CVE-2025-5791

A flaw was found in the user's crate for Rust. This vulnerability allows privilege escalation via incorrect group listing when a user or process has fewer than exactly 1024 groups, leading to the erroneous inclusion of the root group in the access list.

A flaw was found in the user's crate for Rust. This vulnerability allows privilege escalation via incorrect group listing when a user or process has fewer than exactly 1024 groups, leading to the erroneous inclusion of the root group in the access list.

These are all security issues fixed in the flake-pilot-3.1.19-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the mirrorsorcerer-0.1.3~1-1.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the afterburn-5.8.2-3.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the agama-17+60.68fdb92ec-26.1 package on the GA media of openSUSE Tumbleweed.

These are all security issues fixed in the lsd-1.2.0-1.1 package on the GA media of openSUSE Tumbleweed.

Affected versions append root to group listings, unless the correct listing has exactly 1024 groups.

This affects both:

• The supplementary groups of a user
• The group access list of the current process

If the caller uses this information for access control, this may lead to privilege escalation.

This crate is not currently maintained, so a patched version is not available.

Versions older than 0.8.0 do not contain the affected functions, so downgrading to them is a workaround.

Recommended alternatives

• uzers (an actively maintained fork of the users crate)
• sysinfo

This update for afterburn fixes the following issues:

• Update to version 5.9.0.git21.a73f509:

  • docs/release-notes: update for release 5.10.0
  • cargo: update dependencies
  • microsoft/azure: Add XML attribute alias for serde-xml-rs Fedora compat
  • docs/release-notes: Add entry for Azure SharedConfig XML parsing fix
  • microsoft/azure: Fix SharedConfig parsing of XML attributes
  • microsoft/azure: Mock goalstate.SharedConfig output in tests
  • providers/azure: switch SSH key retrieval from certs endpoint to IMDS as azure stopped providing keys in the old one (bsc#1250471)
  • build(deps): bump the build group with 8 updates
  • build(deps): bump slab from 0.4.10 to 0.4.11
  • build(deps): bump actions/checkout from 4 to 5
  • upcloud: implement UpCloud provider
  • build(deps): bump the build group with 4 updates
  • Sync repo templates ⚙

• Update to version 5.9.0:

  • cargo: Afterburn release 5.9.0
  • docs/release-notes: update for release 5.9.0
  • cargo: update dependencies
  • Add TMT test structure and basic smoke test
  • build(deps): bump openssl from 0.10.72 to 0.10.73
  • build(deps): bump reqwest from 0.12.15 to 0.12.18
  • docs/release-notes: Update changelog entry
  • dracut: Return 255 in module-setup
  • oraclecloud: add release note and move base URL to constant
  • oraclecloud: implement oraclecloud provider
  • build(deps): bump nix from 0.29.0 to 0.30.1
  • build(deps): bump zbus from 5.7.0 to 5.7.1
  • build(deps): bump serde-xml-rs from 0.6.0 to 0.8.1
  • build(deps): bump ipnetwork from 0.20.0 to 0.21.1
  • build(deps): bump clap from 4.5.38 to 4.5.39

This update for afterburn fixes the following issues:

• Update to version 5.9.0.git21.a73f509:

  • docs/release-notes: update for release 5.10.0
  • cargo: update dependencies
  • microsoft/azure: Add XML attribute alias for serde-xml-rs Fedora compat
  • docs/release-notes: Add entry for Azure SharedConfig XML parsing fix
  • microsoft/azure: Fix SharedConfig parsing of XML attributes
  • microsoft/azure: Mock goalstate.SharedConfig output in tests
  • providers/azure: switch SSH key retrieval from certs endpoint to IMDS as azure stopped providing keys in the old one (bsc#1250471)
  • build(deps): bump the build group with 8 updates
  • build(deps): bump slab from 0.4.10 to 0.4.11
  • build(deps): bump actions/checkout from 4 to 5
  • upcloud: implement UpCloud provider
  • build(deps): bump the build group with 4 updates
  • Sync repo templates ⚙

• Update to version 5.9.0:

