{"id":"CVE-2025-5791","aliases":["AZL-63771","AZL-63848","EUVD-2025-16945","GHSA-m65q-v92h-cm7q","RUSTSEC-2025-0040","SUSE-RU-2025:20961-1","SUSE-RU-2025:21046-1","SUSE-SU-2025:02166-1","SUSE-SU-2025:3783-1","SUSE-SU-2025:3784-1","SUSE-SU-2025:3785-1","SUSE-SU-2025:3786-1","SUSE-SU-2026:22917-1","SUSE-SU-2026:23071-1","UBUNTU-CVE-2025-5791","openSUSE-SU-2025:15217-1","openSUSE-SU-2025:15246-1","openSUSE-SU-2025:15335-1","openSUSE-SU-2025:15412-1","openSUSE-SU-2025:15628-1"],"status":"published","title":"Users: `root` appended to group listings","description":"A flaw was found in the user's crate for Rust. This vulnerability allows privilege escalation via incorrect group listing when a user or process has fewer than exactly 1024 groups, leading to the erroneous inclusion of the root group in the access list.","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00205,"percentile":0.10603,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-266"],"published":"2025-01-15T12:00:00Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Azure Linux:3","package":"kata-containers-cc","fixed_in":["3.15.0.aks0-15"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"kata-containers-cc","fixed_in":["3.2.0.azl2-7"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.1","package":"afterburn","fixed_in":["5.9.0.git21.a73f509-slfo.1.1_1.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.0","package":"afterburn","fixed_in":["5.9.0.git21.a73f509-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"mirrorsorcerer","fixed_in":["0.1.3~1-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"afterburn","fixed_in":["5.8.2-3.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"agama","fixed_in":["17+60.68fdb92ec-26.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"lsd","fixed_in":["1.2.0-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"users","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.8.0"},{"last_affected":"0.11.0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"kata-containers-cc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.15.0.aks0-15"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"kata-containers-cc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.0.azl2-7"}]}]},{"source":"osv","ecosystem":"crates.io","package":"users","ranges":[{"type":"SEMVER","events":[{"introduced":"0.8.0"},{"last_affected":"0.11.0"}]}]},{"source":"osv","ecosystem":"crates.io","package":"users","ranges":[{"type":"SEMVER","events":[{"introduced":"0.8.0"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"afterburn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.0.git21.a73f509-slfo.1.1_1.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"afterburn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.0.git21.a73f509-1.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"himmelblau","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.7.17+git.0.1ebdab0-150700.3.3.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"afterburn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.0.git21.a73f509-150300.3.5.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"afterburn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.0.git21.a73f509-150500.3.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"afterburn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.0.git21.a73f509-150400.3.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"afterburn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.9.0.git21.a73f509-150400.3.3.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"afterburn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.0.git73.b97f772-1.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"afterburn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.0.git73.b97f772-slfo.1.1_1.1"}]}],"bundled":13},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"rust-users","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.9.1-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"rust-users","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.0-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rust-users","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.11.0-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"flake-pilot","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.19-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"mirrorsorcerer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.1.3~1-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"afterburn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.8.2-3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"agama","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17+60.68fdb92ec-26.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"lsd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.0-1.1"}]}]}],"products":[{"vendor":"red hat","product":"red hat enterprise linux 10"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat openshift container platform 4"},{"vendor":"red hat","product":"red hat openshift sandboxed containers 1.10"},{"vendor":"red hat","product":"red hat trusted profile