-x509, and picky-asn1-der
  • build(deps): bump openssl from 0.10.78 to 0.10.79
  • build(deps): bump once_cell from 1.21.3 to 1.21.4
  • build(deps): bump tempfile from 3.23.0 to 3.27.0
  • push-model: cache UEFI event log bytes at startup
  • build(deps): bump quote from 1.0.40 to 1.0.45
  • build(deps): bump chrono from 0.4.42 to 0.4.44
  • build(deps): bump openssl from 0.10.73 to 0.10.78
  • build(deps): bump serde_json from 1.0.143 to 1.0.149
  • build(deps): bump syn from 2.0.106 to 2.0.117
  • build(deps): bump libc from 0.2.175 to 0.2.184
  • build(deps): bump rand from 0.9.2 to 0.9.4
• Version 0.2.9+21:
  • tests: use Express-style named params in Mockoon endpoints
  • build(deps): bump pest_derive from 2.8.1 to 2.8.6
  • build(deps): bump trybuild from 1.0.110 to 1.0.115
  • build(deps): bump log from 0.4.28 to 0.4.29
  • build(deps): bump uuid from 1.19.0 to 1.20.0
  • build(deps): bump codecov/codecov-action from 5 to 6
  • build(deps): bump tracing-subscriber from 0.3.20 to 0.3.23
  • build(deps): bump cfg-if from 1.0.3 to 1.0.4
  • build(deps): bump tokio from 1.49.0 to 1.50.0
  • build(deps): bump actix-web from 4.12.1 to 4.13.0
  • build(deps): bump anyhow from 1.0.99 to 1.0.102
  • build(deps): bump clap from 4.5.57 to 4.5.60
  • build(deps): bump tracing from 0.1.36 to 0.1.44

This update for afterburn fixes the following issues

Update to version 5.10.0.git73.b97f772.

Security issues fixed:

• CVE-2022-24713: regex: high complexity when parsing regexes with large repetitions on empty sub-expressions can lead to DoS (bsc#1196972).
• CVE-2024-12224: idna: privilege escalation due acceptance Punycode labels that do not produce any non-ASCII when decoded (bsc#1243850).
• CVE-2025-3416: openssl: use-after-free in Md::fetch and Cipher::fetch (bsc#1242665).
• CVE-2025-5791: users: root appended to group listings unless the correct listing has exactly 1024 groups (bsc#1244199).
• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270175).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length (bsc#1270555).
• CVE-2026-41678: openssl: incorrect bounds assertion in aes::unwrap_key() can lead to OOB write (bsc#1270651).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check (bsc#1270787).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory to network peers (bsc#1270817).
• CVE-2026-42327: openssl: undefined behavior in X509Ref::ocsp_responders when processing certificates with non-UTF-8 OCSP URLs (bsc#1270483).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding (bsc#1270886).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers (bsc#1270949).
• CVE-2026-25541: bytes: integer overflow in BytesMut:reserve can lead to undefined behavior and crashes (bsc#1271348).

Other updates and bugfixes:

• Version 5.10.0.git73.b97f772:
  • build(deps): bump anyhow from 1.0.99 to 1.0.103 https://github.com/coreos/afterburn/pull/1284
  • build(deps): bump libflate from 2.1.0 to 2.2.2 https://github.com/coreos/afterburn/pull/1283
  • build(deps): bump openssl from 0.10.79 to 0.10.80 https://github.com/coreos/afterburn/pull/1277
• Version 5.10.0.git70.9cc2a7b:
  • build(deps): bump openssl from 0.10.78 to 0.10.79
  • providers/hetzner: Add the HETZNER_PUBLIC_IPV6 attribute
  • providers/hetzner: Add support for network configuration
  • build(deps): bump rustls-webpki from 0.103.10 to 0.103.13
  • build(deps): bump openssl from 0.10.73 to 0.10.78
  • docs: Add AGENTS.md and CLAUDE.md for AI coding assistants
  • build(deps): bump rand from 0.9.2 to 0.9.4
  • opencode: add skills for provider scaffolding and release automation
  • ibmcloud-classic: Add missing network_id to fixture
  • kubevirt: Support static gateway and DNS with DHCP
  • build(deps): bump rustls-webpki from 0.103.6 to 0.103.10
  • fix(proxmoxve): Define DNS entries for every interface
  • Makefile: download 90-afterburn-authorized-keys-file.conf for rpm building
  • Sync repo templates ⚙
  • build(deps): bump bytes from 1.10.1 to 1.11.1
  • util/dhcp: Fix clippy lints
  • build(deps): bump actions/checkout from 4 to 6
  • build(deps): bump actions/upload-artifact from 4 to 5
  • kubevirt: modprobe for virtio_blk; remove dracut preload
  • kubevirt: Add NoCloud network configuration support
  • kubevirt: Support config drive network data
  • kubevirt: Refactor the provider to follow the proxmoxve structure
  • dracut: Add virtio_blk module preload to afterburn-network-kargs service
  • docs: Add release notes
  • cargo: Afterburn release 5.10.0
• Version 5.10.0:
  • docs/release-notes: update for release 5.10.0
  • cargo: update dependencies
  • microsoft/azure: Add XML attribute alias for serde-xml-rs Fedora compat
  • docs/release-notes: Add entry for Azure SharedConfig XML parsing fix
  • microsoft/azure: Fix SharedConfig parsing of XML attributes
  • microsoft/azure: Mock goalstate.SharedConfig output in tests
  • providers/azure: switch SSH key retrieval from certs endpoint to…

This update for rust-keylime fixes the following issues

Update to version 0.2.9+49.

Security issues fixed:

• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270174).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length (bsc#1270614).
• CVE-2026-41678: openssl: out-of-bounds write due to incorrect bounds assertion in aes::unwrap_key() (bsc#1270699).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check (bsc#1270792).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory to the network (bsc#1270842).
• CVE-2026-42327: openssl: undefined behavior in X509Ref::ocsp_responders for certificates with non-UTF-8 OCSP URLs (bsc#1270523).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding due to incorrectly sized output buffers (bsc#1270903).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers due to incorrectly sized output buffer (bsc#1270999).

Other updates and bugfixes:

• Update openssl to 0.10.81.
• Make tss-esai-sys depend on bindgen 72.1 to support llvm > 21.
• Build with Clang <= 21 (bsc#1260596).
• Version 0.2.9+49:
  • build(deps): bump uuid from 1.23.3 to 1.23.4
  • build(deps): bump syn from 2.0.117 to 2.0.118
  • build(deps): bump openssl from 0.10.80 to 0.10.81
  • build(deps): bump rand from 0.9.4 to 0.10.1
  • Added new regression test into packit-ci.yaml
  • build(deps): bump actions/checkout from 6 to 7
  • build(deps): bump uuid from 1.23.1 to 1.23.3
  • build(deps): bump log from 0.4.29 to 0.4.32
  • build(deps): bump http from 1.4.0 to 1.4.2
  • build(deps): bump codecov/codecov-action from 6 to 7
  • build(deps): bump retry-policies from 0.5.1 to 0.5.2
  • fix: Remove unused base64::Engine import in context_info tests
  • build(deps): bump reqwest-middleware from 0.5.1 to 0.5.2
  • build(deps): bump serde_json from 1.0.149 to 1.0.150
  • build(deps): bump openssl from 0.10.79 to 0.10.80
  • agent: Hash agent ID before TPM2_Certify qualifying data
  • cargo: Bump tss-esapi, picky-asn1-x509, and picky-asn1-der
  • build(deps): bump openssl from 0.10.78 to 0.10.79
  • build(deps): bump once_cell from 1.21.3 to 1.21.4
  • build(deps): bump tempfile from 3.23.0 to 3.27.0
  • push-model: cache UEFI event log bytes at startup
  • build(deps): bump quote from 1.0.40 to 1.0.45
  • build(deps): bump chrono from 0.4.42 to 0.4.44
  • build(deps): bump openssl from 0.10.73 to 0.10.78
  • build(deps): bump serde_json from 1.0.143 to 1.0.149
  • build(deps): bump syn from 2.0.106 to 2.0.117
  • build(deps): bump libc from 0.2.175 to 0.2.184
  • build(deps): bump rand from 0.9.2 to 0.9.4
• Version 0.2.9+21:
  • tests: use Express-style named params in Mockoon endpoints
  • build(deps): bump pest_derive from 2.8.1 to 2.8.6
  • build(deps): bump trybuild from 1.0.110 to 1.0.115
  • build(deps): bump log from 0.4.28 to 0.4.29
  • build(deps): bump uuid from 1.19.0 to 1.20.0
  • build(deps): bump codecov/codecov-action from 5 to 6
  • build(deps): bump tracing-subscriber from 0.3.20 to 0.3.23
  • build(deps): bump cfg-if from 1.0.3 to 1.0.4
  • build(deps): bump tokio from 1.49.0 to 1.50.0
  • build(deps): bump actix-web from 4.12.1 to 4.13.0
  • build(deps): bump anyhow from 1.0.99 to 1.0.102
  • build(deps): bump clap from 4.5.57 to 4.5.60
  • build(deps): bump tracing from 0.1.36 to 0.1.44