  • cargo: Afterburn release 5.9.0
  • docs/release-notes: update for release 5.9.0
  • cargo: update dependencies
  • Add TMT test structure and basic smoke test
  • build(deps): bump openssl from 0.10.72 to 0.10.73
  • build(deps): bump reqwest from 0.12.15 to 0.12.18
  • docs/release-notes: Update changelog entry
  • dracut: Return 255 in module-setup
  • oraclecloud: add release note and move base URL to constant
  • oraclecloud: implement oraclecloud provider
  • build(deps): bump nix from 0.29.0 to 0.30.1
  • build(deps): bump zbus from 5.7.0 to 5.7.1
  • build(deps): bump serde-xml-rs from 0.6.0 to 0.8.1
  • build(deps): bump ipnetwork from 0.20.0 to 0.21.1
  • build(deps): bump clap from 4.5.38 to 4.5.39

This update for himmelblau fixes the following issues:

• CVE-2025-5791: Fixed using deprecated users crate (bsc#1244202)
• CVE-2025-3416: Fixed use-After-Free in Md::fetch and Cipher::fetch in rust-openssl crate (bsc#1242648)

Update to version 0.7.17+git.0.1ebdab0

• Update sccache-action version to use new cache service

This update for afterburn fixes the following issues:

Update to version 5.9.0.git21.a73f509.

Security issues fixed:

• CVE-2022-24713: regex: no proper complexity limitation when parsing untrusted regular expressions with large repetitions on empty sub-expressions can lead to excessive resource consumption and denial of service (bsc#1196972).
• CVE-2024-12224: idna: acceptance of Punycode labels that do not produce any non-ASCII output may lead to incorrect hostname comparisons and incorrect URL parsing (bsc#1243850).
• CVE-2025-5791: users: root user being appended to group listings whenever listing does not have exactly 1024 groups can lead to privilege escalation when information is used for access control (bsc#1244199).
• CVE-2025-3416: openssl: passing of Some(...) value as properties argument to Md::fetch or Cipher::fetch can lead to use-after-free (bsc#1242665).

Other issues fixed:

• Fixed in version 5.9.0.git21.a73f509:

  • cargo: update dependencies
  • microsoft/azure: Add XML attribute alias for serde-xml-rs Fedora compat
  • microsoft/azure: Fix SharedConfig parsing of XML attributes
  • microsoft/azure: Mock goalstate.SharedConfig output in tests
  • providers/azure: switch SSH key retrieval from certs endpoint to IMDS as azure stopped providing keys in the old one (bsc#1250471).
  • upcloud: implement UpCloud provider
  • Update several build dependencies

• Fixed in version 5.9.0:

  • cargo: update dependencies
  • dracut: Return 255 in module-setup
  • oraclecloud: add release note and move base URL to constant
  • oraclecloud: implement oraclecloud provider
  • Update several build dependencies

• Fixed in version 5.8.2:

  • cargo: update dependencies
  • packit: add initial support

• Fixed in version 5.7.0.git103.bae893c:

  • proxmoxve: Add more context to log messages.
  • proxmoxve: Remove unneeded fields
  • proxmoxve: Add tests for static network configuration from cloud-init.
  • proxmoxve: Add support for static network configuration from cloud-init.
  • providers/openstack: ignore ec2 metadata if not present
  • proxmox: use noop provider if no configdrive
  • Update several build dependencies

• Fixed in version 5.7.0:

  • cargo: update dependencies
  • dhcp: replace dbus_proxy with proxy, and zbus traits
  • providers/hetzner: private ipv4 addresses in attributes
  • openstack: Document the two platforms
  • microsoft/azure: allow empty certificate chain in PKCS12 file
  • proxmoxve: implement proxmoxve provider
  • providers/hetzner: fix duplicate attribute prefix
  • lint: silence deadcode warnings
  • lint: address latest lint's from msrv update
  • cargo: update msrv to 1.75
  • providers: Add 'akamai' provider
  • providers/vmware: add missing public functions for non-amd64
  • providers/vmware: Process guestinfo.metadata netplan configuration
  • kubevirt: Run afterburn-hostname service
  • providers: add support for scaleway
  • Move away from deprecated users to uzers
  • providers/hetzner: add support for Hetzner Cloud
  • cargo: update MSRV to 1.71
  • cargo: specify required features for nix dependency
  • openstack: Add attribute OPENSTACK_INSTANCE_UUID
  • cargo: allow openssl 0.10.46
  • build-sys: Use new tier = 2 for cargo-vendor-filterer
  • cargo: fix minimum version of openssl crate
  • microsoft/crypto/mod: replace deprecated function parse with parse2
  • cli: switch to clap derive
  • cli: add descriptive value names for option arguments in --help
  • cli: have clap require exactly one of --cmdline/--provider
  • providers/*: move endpoint mocking into retry::Client
  • retry/client: move URL parsing into helper function
  • providers/microsoft: import crate::retry
  • providers/microsoft: use stored client for all fetches
  • providers/packet: use stored client for boot checkin
  • initrd: remember to write trailing newline to network kargs file
  • util: drop obsolete 'OEM' terminology
  • Inline variables into format strings
  • Update…

This update for afterburn fixes the following issues:

Update to version 5.9.0.git21.a73f509.

Security issues fixed:

• CVE-2022-24713: regex: no proper complexity limitation when parsing untrusted regular expressions with large repetitions on empty sub-expressions can lead to excessive resource consumption and denial of service (bsc#1196972).
• CVE-2024-12224: idna: acceptance of Punycode labels that do not produce any non-ASCII output may lead to incorrect hostname comparisons and incorrect URL parsing (bsc#1243850).
• CVE-2025-5791: users: root user being appended to group listings whenever listing does not have exactly 1024 groups can lead to privilege escalation when information is used for access control (bsc#1244199).
• CVE-2025-3416: openssl: passing of Some(...) value as properties argument to Md::fetch or Cipher::fetch can lead to use-after-free (bsc#1242665).

Other issues fixed:

• Fixed in version 5.9.0.git21.a73f509:

  • cargo: update dependencies
  • microsoft/azure: Add XML attribute alias for serde-xml-rs Fedora compat
  • microsoft/azure: Fix SharedConfig parsing of XML attributes
  • microsoft/azure: Mock goalstate.SharedConfig output in tests
  • providers/azure: switch SSH key retrieval from certs endpoint to IMDS as azure stopped providing keys in the old one (bsc#1250471).
  • upcloud: implement UpCloud provider
  • Update several build dependencies

• Fixed in version 5.9.0:

  • cargo: update dependencies
  • dracut: Return 255 in module-setup
  • oraclecloud: add release note and move base URL to constant
  • oraclecloud: implement oraclecloud provider
  • Update several build dependencies

• Fixed in version 5.8.2:

  • cargo: update dependencies
  • packit: add initial support

• Fixed in version 5.7.0.git103.bae893c:

  • proxmoxve: Add more context to log messages.
  • proxmoxve: Remove unneeded fields
  • proxmoxve: Add tests for static network configuration from cloud-init.
  • proxmoxve: Add support for static network configuration from cloud-init.
  • providers/openstack: ignore ec2 metadata if not present
  • proxmox: use noop provider if no configdrive
  • Update several build dependencies

• Fixed in version 5.7.0:

  • cargo: update dependencies
  • dhcp: replace dbus_proxy with proxy, and zbus traits
  • providers/hetzner: private ipv4 addresses in attributes
  • openstack: Document the two platforms
  • microsoft/azure: allow empty certificate chain in PKCS12 file
  • proxmoxve: implement proxmoxve provider
  • providers/hetzner: fix duplicate attribute prefix
  • lint: silence deadcode warnings
  • lint: address latest lint's from msrv update
  • cargo: update msrv to 1.75
  • providers: Add 'akamai' provider
  • providers/vmware: add missing public functions for non-amd64
  • providers/vmware: Process guestinfo.metadata netplan configuration
  • kubevirt: Run afterburn-hostname service
  • providers: add support for scaleway
  • Move away from deprecated users to uzers
  • providers/hetzner: add support for Hetzner Cloud
  • cargo: update MSRV to 1.71
  • cargo: specify required features for nix dependency
  • openstack: Add attribute OPENSTACK_INSTANCE_UUID
  • cargo: allow openssl 0.10.46
  • build-sys: Use new tier = 2 for cargo-vendor-filterer
  • cargo: fix minimum version of openssl crate
  • microsoft/crypto/mod: replace deprecated function parse with parse2
  • cli: switch to clap derive
  • cli: add descriptive value names for option arguments in --help
  • cli: have clap require exactly one of --cmdline/--provider
  • providers/*: move endpoint mocking into retry::Client
  • retry/client: move URL parsing into helper function
  • providers/microsoft: import crate::retry
  • providers/microsoft: use stored client for all fetches
  • providers/packet: use stored client for boot checkin
  • initrd: remember to write trailing newline to network kargs file
  • util: drop obsolete 'OEM' terminology
  • Inline variables into format strings
  • Update…