analyzer"}],"references":[{"url":"https://access.redhat.com/errata/RHSA-2025:12359","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-5791","tags":["vdb-entry","x_refsource_REDHAT","web","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2370001","tags":["issue-tracking","x_refsource_REDHAT","web"]},{"url":"https://crates.io/crates/users","tags":["package","report"]},{"url":"https://github.com/ogham/rust-users/issues/44","tags":["web","report"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2025-0040.html","tags":["web","advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-5791","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-m65q-v92h-cm7q"},{"url":"https://github.com/ogham/rust-users","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement//suse-ru-202520961-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1250471","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-5791","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement//suse-ru-202521046-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502166-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1242648","tags":["report"]},{"url":"https://bugzilla.suse.com/1244202","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3416","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20253783-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1196972","tags":["report"]},{"url":"https://bugzilla.suse.com/1242665","tags":["report"]},{"url":"https://bugzilla.suse.com/1243850","tags":["report"]},{"url":"https://bugzilla.suse.com/1244199","tags":["report"]},{"url":"https://bugzilla.suse.com/1244675","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-24713","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-12224","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20253784-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20253785-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20253786-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202622917-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1270175","tags":["report"]},{"url":"https://bugzilla.suse.com/1270483","tags":["report"]},{"url":"https://bugzilla.suse.com/1270555","tags":["report"]},{"url":"https://bugzilla.suse.com/1270651","tags":["report"]},{"url":"https://bugzilla.suse.com/1270787","tags":["report"]},{"url":"https://bugzilla.suse.com/1270817","tags":["report"]},{"url":"https://bugzilla.suse.com/1270886","tags":["report"]},{"url":"https://bugzilla.suse.com/1270949","tags":["report"]},{"url":"https://bugzilla.suse.com/1271348","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25541","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41676","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41677","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41678","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41898","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42327","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44662","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45784","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623071-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-5791","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-5791","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-5791","title":"Users: `root` appended to group listings","description":"A flaw was found in the user's crate for Rust. This vulnerability allows privilege escalation via incorrect group listing when a user or process has fewer than exactly 1024 groups, leading to the erroneous inclusion of the root group in the access list.","status":"published","published":"2025-06-06T13:10:07.157Z","modified":"2026-11-04T21:35:33.423Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-266"],"updated_at":"2026-11-04T22:39:14.734949Z"}],"euvd":[{"id":"EUVD-2025-16945","description":"A flaw was found in the user's crate for Rust. This vulnerability allows privilege escalation via incorrect group listing when a user or process has fewer than exactly 1024 groups, leading to the erroneous inclusion of the root group in the access list.","status":"published","published":"2025-06-06T13:10:07Z","modified":"2026-11-04T21:35:33Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-04T23:47:19.24864Z"}],"ghsa":[{"id":"GHSA-m65q-v92h-cm7q","title":"users may append `root` to group listings","description":"Affected versions append `root` to group listings, unless the correct listing has exactly 1024 groups.\n\nThis affects both:\n\n- The supplementary groups of a user\n- The group access list of the current process\n\nIf the caller uses this information for access control, this may lead to privilege escalation.\n\nThis crate is not currently maintained, so a patched version is not available.\n\nVersions older than 0.8.0 do not contain the affected functions, so downgrading to them is a workaround.\n\n## Recommended alternatives\n- [`uzers`](https://crates.io/crates/uzers) (an actively maintained fork of the `users` crate)\n- [`sysinfo`](https://crates.io/crates/sysinfo)","status":"published","published":"2025-06-05T01:17:28Z","modified":"2025-06-06T23:16:39Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-266"],"updated_at":"2026-11-02T14:38:46.901955Z"}],"nvd":[{"id":"CVE-2025-5791","description":"A flaw was found in the user's crate for Rust. This vulnerability allows privilege escalation via incorrect group listing when a user or process has fewer than exactly 1024 groups, leading to the erroneous inclusion of the root group in the access list.","status":"published","published":"2025-06-06T14:15:23.137Z","modified":"2026-11-04T22:17:38.203Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-266"],"updated_at":"2026-11-04T23:43:37.864413Z"}],"osv":[{"id":"GHSA-m65q-v92h-cm7q","title":"users may append `root` to group listings","description":"Affected versions append `root` to group listings, unless the correct listing has exactly 1024 groups.\n\nThis affects both:\n\n- The supplementary groups of a user\n- The group access list of the current process\n\nIf the caller uses this information for access control, this may lead to privilege escalation.\n\nThis crate is not currently maintained, so a patched version is not available.\n\nVersions older than 0.8.0 do not contain the affected functions, so downgrading to them is a workaround.