This update for afterburn fixes the following issues:

Update to version 5.10.0.git73.b97f772.

Security issues fixed:

• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270175).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length (bsc#1270555).
• CVE-2026-41678: openssl: incorrect bounds assertion in aes::unwrap_key() can lead to OOB write (bsc#1270651).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check (bsc#1270787).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory to network peers (bsc#1270817).
• CVE-2026-42327: openssl: undefined behavior in X509Ref::ocsp_responders when processing certificates with non-UTF-8 OCSP URLs (bsc#1270483).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding (bsc#1270886).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers (bsc#1270949).
• CVE-2026-25541: bytes: integer overflow in BytesMut:reserve can lead to undefined behavior and crashes (bsc#1271348).

Other updates and bugfixes:

• Version 5.10.0.git73.b97f772:
  • build(deps): bump anyhow from 1.0.99 to 1.0.103 https://github.com/coreos/afterburn/pull/1284
  • build(deps): bump libflate from 2.1.0 to 2.2.2 https://github.com/coreos/afterburn/pull/1283
  • build(deps): bump openssl from 0.10.79 to 0.10.80 https://github.com/coreos/afterburn/pull/1277
• Version 5.10.0.git70.9cc2a7b:
  • build(deps): bump openssl from 0.10.78 to 0.10.79
  • providers/hetzner: Add the HETZNER_PUBLIC_IPV6 attribute
  • providers/hetzner: Add support for network configuration
  • build(deps): bump rustls-webpki from 0.103.10 to 0.103.13
  • build(deps): bump openssl from 0.10.73 to 0.10.78
  • docs: Add AGENTS.md and CLAUDE.md for AI coding assistants
  • build(deps): bump rand from 0.9.2 to 0.9.4
  • opencode: add skills for provider scaffolding and release automation
  • ibmcloud-classic: Add missing network_id to fixture
  • kubevirt: Support static gateway and DNS with DHCP
  • build(deps): bump rustls-webpki from 0.103.6 to 0.103.10
  • fix(proxmoxve): Define DNS entries for every interface
  • Makefile: download 90-afterburn-authorized-keys-file.conf for rpm building
  • Sync repo templates ⚙
  • build(deps): bump bytes from 1.10.1 to 1.11.1
  • util/dhcp: Fix clippy lints
  • build(deps): bump actions/checkout from 4 to 6
  • build(deps): bump actions/upload-artifact from 4 to 5
  • kubevirt: modprobe for virtio_blk; remove dracut preload
  • kubevirt: Add NoCloud network configuration support
  • kubevirt: Support config drive network data
  • kubevirt: Refactor the provider to follow the proxmoxve structure
  • dracut: Add virtio_blk module preload to afterburn-network-kargs service
  • docs: Add release notes
  • cargo: Afterburn release 5.10.0
• Version 5.10.0:
  • docs/release-notes: update for release 5.10.0
  • cargo: update dependencies
  • microsoft/azure: Add XML attribute alias for serde-xml-rs Fedora compat
  • docs/release-notes: Add entry for Azure SharedConfig XML parsing fix
  • microsoft/azure: Fix SharedConfig parsing of XML attributes
  • microsoft/azure: Mock goalstate.SharedConfig output in tests
  • providers/azure: switch SSH key retrieval from certs endpoint to IMDS
  • build(deps): bump the build group with 8 updates
  • build(deps): bump slab from 0.4.10 to 0.4.11
  • build(deps): bump actions/checkout from 4 to 5
  • upcloud: implement UpCloud provider
  • build(deps): bump the build group with 4 updates