This update for afterburn fixes the following issues:

Update to version 5.9.0.git21.a73f509.

Security issues fixed:

• CVE-2022-24713: regex: no proper complexity limitation when parsing untrusted regular expressions with large repetitions on empty sub-expressions can lead to excessive resource consumption and denial of service (bsc#1196972).
• CVE-2024-12224: idna: acceptance of Punycode labels that do not produce any non-ASCII output may lead to incorrect hostname comparisons and incorrect URL parsing (bsc#1243850).
• CVE-2025-5791: users: root user being appended to group listings whenever listing does not have exactly 1024 groups can lead to privilege escalation when information is used for access control (bsc#1244199).
• CVE-2025-3416: openssl: passing of Some(...) value as properties argument to Md::fetch or Cipher::fetch can lead to use-after-free (bsc#1242665).

Other issues fixed:

• Fixed in version 5.9.0.git21.a73f509:

  • cargo: update dependencies
  • microsoft/azure: Add XML attribute alias for serde-xml-rs Fedora compat
  • microsoft/azure: Fix SharedConfig parsing of XML attributes
  • microsoft/azure: Mock goalstate.SharedConfig output in tests
  • providers/azure: switch SSH key retrieval from certs endpoint to IMDS as azure stopped providing keys in the old one (bsc#1250471).
  • upcloud: implement UpCloud provider
  • Update several build dependencies

• Fixed in version 5.9.0:

  • cargo: update dependencies
  • dracut: Return 255 in module-setup
  • oraclecloud: add release note and move base URL to constant
  • oraclecloud: implement oraclecloud provider
  • Update several build dependencies

• Fixed in version 5.8.2:

  • cargo: update dependencies
  • packit: add initial support

• Fixed in version 5.7.0.git103.bae893c:

  • proxmoxve: Add more context to log messages.
  • proxmoxve: Remove unneeded fields
  • proxmoxve: Add tests for static network configuration from cloud-init.
  • proxmoxve: Add support for static network configuration from cloud-init.
  • providers/openstack: ignore ec2 metadata if not present
  • proxmox: use noop provider if no configdrive
  • Update several build dependencies

• Fixed in version 5.7.0:

  • cargo: update dependencies
  • dhcp: replace dbus_proxy with proxy, and zbus traits
  • providers/hetzner: private ipv4 addresses in attributes
  • openstack: Document the two platforms
  • microsoft/azure: allow empty certificate chain in PKCS12 file
  • proxmoxve: implement proxmoxve provider
  • providers/hetzner: fix duplicate attribute prefix
  • lint: silence deadcode warnings
  • lint: address latest lint's from msrv update
  • cargo: update msrv to 1.75
  • providers: Add 'akamai' provider
  • providers/vmware: add missing public functions for non-amd64
  • providers/vmware: Process guestinfo.metadata netplan configuration
  • kubevirt: Run afterburn-hostname service
  • providers: add support for scaleway
  • Move away from deprecated users to uzers
  • providers/hetzner: add support for Hetzner Cloud
  • cargo: update MSRV to 1.71
  • cargo: specify required features for nix dependency
  • openstack: Add attribute OPENSTACK_INSTANCE_UUID
  • cargo: allow openssl 0.10.46
  • build-sys: Use new tier = 2 for cargo-vendor-filterer
  • cargo: fix minimum version of openssl crate
  • microsoft/crypto/mod: replace deprecated function parse with parse2
  • cli: switch to clap derive
  • cli: add descriptive value names for option arguments in --help
  • cli: have clap require exactly one of --cmdline/--provider
  • providers/*: move endpoint mocking into retry::Client
  • retry/client: move URL parsing into helper function
  • providers/microsoft: import crate::retry
  • providers/microsoft: use stored client for all fetches
  • providers/packet: use stored client for boot checkin
  • initrd: remember to write trailing newline to network kargs file
  • util: drop obsolete 'OEM' terminology
  • Inline variables into format strings
  • Update…