\n\n## Recommended alternatives\n- [`uzers`](https://crates.io/crates/uzers) (an actively maintained fork of the `users` crate)\n- [`sysinfo`](https://crates.io/crates/sysinfo)","status":"published","published":"2025-06-05T01:17:28Z","modified":"2026-09-10T03:50:57.706129891Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-266"],"updated_at":"2026-11-02T15:46:51.463834Z"},{"id":"UBUNTU-CVE-2025-5791","description":"A flaw was found in the user's crate for Rust. This vulnerability allows privilege escalation via incorrect group listing when a user or process has fewer than exactly 1024 groups, leading to the erroneous inclusion of the root group in the access list.","status":"published","published":"2025-06-06T14:15:00Z","modified":"2026-01-20T18:50:36.006509Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T16:55:50.817402Z"},{"id":"AZL-63771","title":"CVE-2025-5791 affecting package kata-containers-cc for versions less than 3.15.0.aks0-15","description":"A flaw was found in the user's crate for Rust. This vulnerability allows privilege escalation via incorrect group listing when a user or process has fewer than exactly 1024 groups, leading to the erroneous inclusion of the root group in the access list.","status":"published","published":"2025-06-06T14:15:23Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:21.518778Z"},{"id":"AZL-63848","title":"CVE-2025-5791 affecting package kata-containers-cc for versions less than 3.2.0.azl2-7","description":"A flaw was found in the user's crate for Rust. This vulnerability allows privilege escalation via incorrect group listing when a user or process has fewer than exactly 1024 groups, leading to the erroneous inclusion of the root group in the access list.","status":"published","published":"2025-06-06T14:15:23Z","modified":"2026-04-21T04:32:14.055169Z","updated_at":"2026-11-02T15:28:07.805289Z"},{"id":"openSUSE-SU-2025:15217-1","title":"flake-pilot-3.1.19-1.1 on GA media","description":"These are all security issues fixed in the flake-pilot-3.1.19-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-07-03T00:00:00Z","modified":"2026-03-23T04:53:30.41793Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"openSUSE-SU-2025:15246-1","title":"mirrorsorcerer-0.1.3~1-1.1 on GA media","description":"These are all security issues fixed in the mirrorsorcerer-0.1.3~1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-07-03T00:00:00Z","modified":"2026-03-23T04:53:32.512135Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"openSUSE-SU-2025:15335-1","title":"afterburn-5.8.2-3.1 on GA media","description":"These are all security issues fixed in the afterburn-5.8.2-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-07-11T00:00:00Z","modified":"2026-02-04T03:51:14.718778Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"openSUSE-SU-2025:15412-1","title":"agama-17+60.68fdb92ec-26.1 on GA media","description":"These are all security issues fixed in the agama-17+60.68fdb92ec-26.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-08-06T00:00:00Z","modified":"2026-03-23T04:53:44.547102Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"openSUSE-SU-2025:15628-1","title":"lsd-1.2.0-1.1 on GA media","description":"These are all security issues fixed in the lsd-1.2.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-10-13T00:00:00Z","modified":"2026-03-23T04:54:01.603133Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"RUSTSEC-2025-0040","title":"`root` appended to group listings","description":"Affected versions append `root` to group listings, unless the correct listing\nhas exactly 1024 groups.\n\nThis affects both:\n\n- The supplementary groups of a user\n- The group access list of the current process\n\nIf the caller uses this information for access control, this may lead to\nprivilege escalation.\n\nThis crate is not currently maintained, so a patched version is not available.\n\nVersions older than 0.8.0 do not contain the affected functions, so downgrading\nto them is a workaround.\n\n## Recommended alternatives\n- [`uzers`](https://crates.io/crates/uzers) (an actively maintained fork of the `users` crate)\n- [`sysinfo`](https://crates.io/crates/sysinfo)","status":"published","published":"2025-01-15T12:00:00Z","modified":"2025-10-28T06:28:57.282109Z","updated_at":"2026-11-02T15:53:39.971022Z"},{"id":"SUSE-RU-2025:20961-1","title":"Recommended update for afterburn","description":"This update for afterburn fixes the following issues:\n\n- Update to version 5.9.0.git21.a73f509:\n  * docs/release-notes: update for release 5.10.0\n  * cargo: update dependencies\n  * microsoft/azure: Add XML attribute alias for serde-xml-rs Fedora compat\n  * docs/release-notes: Add entry for Azure SharedConfig XML parsing fix\n  * microsoft/azure: Fix SharedConfig parsing of XML attributes\n  * microsoft/azure: Mock goalstate.SharedConfig output in tests\n  * providers/azure: switch SSH key retrieval from certs endpoint to IMDS\n    as azure stopped providing keys in the old one (bsc#1250471)\n  * build(deps): bump the build group with 8 updates\n  * build(deps): bump slab from 0.4.10 to 0.4.11\n  * build(deps): bump actions/checkout from 4 to 5\n  * upcloud: implement UpCloud provider\n  * build(deps): bump the build group with 4 updates\n  * Sync repo templates ⚙\n\n- Update to version 5.9.0:\n  * cargo: Afterburn release 5.9.0\n  * docs/release-notes: update for release 5.9.0\n  * cargo: update dependencies\n  * Add TMT test structure and basic smoke test\n  * build(deps): bump openssl from 0.10.72 to 0.10.73\n  * build(deps): bump reqwest from 0.12.15 to 0.12.18\n  * docs/release-notes: Update changelog entry\n  * dracut: Return 255 in module-setup\n  * oraclecloud: add release note and move