This update for himmelblau fixes the following issues:

Update to version 2.3.14+git0.e23b4c54.

Security issues fixed:

• CVE-2026-45784: incorrect sizing of output buffers in CipherCtxRef::cipher_update_inplace when used with AES key-wrap-with-padding ciphers can lead to attacker-controlled heap corruption (bsc#1270985).
• Arbitrary HTTP or HTTPS URLs classified as Office documents based on an attacker-controlled file query parameters are forwarded to Electron applications and allow for code execution through Electron (bsc#1273910).
• Directory-provided RFC2307 user identifiers accepted without exclusion of systemd's dynamic-user range allows for daemon impersonation and command execution through the task helper (bsc#1273911).
• Daemon acts on Hello PIN enrollment requests whose identity claims it never cryptographically verifies and allows for local authentication bypass (bsc#1273912).

Other updates and bugfixes:

• Version 2.3.14+git0.e23b4c54:
  • fix(nss): avoid locked shadow entries
  • fix(deps): update libhimmelblau lockfile
  • fix(pam): make account denials terminal
  • debian: make the pam_allow_groups denial terminal in the account phase
• Version 2.3.13:
  • Update cargo vet audits for backport
  • Fix cargo-fuzz install in fuzz CI
  • cargo vet
  • Update ldap3_proto to 0.7.1
  • Update openssl
• Version 2.3.12:
  • Remove invalid himmelblau.conf example info
  • Fix SSHd configuration load order on Fedora/RHEL systems
  • himmelblau-init-hsm-pin: don't bind the hsm-pin to PCR7
  • qr-greeter: support GNOME Shell 50
  • Update libhimmelblau to latest version
  • deps(rust): bump tonic in the all-cargo-updates group across 1 directory
  • cargo audit

This update for snpguest fixes the following issues:

• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length (bsc#1270541).
• CVE-2026-41678: openssl: OOB write due to incorrect bounds assertion in aes::unwrap_key() (bsc#1270642).
• CVE-2026-41681: openssl: stack corruption due to MdCtxRef::digest_final() writing past caller buffer with no length check (bsc#1270720).
• CVE-2026-41898: openssl: information leak to network peers due to unchecked callback-returned length in PSK and cookie generate trampolines (bsc#1270799).
• CVE-2026-42327: openssl: undefined behavior in X509Ref::ocsp_responders when processing certificates with non-UTF-8 OCSP URLs (bsc#1270527).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding (bsc#1270873).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers (bsc#1270947).

This update for snphost fixes the following issues:

• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length (bsc#1270541).
• CVE-2026-41678: openssl: OOB write due to incorrect bounds assertion in aes::unwrap_key() (bsc#1270642).
• CVE-2026-41681: openssl: stack corruption due to MdCtxRef::digest_final() writing past caller buffer with no length check (bsc#1270720).
• CVE-2026-41898: openssl: information leak to network peers due to unchecked callback-returned length in PSK and cookie generate trampolines (bsc#1270799).
• CVE-2026-42327: openssl: undefined behavior in X509Ref::ocsp_responders when processing certificates with non-UTF-8 OCSP URLs (bsc#1270527).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding (bsc#1270873).
• CVE-2026-45784: openssl: OOB write due to incorrectly sized output buffers in CipherCtxRef::cipher_update_inplace when it is used with AES key-wrap-with-padding ciphers (bsc#1270947).