This update for afterburn fixes the following issues:

Update to version 5.9.0.git21.a73f509.

Security issues fixed:

• CVE-2022-24713: regex: no proper complexity limitation when parsing untrusted regular expressions with large repetitions on empty sub-expressions can lead to excessive resource consumption and denial of service (bsc#1196972).
• CVE-2024-12224: idna: acceptance of Punycode labels that do not produce any non-ASCII output may lead to incorrect hostname comparisons and incorrect URL parsing (bsc#1243850).
• CVE-2025-5791: users: root user being appended to group listings whenever listing does not have exactly 1024 groups can lead to privilege escalation when information is used for access control (bsc#1244199).
• CVE-2025-3416: openssl: passing of Some(...) value as properties argument to Md::fetch or Cipher::fetch can lead to use-after-free (bsc#1242665).

Other issues fixed:

• Fixed in version 5.9.0.git21.a73f509:

  • cargo: update dependencies
  • microsoft/azure: Add XML attribute alias for serde-xml-rs Fedora compat
  • microsoft/azure: Fix SharedConfig parsing of XML attributes
  • microsoft/azure: Mock goalstate.SharedConfig output in tests
  • providers/azure: switch SSH key retrieval from certs endpoint to IMDS as azure stopped providing keys in the old one (bsc#1250471).
  • upcloud: implement UpCloud provider
  • Update several build dependencies

• Fixed in version 5.9.0:

  • cargo: update dependencies
  • dracut: Return 255 in module-setup
  • oraclecloud: add release note and move base URL to constant
  • oraclecloud: implement oraclecloud provider
  • Update several build dependencies

• Fixed in version 5.8.2:

  • cargo: update dependencies
  • packit: add initial support

• Fixed in version 5.7.0.git103.bae893c:

  • proxmoxve: Add more context to log messages.
  • proxmoxve: Remove unneeded fields
  • proxmoxve: Add tests for static network configuration from cloud-init.
  • proxmoxve: Add support for static network configuration from cloud-init.
  • providers/openstack: ignore ec2 metadata if not present
  • proxmox: use noop provider if no configdrive
  • Update several build dependencies

• Fixed in version 5.7.0:

  • cargo: update dependencies
  • dhcp: replace dbus_proxy with proxy, and zbus traits
  • providers/hetzner: private ipv4 addresses in attributes
  • openstack: Document the two platforms
  • microsoft/azure: allow empty certificate chain in PKCS12 file
  • proxmoxve: implement proxmoxve provider
  • providers/hetzner: fix duplicate attribute prefix
  • lint: silence deadcode warnings
  • lint: address latest lint's from msrv update
  • cargo: update msrv to 1.75
  • providers: Add 'akamai' provider
  • providers/vmware: add missing public functions for non-amd64
  • providers/vmware: Process guestinfo.metadata netplan configuration
  • kubevirt: Run afterburn-hostname service
  • providers: add support for scaleway
  • Move away from deprecated users to uzers
  • providers/hetzner: add support for Hetzner Cloud
  • cargo: update MSRV to 1.71
  • cargo: specify required features for nix dependency
  • openstack: Add attribute OPENSTACK_INSTANCE_UUID
  • cargo: allow openssl 0.10.46
  • build-sys: Use new tier = 2 for cargo-vendor-filterer
  • cargo: fix minimum version of openssl crate
  • microsoft/crypto/mod: replace deprecated function parse with parse2
  • cli: switch to clap derive
  • cli: add descriptive value names for option arguments in --help
  • cli: have clap require exactly one of --cmdline/--provider
  • providers/*: move endpoint mocking into retry::Client
  • retry/client: move URL parsing into helper function
  • providers/microsoft: import crate::retry
  • providers/microsoft: use stored client for all fetches
  • providers/packet: use stored client for boot checkin
  • initrd: remember to write trailing newline to network kargs file
  • util: drop obsolete 'OEM' terminology
  • Inline variables into format strings
  • Update…

This update for afterburn fixes the following issues

Update to version 5.10.0.git73.b97f772.