base URL to constant\n  * oraclecloud: implement oraclecloud provider\n  * build(deps): bump nix from 0.29.0 to 0.30.1\n  * build(deps): bump zbus from 5.7.0 to 5.7.1\n  * build(deps): bump serde-xml-rs from 0.6.0 to 0.8.1\n  * build(deps): bump ipnetwork from 0.20.0 to 0.21.1\n  * build(deps): bump clap from 4.5.38 to 4.5.39\n","status":"published","published":"2025-10-27T15:32:17Z","modified":"2026-03-23T04:46:13.986666Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-RU-2025:21046-1","title":"Recommended update for afterburn","description":"This update for afterburn fixes the following issues:\n\n- Update to version 5.9.0.git21.a73f509:\n  * docs/release-notes: update for release 5.10.0\n  * cargo: update dependencies\n  * microsoft/azure: Add XML attribute alias for serde-xml-rs Fedora compat\n  * docs/release-notes: Add entry for Azure SharedConfig XML parsing fix\n  * microsoft/azure: Fix SharedConfig parsing of XML attributes\n  * microsoft/azure: Mock goalstate.SharedConfig output in tests\n  * providers/azure: switch SSH key retrieval from certs endpoint to IMDS\n    as azure stopped providing keys in the old one (bsc#1250471)\n  * build(deps): bump the build group with 8 updates\n  * build(deps): bump slab from 0.4.10 to 0.4.11\n  * build(deps): bump actions/checkout from 4 to 5\n  * upcloud: implement UpCloud provider\n  * build(deps): bump the build group with 4 updates\n  * Sync repo templates ⚙\n\n- Update to version 5.9.0:\n  * cargo: Afterburn release 5.9.0\n  * docs/release-notes: update for release 5.9.0\n  * cargo: update dependencies\n  * Add TMT test structure and basic smoke test\n  * build(deps): bump openssl from 0.10.72 to 0.10.73\n  * build(deps): bump reqwest from 0.12.15 to 0.12.18\n  * docs/release-notes: Update changelog entry\n  * dracut: Return 255 in module-setup\n  * oraclecloud: add release note and move base URL to constant\n  * oraclecloud: implement oraclecloud provider\n  * build(deps): bump nix from 0.29.0 to 0.30.1\n  * build(deps): bump zbus from 5.7.0 to 5.7.1\n  * build(deps): bump serde-xml-rs from 0.6.0 to 0.8.1\n  * build(deps): bump ipnetwork from 0.20.0 to 0.21.1\n  * build(deps): bump clap from 4.5.38 to 4.5.39\n","status":"published","published":"2025-11-18T09:58:24Z","modified":"2026-03-23T04:46:13.975778Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2025:02166-1","title":"Security update for himmelblau","description":"This update for himmelblau fixes the following issues:\n\n- CVE-2025-5791: Fixed using deprecated `users` crate (bsc#1244202)\n- CVE-2025-3416: Fixed use-After-Free in Md::fetch and Cipher::fetch in rust-openssl crate (bsc#1242648) \n     \nUpdate to version 0.7.17+git.0.1ebdab0\n* Update sccache-action version to use new cache service\n","status":"published","published":"2025-06-30T07:14:21Z","modified":"2026-02-04T02:15:49.418807Z","updated_at":"2026-11-02T15:53:56.647031Z"},{"id":"SUSE-SU-2025:3783-1","title":"Security update for afterburn","description":"This update for afterburn fixes the following issues:\n\nUpdate to version 5.9.0.git21.a73f509.\n\nSecurity issues fixed:\n\n- CVE-2022-24713: regex: no proper complexity limitation when parsing untrusted regular expressions with large\n  repetitions on empty sub-expressions can lead to excessive resource consumption and denial of service (bsc#1196972).\n- CVE-2024-12224: idna: acceptance of Punycode labels that do not produce any non-ASCII output may lead to incorrect\n  hostname comparisons and incorrect URL parsing (bsc#1243850).\n- CVE-2025-5791: users: `root` user being appended to group listings whenever listing does not have exactly 1024 groups\n  can lead to privilege escalation when information is used for access control (bsc#1244199).\n- CVE-2025-3416: openssl: passing of `Some(...)` value as `properties` argument to `Md::fetch` or `Cipher::fetch` can\n  lead to use-after-free (bsc#1242665).\n\nOther issues fixed:\n\n- Fixed in version 5.9.0.git21.a73f509:\n  * cargo: update dependencies\n  * microsoft/azure: Add XML attribute alias for serde-xml-rs Fedora compat\n  * microsoft/azure: Fix SharedConfig parsing of XML attributes\n  * microsoft/azure: Mock goalstate.SharedConfig output in tests\n  * providers/azure: switch SSH key retrieval from certs endpoint to IMDS as azure stopped providing keys in the old one (bsc#1250471).\n  * upcloud: implement UpCloud provider\n  * Update several build dependencies\n    \n- Fixed in version 5.9.0:\n  * cargo: update dependencies\n  * dracut: Return 255 in module-setup\n  * oraclecloud: add release note and move base URL to constant\n  * oraclecloud: implement oraclecloud provider\n  * Update several build dependencies\n\n- Fixed in version 5.8.2:\n  * cargo: update dependencies\n  * packit: add initial support\n\n- Fixed in version 5.7.0.git103.bae893c:\n  * proxmoxve: Add more context to log messages.\n  * proxmoxve: Remove unneeded fields\n  * proxmoxve: Add tests for static network configuration from cloud-init.\n  * proxmoxve: Add support for static network configuration from cloud-init.