This update for sccache fixes the following issues:

• CVE-2024-12224: idna: idna accepts Punycode labels that do not produce any non-ASCII when decoded (bsc#1243868).
• CVE-2026-25541: bytes: integer overflow in 'BytesMut:reserve' can lead to undefined behavior and crashes (bsc#1274146).
• CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion (bsc#1257923).
• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270206).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length in rust- openssl crate (bsc#1270559).
• CVE-2026-41678: openssl: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270693).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check in rust-openssl crate (bsc#1270736).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory in rust-openssl crate (bsc#1270869).
• CVE-2026-42327: openssl: arbitrary code execution via specially crafted certificate in rust-openssl crate (bsc#1270512).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-openssl crate (bsc#1270938).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers in rust- openssl crate (bsc#1270948).
• CVE-2026-66746: rouille: HTTP Response Splitting via Unvalidated Response Header Values (bsc#1273881).
• CVE-2026-66754: rouille: remove_prefix function that allows remote unauthenticated attackers to crash the server by sending a crafted percent-encoded URL (bsc#1273884).
• CVE-2026-67181: rouille: HTTP Request Smuggling via Transfer-Encoding Desynchronization (bsc#1273886).
• CVE-2026-67182: rouille: HTTP Request Smuggling Enables Front-End Access Control Bypass (bsc#1273888).
• CVE-2026-93599: rustls-webpki: panic via empty BIT STRING (bsc#1282211).
• CVE-2026-93600: rustls-webpki: name constraints URI validation bypass (bsc#1282211).
• CVE-2026-93601: rustls-webpki: name constraint bypass (bsc#1282211).
• CVE-2026-93602: rustls-webpki: CRL revocation check bypass (bsc#1282211).

Changes for sccache:

Update to version 0.18.0~2:

• Add experimental concurrent cache support
• chore: Remove dependency status badge (#2856)
• Don't hand the jobserver to children that can't use it
• dist: refuse to trim rlibs from crates that also emit a cdylib
• fix(cache): avoid duplicate multilevel reads
• Strip basedirs from the compiler arguments too
• tests/integration: replace MinIO with Silo
• ci: dump sccache logs on integration failures
• multilevel: a chain with any writable level is writable
• Fix parsing of #line directives
• Release 0.18.0
• daemonize: use an allow-list approach to inherited FDs
• gcc, clang: make the assembler part of the cache key
• support cl.exe /openmp:llvm
• support all current /fsanitize*, /fsanitize-coverage*, and /fno-sanitize* args
• support MSVC /feature argument
• msvc: support lots of flags (#2832)
• Update shlex dependency to version 2 (#2836)
• gcc: mark flags as TooHard if need to cache something else (#2833)
• clang: support more CLI options (#2834)
• msvc: support arm64EC and fastfail flags (#2830)
• chore: fix typo in comment (#2829)
• nvcc: accept the --diag-error/--diag-suppress/--diag-warn family (#2816)
• cache: allow skipping capability checks (#2822)
• Bump opendal to 0.58.1 and fix fallout (fixes local GCS cache usage) (#2715)
• nvcc (Windows): protect escaped quotes in dryrun lines before flattening backslashes (#2811)
• Add an agent (#2812)
• Add support for d20bforceinline. (#2807)
• feat: add Microsoft Entra ID (passwordless) auth for the Azure Blob backend (#2802)
• Bump MSRV to 1.91.0 (#2793)
• Fix nvcc dryrun parsing for CUDA 13.3 (#2722)
• test: Fixed…

This update for rustup fixes the following issues:

• CVE-2024-12224: idna: idna accepts Punycode labels that do not produce any non-ASCII when decoded (bsc#1243862).
• CVE-2025-58160: tracing-subscriber: Tracing log pollution (bsc#1249008).
• CVE-2026-25541: bytes: integer overflow in 'BytesMut:reserve' can lead to undefined behavior and crashes (bsc#1274144).
• CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion (bsc#1257902).
• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270186).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length in rust- openssl crate (bsc#1270619).
• CVE-2026-41678: openssl: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270644).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check in rust-openssl crate (bsc#1270795).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory in rust-openssl crate (bsc#1270870).
• CVE-2026-42327: openssl: arbitrary code execution via specially crafted certificate in rust-openssl crate (bsc#1270521).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-openssl crate (bsc#1270874).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers in rust- openssl crate (bsc#1270989).
• CVE-2026-93599: rustls-webpki: panic via empty BIT STRING (bsc#1282217).
• CVE-2026-93600: rustls-webpki: name constraints URI validation bypass (bsc#1282217).
• CVE-2026-93601: rustls-webpki: name constraint bypass (bsc#1282217).
• CVE-2026-93602: rustls-webpki: CRL revocation check bypass (bsc#1282217).
• rust-shlex: Multiple issues involving quote API (RUSTSEC-2024-0006, GHSA-r7qv-8r2h-pg27) (bsc#1230032).

Changes for rustup:

• Update to version 1.29.1~0:

• dist(rustup-init/sh): update commit shasum in help string
• style(bin/rustup-init): reformat code
• docs(changelog): update for v1.29.1 stable release
• warn how to switch away from the deprecated complete profile
• fix(cli/help): fix wording in rustup run --help
• ci(docker/android): stop building OpenSSL
• refactor(cli/docs): use tracing for docs opening status messages
• refactor(self-update): rename Windows uninstall registry helpers
• feat(test): isolate Windows registry state per test
• docs(dev-guide): mention how to support new compilation targets
• Fix funding link
• chore(deps): lock file maintenance
• refactor(cli/self-update): move current_install_opts() to InstallOpts::display()
• refactor(cli/self-update): move process out of InstallOpts
• fix(cli/self-update): postpone initialization of Cfg in setup_mode
• refactor(cli/self-update): take Process in check_existence_of_settings_file()
• fix(settings): prevent creating new file with SettingsFile::read_settings()
• test(cli-inst-interactive): test file creation on cancelled installation
• refactor(toolchain/names): inline validate() aliases into FromStr
• refactor(toolchain/names): rename validate() to normalize_name()
• fix minor typos
• www: align copy icon
• refactor(toolchain/names)!: remove try_from_str!()
• refactor(toolchain/names)!: remove from_variant!()
• Add rustup doc --serve to serve docs over local HTTP
• Move doc() and man() into a new docs module
• chore(github): comment out instructions in PR template
• docs(dev-guide): reapply abandoned changes from #4970
• Add riscv64 unknown linux musl support
• fix(deps): update rust crate enum-map to v3
• refactor(cli/self-update)!: rename install() to InstallOpts::install()
• refactor(cli/self-update)!: rename maybe_install_rust() to InstallOpts::install_rust()
• refactor(cli/self-update)!: rename…

This update for rust-keylime fixes the following issues

• Update to version 0.2.9+49
• Update openssl to 0.10.81
• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270174).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length in rust-openssl crate (bsc#1270614).
• CVE-2026-41678: openssl: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270699).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check in rust-openssl crate (bsc#1270792).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory in rust-openssl crate (bsc#1270842).
• CVE-2026-42327: openssl: arbitrary code execution via specially crafted certificate in rust-openssl crate (bsc#1270523).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-openssl crate (bsc#1270903).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers in rust-openssl crate (bsc#1270999).

This update for rust-keylime fixes the following issues

• Update to version 0.2.9+49
• Update openssl to 0.10.81
• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270174).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length in rust-openssl crate (bsc#1270614).
• CVE-2026-41678: openssl: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270699).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check in rust-openssl crate (bsc#1270792).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory in rust-openssl crate (bsc#1270842).
• CVE-2026-42327: openssl: arbitrary code execution via specially crafted certificate in rust-openssl crate (bsc#1270523).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-openssl crate (bsc#1270903).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers in rust-openssl crate (bsc#1270999).