Security issues fixed:

• CVE-2022-24713: regex: high complexity when parsing regexes with large repetitions on empty sub-expressions can lead to DoS (bsc#1196972).
• CVE-2024-12224: idna: privilege escalation due acceptance Punycode labels that do not produce any non-ASCII when decoded (bsc#1243850).
• CVE-2025-3416: openssl: use-after-free in Md::fetch and Cipher::fetch (bsc#1242665).
• CVE-2025-5791: users: root appended to group listings unless the correct listing has exactly 1024 groups (bsc#1244199).
• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270175).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length (bsc#1270555).
• CVE-2026-41678: openssl: incorrect bounds assertion in aes::unwrap_key() can lead to OOB write (bsc#1270651).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check (bsc#1270787).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory to network peers (bsc#1270817).
• CVE-2026-42327: openssl: undefined behavior in X509Ref::ocsp_responders when processing certificates with non-UTF-8 OCSP URLs (bsc#1270483).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding (bsc#1270886).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers (bsc#1270949).
• CVE-2026-25541: bytes: integer overflow in BytesMut:reserve can lead to undefined behavior and crashes (bsc#1271348).

Other updates and bugfixes:

• Version 5.10.0.git73.b97f772:
  • build(deps): bump anyhow from 1.0.99 to 1.0.103 https://github.com/coreos/afterburn/pull/1284
  • build(deps): bump libflate from 2.1.0 to 2.2.2 https://github.com/coreos/afterburn/pull/1283
  • build(deps): bump openssl from 0.10.79 to 0.10.80 https://github.com/coreos/afterburn/pull/1277
• Version 5.10.0.git70.9cc2a7b:
  • build(deps): bump openssl from 0.10.78 to 0.10.79
  • providers/hetzner: Add the HETZNER_PUBLIC_IPV6 attribute
  • providers/hetzner: Add support for network configuration
  • build(deps): bump rustls-webpki from 0.103.10 to 0.103.13
  • build(deps): bump openssl from 0.10.73 to 0.10.78
  • docs: Add AGENTS.md and CLAUDE.md for AI coding assistants
  • build(deps): bump rand from 0.9.2 to 0.9.4
  • opencode: add skills for provider scaffolding and release automation
  • ibmcloud-classic: Add missing network_id to fixture
  • kubevirt: Support static gateway and DNS with DHCP
  • build(deps): bump rustls-webpki from 0.103.6 to 0.103.10
  • fix(proxmoxve): Define DNS entries for every interface
  • Makefile: download 90-afterburn-authorized-keys-file.conf for rpm building
  • Sync repo templates ⚙
  • build(deps): bump bytes from 1.10.1 to 1.11.1
  • util/dhcp: Fix clippy lints
  • build(deps): bump actions/checkout from 4 to 6
  • build(deps): bump actions/upload-artifact from 4 to 5
  • kubevirt: modprobe for virtio_blk; remove dracut preload
  • kubevirt: Add NoCloud network configuration support
  • kubevirt: Support config drive network data
  • kubevirt: Refactor the provider to follow the proxmoxve structure
  • dracut: Add virtio_blk module preload to afterburn-network-kargs service
  • docs: Add release notes
  • cargo: Afterburn release 5.10.0
• Version 5.10.0:
  • docs/release-notes: update for release 5.10.0
  • cargo: update dependencies
  • microsoft/azure: Add XML attribute alias for serde-xml-rs Fedora compat
  • docs/release-notes: Add entry for Azure SharedConfig XML parsing fix
  • microsoft/azure: Fix SharedConfig parsing of XML attributes
  • microsoft/azure: Mock goalstate.SharedConfig output in tests
  • providers/azure: switch SSH key retrieval from certs endpoint to…

This update for afterburn fixes the following issues:

Update to version 5.10.0.git73.b97f772.