\n  * providers/openstack: ignore ec2 metadata if not present\n  * proxmox: use noop provider if no configdrive\n  * Update several build dependencies\n\n- Fixed in version 5.7.0:\n  * cargo: update dependencies\n  * dhcp: replace dbus_proxy with proxy, and zbus traits\n  * providers/hetzner: private ipv4 addresses in attributes\n  * openstack: Document the two platforms\n  * microsoft/azure: allow empty certificate chain in PKCS12 file\n  * proxmoxve: implement proxmoxve provider\n  * providers/hetzner: fix duplicate attribute prefix\n  * lint: silence deadcode warnings\n  * lint: address latest lint's from msrv update\n  * cargo: update msrv to 1.75\n  * providers: Add 'akamai' provider\n  * providers/vmware: add missing public functions for non-amd64\n  * providers/vmware: Process guestinfo.metadata netplan configuration\n  * kubevirt: Run afterburn-hostname service\n  * providers: add support for scaleway\n  * Move away from deprecated `users` to `uzers`\n  * providers/hetzner: add support for Hetzner Cloud\n  * cargo: update MSRV to 1.71\n  * cargo: specify required features for nix dependency\n  * openstack: Add attribute OPENSTACK_INSTANCE_UUID\n  * cargo: allow openssl 0.10.46\n  * build-sys: Use new tier = 2 for cargo-vendor-filterer\n  * cargo: fix minimum version of openssl crate\n  * microsoft/crypto/mod: replace deprecated function `parse` with `parse2`\n  * cli: switch to clap derive\n  * cli: add descriptive value names for option arguments in --help\n  * cli: have clap require exactly one of --cmdline/--provider\n  * providers/`*`: move endpoint mocking into retry::Client\n  * retry/client: move URL parsing into helper function\n  * providers/microsoft: import crate::retry\n  * providers/microsoft: use stored client for all fetches\n  * providers/packet: use stored client for boot checkin\n  * initrd: remember to write trailing newline to network kargs file\n  * util: drop obsolete 'OEM' terminology\n  * Inline variables into format strings\n  * Update several build dependencies\n\n- Fixed in version 5.4.1:\n  * cargo: add configuration for cargo-vendor-filterer\n  * util: support DHCP option lookup from NetworkManager\n  * util: factor out retries of DHCP option lookup\n  * util: refactor DHCP option query helper into an enum\n  * util: move dns_lease_key_lookup() to a separate module\n  * cargo: update MSRV to 1.66\n  * cargo: update all packages to fix build error\n  * cargo: continue to support openssh-keys 0.5\n  * cargo: drop serde_derive crate in favor of serde derive feature\n  * cargo: use consistent declaration syntax for slog dependency\n  * cargo: drop unused dependencies\n  * cargo: continue to support base64 0.13\n  * cargo: continue to support mailparse 0.13.8\n  * cargo: continue to support clap 3.1\n  * cargo: stop enabling LTO in release builds\n  * providers/ibmcloud: avoid error if an ssh key not found in metadata\n  * systemd: add explicit ordering, after multi-user.target\n  * network: fix clippy 1.63.0 lints\n  * cargo: allow serde_yaml 0.8\n  * cargo: update version ranges for post-1.x deps\n  * providers: Use inline `format!` in a few places\n  * *: bump MSRV to 1.58.0\n  * cargo: update clap to 3.2.5\n  * copr: mark git checkout as safe\n  * providers/aws: expose instance availability-zone-id as AWS_AVAILABILITY_ZONE_ID\n  * Update several build dependencies\n\n- Fixed in version 5.3.0:\n  * systemd: enable sshkeys on Power VS platform\n  * network: Encode information for systemd-networkd-wait-online\n  * cargo: update to clap 3.1\n  * cargo: enable clap wrap_help feature\n  * cli: run clap tests\n  * cli: avoid deprecated clap constructs\n  * cargo: update to clap 3.0\n  * cli: use clap mechanism to require exp subcommand\n  * cargo: declare MSRV in Cargo.toml\n  * cargo: update to Rust 2021; bump MSRV to 1.56.0\n  * copr: abort if specfile fetch fails\n  * providers/aws: add AWS_IPV6 attribute\n  * providers/aws: bump metadata version to 2021-01-03\n  * kubevirt: Add KubeVirt platform support\n  * *.service: add/update Documentation field\n  * aws/mock_tests: explicitly drop mocks before resetting\n  * aws/mock_tests: split out IMDS tests\n  * aws/mock_tests: factor out map building\n  * *: use `RemainAfterExit` on all oneshot services\n  * Update several build dependencies\n","status":"published","published":"2025-10-24T13:28:12Z","modified":"2026-02-04T02:56:11.535939Z","updated_at":"2026-11-02T15:54:00.344164Z"},{"id":"SUSE-SU-2025:3784-1","title":"Security update for afterburn","description":"This update for afterburn fixes the following issues:\n\nUpdate to version 5.9.0.git21.a73f509.\n\nSecurity issues fixed:\n\n- CVE-2022-24713: regex: no proper complexity limitation when parsing untrusted regular expressions with large\n  repetitions on empty sub-expressions can lead to excessive resource consumption and denial of service (bsc#1196972).\n- CVE-2024-12224: idna: acceptance of Punycode labels that do not produce any non-ASCII output may lead to incorrect\n  hostname comparisons and incorrect URL parsing (bsc#1243850).\n- CVE-2025-5791: users: `root` user being appended to group listings whenever listing does not have exactly 1024 groups\n  can lead to privilege escalation when information is used for access control (bsc#1244199).\n- CVE-2025-3416: openssl: passing of `Some(...)` value as `properties` argument to `Md::fetch` or `Cipher::fetch` can\n  lead to use-after-free (bsc#1242665).\n\nOther issues fixed:\n\n- Fixed in version 5.9.0.git21.a73f509:\n  * cargo: update dependencies\n  * microsoft/azure: Add XML attribute alias for serde-xml-rs Fedora compat\n  * microsoft/azure: Fix SharedConfig parsing of XML attributes\n  * microsoft/azure: Mock goalstate.SharedConfig output in tests\n  * providers/azure: switch SSH key retrieval from certs endpoint to IMDS as azure stopped providing keys in the old one (bsc#1250471).\n  * upcloud: implement UpCloud provider\n  * Update several build dependencies\n    \n- Fixed in version 5.9.0:\n  * cargo: update dependencies\n  * dracut: Return 255 in module-setup\n  * oraclecloud: add release note and move base URL to constant\n  * oraclecloud: implement oraclecloud provider\n  * Update several build dependencies\n\n- Fixed in version 5.8.2:\n  * cargo: update dependencies\n  * packit: add initial support\n\n- Fixed in version 5.7.0.git103.bae893c:\n  * proxmoxve: Add more context to log messages.\n  * proxmoxve: Remove unneeded fields\n  * proxmoxve: Add tests for static network configuration from cloud-init.\n  * proxmoxve: Add support for static network configuration from cloud-init.\n  * providers/openstack: ignore ec2 metadata if not present\n  * proxmox: use noop provider if no configdrive\n  * Update several build dependencies\n\n- Fixed in version 5.7.0:\n  * cargo: update dependencies\n  * dhcp: replace dbus_proxy with proxy, and zbus traits\n  * providers/hetzner: private ipv4 addresses in attributes\n  * openstack: Document the two platforms\n  * microsoft/azure: allow empty certificate chain in PKCS12 file\n  * proxmoxve: implement proxmoxve provider\n  * providers/hetzner: fix duplicate attribute prefix\n  * lint: silence deadcode warnings\n  * lint: address latest lint's from msrv update\n  * cargo: update msrv to 1.75\n  * providers: Add 'akamai' provider\n  * providers/vmware: add missing public functions for non-amd64\n  * providers/vmware: Process guestinfo.metadata netplan configuration\n  * kubevirt: Run afterburn-hostname service\n  * providers: add support for scaleway\n  * Move away from deprecated `users` to `uzers`\n  * providers/hetzner: add support for Hetzner Cloud\n  * cargo: update MSRV to 1.71\n  * cargo: specify required features for nix dependency\n  * openstack: Add attribute OPENSTACK_INSTANCE_UUID\n  * cargo: allow openssl 0.10.46\n  * build-sys: Use new tier = 2 for cargo-vendor-filterer\n  * cargo: fix minimum version of openssl crate\n  * microsoft/crypto/mod: replace deprecated function `parse` with `parse2`\n  * cli: switch to clap derive\n  * cli: add descriptive value names for option arguments in --help\n  * cli: have clap require exactly one of --cmdline/--provider\n  * providers/`*`: move endpoint mocking into retry::Client\n  * retry/client: move URL parsing into helper function\n  * providers/microsoft: import crate::retry\n  * providers/microsoft: use stored client for all fetches\n  * providers/packet: use stored client for boot checkin\n  * initrd: remember to write trailing newline to network kargs file\n  * util: drop obsolete 'OEM' terminology\n  * Inline variables into format strings\n  * Update several build dependencies\n\n- Fixed in version 5.4.1:\n  * cargo: add configuration for cargo-vendor-filterer\n  * util: support DHCP option lookup from NetworkManager\n  * util: factor out retries of DHCP option lookup\n  * util: refactor DHCP option query helper into an enum\n  * util: move dns_lease_key_lookup() to a separate module\n  * cargo: update MSRV to 1.66\n  * cargo: update all packages to fix build error\n  * cargo: continue to support openssh-keys 0.5\n  * cargo: drop serde_derive crate in favor of serde derive feature\n  * cargo: use consistent declaration syntax for slog dependency\n  * cargo: drop unused dependencies\n  * cargo: continue to support base64 0.13\n  * cargo: continue to support mailparse 0.13.8\n  * cargo: continue to support clap 3.1\n  * cargo: stop enabling LTO in release builds\n  * providers/ibmcloud: avoid error if an ssh key not found in metadata\n  * systemd: add explicit ordering, after multi-user.target\n  * network: fix clippy 1.63.0 lints\n  * cargo: allow serde_yaml 0.8\n  * cargo: update version ranges for post-1.x deps\n  * providers: Use inline `format!` in a few places\n  * *: bump MSRV to 1.58.0\n  * cargo: update clap to 3.2.5\n  * copr: mark git checkout as safe\n  * providers/aws: expose instance availability-zone-id as AWS_AVAILABILITY_ZONE_ID\n  * Update several build dependencies\n\n- Fixed in version 5.3.0:\n  * systemd: enable sshkeys on Power VS platform\n  * network: Encode information for systemd-networkd-wait-online\n  * cargo: update to clap 3.1\n  * cargo: enable clap wrap_help feature\n  * cli: run clap tests\n  * cli: avoid deprecated clap constructs\n  * cargo: update to clap 3.0\n  * cli: use clap mechanism to require exp subcommand\n  * cargo: declare MSRV in Cargo.toml\n  * cargo: update to Rust 2021; bump MSRV to 1.56.0\n  * copr: abort if specfile fetch fails\n  * providers/aws: add AWS_IPV6 attribute\n  * providers/aws: bump metadata version to 2021-01-03\n  * kubevirt: Add KubeVirt platform support\n  * *.service: add/update Documentation field\n  * aws/mock_tests: explicitly drop mocks before resetting\n  * aws/mock_tests: split out IMDS tests\n  * aws/mock_tests: factor out map building\n  * *: use `RemainAfterExit` on all oneshot services\n  * Update several build dependencies\n","status":"published","published":"2025-10-24T13:28:17Z","modified":"2026-02-04T03:09:14.894967Z","updated_at":"2026-11-02T15:54:00.344164Z"},{"id":"SUSE-SU-2025:3785-1","title":"Security update for afterburn","description":"This update for afterburn fixes the following issues:\n\nUpdate to version 5.9.0.git21.a73f509.\n\nSecurity issues fixed:\n\n- CVE-2022-24713: regex: no proper complexity limitation when parsing untrusted regular expressions with large\n  repetitions on empty sub-expressions can lead to excessive resource consumption and denial of service (bsc#1196972).\n- CVE-2024-12224: idna: acceptance of Punycode labels that do not produce any non-ASCII output may lead to incorrect\n  hostname comparisons and incorrect URL parsing (bsc#1243850).\n- CVE-2025-5791: users: `root` user being appended to group listings whenever listing does not have exactly 1024 groups\n  can lead to privilege escalation when information is used for access control (bsc#1244199).\n- CVE-2025-3416: openssl: passing of `Some(...)` value as `properties` argument to `Md::fetch` or `Cipher::fetch` can\n  lead to use-after-free (bsc#1242665).