Security issues fixed:

• CVE-2026-41676: openssl: Deriver:derive and PkeyCtxRef:derive can overflow short buffers on OpenSSL 1.1.1 (bsc#1270175).
• CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length (bsc#1270555).
• CVE-2026-41678: openssl: incorrect bounds assertion in aes::unwrap_key() can lead to OOB write (bsc#1270651).
• CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check (bsc#1270787).
• CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory to network peers (bsc#1270817).
• CVE-2026-42327: openssl: undefined behavior in X509Ref::ocsp_responders when processing certificates with non-UTF-8 OCSP URLs (bsc#1270483).
• CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding (bsc#1270886).
• CVE-2026-45784: openssl: out-of-bounds write in CipherCtxRef::cipher_update_inplace for AES-KW-PAD ciphers (bsc#1270949).
• CVE-2026-25541: bytes: integer overflow in BytesMut:reserve can lead to undefined behavior and crashes (bsc#1271348).

Other updates and bugfixes:

• Version 5.10.0.git73.b97f772:
  • build(deps): bump anyhow from 1.0.99 to 1.0.103 https://github.com/coreos/afterburn/pull/1284
  • build(deps): bump libflate from 2.1.0 to 2.2.2 https://github.com/coreos/afterburn/pull/1283
  • build(deps): bump openssl from 0.10.79 to 0.10.80 https://github.com/coreos/afterburn/pull/1277
• Version 5.10.0.git70.9cc2a7b:
  • build(deps): bump openssl from 0.10.78 to 0.10.79
  • providers/hetzner: Add the HETZNER_PUBLIC_IPV6 attribute
  • providers/hetzner: Add support for network configuration
  • build(deps): bump rustls-webpki from 0.103.10 to 0.103.13
  • build(deps): bump openssl from 0.10.73 to 0.10.78
  • docs: Add AGENTS.md and CLAUDE.md for AI coding assistants
  • build(deps): bump rand from 0.9.2 to 0.9.4
  • opencode: add skills for provider scaffolding and release automation
  • ibmcloud-classic: Add missing network_id to fixture
  • kubevirt: Support static gateway and DNS with DHCP
  • build(deps): bump rustls-webpki from 0.103.6 to 0.103.10
  • fix(proxmoxve): Define DNS entries for every interface
  • Makefile: download 90-afterburn-authorized-keys-file.conf for rpm building
  • Sync repo templates ⚙
  • build(deps): bump bytes from 1.10.1 to 1.11.1
  • util/dhcp: Fix clippy lints
  • build(deps): bump actions/checkout from 4 to 6
  • build(deps): bump actions/upload-artifact from 4 to 5
  • kubevirt: modprobe for virtio_blk; remove dracut preload
  • kubevirt: Add NoCloud network configuration support
  • kubevirt: Support config drive network data
  • kubevirt: Refactor the provider to follow the proxmoxve structure
  • dracut: Add virtio_blk module preload to afterburn-network-kargs service
  • docs: Add release notes
  • cargo: Afterburn release 5.10.0
• Version 5.10.0:
  • docs/release-notes: update for release 5.10.0
  • cargo: update dependencies
  • microsoft/azure: Add XML attribute alias for serde-xml-rs Fedora compat
  • docs/release-notes: Add entry for Azure SharedConfig XML parsing fix
  • microsoft/azure: Fix SharedConfig parsing of XML attributes
  • microsoft/azure: Mock goalstate.SharedConfig output in tests
  • providers/azure: switch SSH key retrieval from certs endpoint to IMDS
  • build(deps): bump the build group with 8 updates
  • build(deps): bump slab from 0.4.10 to 0.4.11
  • build(deps): bump actions/checkout from 4 to 5
  • upcloud: implement UpCloud provider
  • build(deps): bump the build group with 4 updates