\n\nOther issues fixed:\n\n- Fixed in version 5.9.0.git21.a73f509:\n  * cargo: update dependencies\n  * microsoft/azure: Add XML attribute alias for serde-xml-rs Fedora compat\n  * microsoft/azure: Fix SharedConfig parsing of XML attributes\n  * microsoft/azure: Mock goalstate.SharedConfig output in tests\n  * providers/azure: switch SSH key retrieval from certs endpoint to IMDS as azure stopped providing keys in the old one (bsc#1250471).\n  * upcloud: implement UpCloud provider\n  * Update several build dependencies\n    \n- Fixed in version 5.9.0:\n  * cargo: update dependencies\n  * dracut: Return 255 in module-setup\n  * oraclecloud: add release note and move base URL to constant\n  * oraclecloud: implement oraclecloud provider\n  * Update several build dependencies\n\n- Fixed in version 5.8.2:\n  * cargo: update dependencies\n  * packit: add initial support\n\n- Fixed in version 5.7.0.git103.bae893c:\n  * proxmoxve: Add more context to log messages.\n  * proxmoxve: Remove unneeded fields\n  * proxmoxve: Add tests for static network configuration from cloud-init.\n  * proxmoxve: Add support for static network configuration from cloud-init.\n  * providers/openstack: ignore ec2 metadata if not present\n  * proxmox: use noop provider if no configdrive\n  * Update several build dependencies\n\n- Fixed in version 5.7.0:\n  * cargo: update dependencies\n  * dhcp: replace dbus_proxy with proxy, and zbus traits\n  * providers/hetzner: private ipv4 addresses in attributes\n  * openstack: Document the two platforms\n  * microsoft/azure: allow empty certificate chain in PKCS12 file\n  * proxmoxve: implement proxmoxve provider\n  * providers/hetzner: fix duplicate attribute prefix\n  * lint: silence deadcode warnings\n  * lint: address latest lint's from msrv update\n  * cargo: update msrv to 1.75\n  * providers: Add 'akamai' provider\n  * providers/vmware: add missing public functions for non-amd64\n  * providers/vmware: Process guestinfo.metadata netplan configuration\n  * kubevirt: Run afterburn-hostname service\n  * providers: add support for scaleway\n  * Move away from deprecated `users` to `uzers`\n  * providers/hetzner: add support for Hetzner Cloud\n  * cargo: update MSRV to 1.71\n  * cargo: specify required features for nix dependency\n  * openstack: Add attribute OPENSTACK_INSTANCE_UUID\n  * cargo: allow openssl 0.10.46\n  * build-sys: Use new tier = 2 for cargo-vendor-filterer\n  * cargo: fix minimum version of openssl crate\n  * microsoft/crypto/mod: replace deprecated function `parse` with `parse2`\n  * cli: switch to clap derive\n  * cli: add descriptive value names for option arguments in --help\n  * cli: have clap require exactly one of --cmdline/--provider\n  * providers/`*`: move endpoint mocking into retry::Client\n  * retry/client: move URL parsing into helper function\n  * providers/microsoft: import crate::retry\n  * providers/microsoft: use stored client for all fetches\n  * providers/packet: use stored client for boot checkin\n  * initrd: remember to write trailing newline to network kargs file\n  * util: drop obsolete 'OEM' terminology\n  * Inline variables into format strings\n  * Update several build dependencies\n\n- Fixed in version 5.4.1:\n  * cargo: add configuration for cargo-vendor-filterer\n  * util: support DHCP option lookup from NetworkManager\n  * util: factor out retries of DHCP option lookup\n  * util: refactor DHCP option query helper into an enum\n  * util: move dns_lease_key_lookup() to a separate module\n  * cargo: update MSRV to 1.66\n  * cargo: update all packages to fix build error\n  * cargo: continue to support openssh-keys 0.5\n  * cargo: drop serde_derive crate in favor of serde derive feature\n  * cargo: use consistent declaration syntax for slog dependency\n  * cargo: drop unused dependencies\n  * cargo: continue to support base64 0.13\n  * cargo: continue to support mailparse 0.13.8\n  * cargo: continue to support clap 3.1\n  * cargo: stop enabling LTO in release builds\n  * providers/ibmcloud: avoid error if an ssh key not found in metadata\n  * systemd: add explicit ordering, after multi-user.target\n  * network: fix clippy 1.63.0 lints\n  * cargo: allow serde_yaml 0.8\n  * cargo: update version ranges for post-1.x deps\n  * providers: Use inline `format!` in a few places\n  * *: bump MSRV to 1.58.0\n  * cargo: update clap to 3.2.5\n  * copr: mark git checkout as safe\n  * providers/aws: expose instance availability-zone-id as AWS_AVAILABILITY_ZONE_ID\n  * Update several build dependencies\n\n- Fixed in version 5.3.0:\n  * systemd: enable sshkeys on Power VS platform\n  * network: Encode information for systemd-networkd-wait-online\n  * cargo: update to clap 3.1\n  * cargo: enable clap wrap_help feature\n  * cli: run clap tests\n  * cli: avoid deprecated clap constructs\n  * cargo: update to clap 3.0\n  * cli: use clap mechanism to require exp subcommand\n  * cargo: declare MSRV in Cargo.toml\n  * cargo: update to Rust 2021; bump MSRV to 1.56.0\n  * copr: abort if specfile fetch fails\n  * providers/aws: add AWS_IPV6 attribute\n  * providers/aws: bump metadata version to 2021-01-03\n  * kubevirt: Add KubeVirt platform support\n  * *.service: add/update Documentation field\n  * aws/mock_tests: explicitly drop mocks before resetting\n  * aws/mock_tests: split out IMDS tests\n  * aws/mock_tests: factor out map building\n  * *: use `RemainAfterExit` on all oneshot services\n  * Update several build dependencies\n","status":"published","published":"2025-10-24T13:28:23Z","modified":"2026-02-04T02:54:08.727908Z","updated_at":"2026-11-02T15:54:00.344164Z"},{"id":"SUSE-SU-2025:3786-1","title":"Security update for afterburn","description":"This update for afterburn fixes the following issues:\n\nUpdate to version 5.9.0.git21.a73f509.\n\nSecurity issues fixed:\n\n- CVE-2022-24713: regex: no proper complexity limitation when parsing untrusted regular expressions with large\n  repetitions on empty sub-expressions can lead to excessive resource consumption and denial of service (bsc#1196972).\n- CVE-2024-12224: idna: acceptance of Punycode labels that do not produce any non-ASCII output may lead to incorrect\n  hostname comparisons and incorrect URL parsing (bsc#1243850).\n- CVE-2025-5791: users: `root` user being appended to group listings whenever listing does not have exactly 1024 groups\n  can lead to privilege escalation when information is used for access control (bsc#1244199).\n- CVE-2025-3416: openssl: passing of `Some(...)` value as `properties` argument to `Md::fetch` or `Cipher::fetch` can\n  lead to use-after-free (bsc#1242665).\n\nOther issues fixed:\n\n- Fixed in version 5.9.0.git21.a73f509:\n  * cargo: update dependencies\n  * microsoft/azure: Add XML attribute alias for serde-xml-rs Fedora compat\n  * microsoft/azure: Fix SharedConfig parsing of XML attributes\n  * microsoft/azure: Mock goalstate.SharedConfig output in tests\n  * providers/azure: switch SSH key retrieval from certs endpoint to IMDS as azure stopped providing keys in the old one (bsc#1250471).\n  * upcloud: implement UpCloud provider\n  * Update several build dependencies\n    \n- Fixed in version 5.9.0:\n  * cargo: update dependencies\n  * dracut: Return 255 in module-setup\n  * oraclecloud: add release note and move base URL to constant\n  * oraclecloud: implement oraclecloud provider\n  * Update several build dependencies\n\n- Fixed in version 5.8.2:\n  * cargo: update dependencies\n  * packit: add initial support\n\n- Fixed in version 5.7.0.git103.bae893c:\n  * proxmoxve: Add more context to log messages.\n  * proxmoxve: Remove unneeded fields\n  * proxmoxve: Add tests for static network configuration from cloud-init.\n  * proxmoxve: Add support for static network configuration from cloud-init.\n  * providers/openstack: ignore ec2 metadata if not present\n  * proxmox: use noop provider if no configdrive\n  * Update several build dependencies\n\n- Fixed in version 5.7.0:\n  * cargo: update dependencies\n  * dhcp: replace dbus_proxy with proxy, and zbus traits\n  * providers/hetzner: private ipv4 addresses in attributes\n  * openstack: Document the two platforms\n  * microsoft/azure: allow empty certificate chain in PKCS12 file\n  * proxmoxve: implement proxmoxve provider\n  * providers/hetzner: fix duplicate attribute prefix\n  * lint: silence deadcode warnings\n  * lint: address latest lint's from msrv update\n  * cargo: update msrv to 1.75\n  * providers: Add 'akamai' provider\n  * providers/vmware: add missing public functions for non-amd64\n  * providers/vmware: Process guestinfo.metadata netplan configuration\n  * kubevirt: Run afterburn-hostname service\n  * providers: add support for scaleway\n  * Move away from deprecated `users` to `uzers`\n  * providers/hetzner: add support for Hetzner Cloud\n  * cargo: update MSRV to 1.71\n  * cargo: specify required features for nix dependency\n  * openstack: Add attribute OPENSTACK_INSTANCE_UUID\n  * cargo: allow openssl 0.10.46\n  * build-sys: Use new tier = 2 for cargo-vendor-filterer\n  * cargo: fix minimum version of openssl crate\n  * microsoft/crypto/mod: replace deprecated function `parse` with `parse2`\n  * cli: switch to clap derive\n  * cli: add descriptive value names for option arguments in --help\n  * cli: have clap require exactly one of --cmdline/--provider\n  * providers/`*`: move endpoint mocking into retry::Client\n  * retry/client: move URL parsing into helper function\n  * providers/microsoft: import crate::retry\n  * providers/microsoft: use stored client for all fetches\n  * providers/packet: use stored client for boot checkin\n  * initrd: remember to write trailing newline to network kargs file\n  * util: drop obsolete 'OEM' terminology\n  * Inline variables into format strings\n  * Update several build dependencies\n\n- Fixed in version 5.4.1:\n  * cargo: add configuration for cargo-vendor-filterer\n  * util: support DHCP option lookup from NetworkManager\n  * util: factor out retries of DHCP option lookup\n  * util: refactor DHCP option query helper into an enum\n  * util: move dns_lease_key_lookup() to a separate module\n  * cargo: update MSRV to 1.66\n  * cargo: update all packages to fix build error\n  * cargo: continue to support openssh-keys 0.5\n  * cargo: drop serde_derive crate in favor of serde derive feature\n  * cargo: use consistent declaration syntax for slog dependency\n  * cargo: drop unused dependencies\n  * cargo: continue to support base64 0.13\n  * cargo: continue to support mailparse 0.13.8\n  * cargo: continue to support clap 3.1\n  * cargo: stop enabling LTO in release builds\n  * providers/ibmcloud: avoid error if an ssh key not found in metadata\n  * systemd: add explicit ordering, after multi-user.target\n  * network: fix clippy 1.63.0 lints\n  * cargo: allow serde_yaml 0.8\n  * cargo: update version ranges for post-1.x deps\n  * providers: Use inline `format!` in a few places\n  * *: bump MSRV to 1.58.0\n  * cargo: update clap to 3.2.5\n  * copr: mark git checkout as safe\n  * providers/aws: expose instance availability-zone-id as AWS_AVAILABILITY_ZONE_ID\n  * Update several build dependencies\n\n- Fixed in version 5.3.0:\n  * systemd: enable sshkeys on Power VS platform\n  * network: Encode information for systemd-networkd-wait-online\n  * cargo: update to clap 3.1\n  * cargo: enable clap wrap_help feature\n  * cli: run clap tests\n  * cli: avoid deprecated clap constructs\n  * cargo: update to clap 3.0\n  * cli: use clap mechanism to require exp subcommand\n  * cargo: declare MSRV in Cargo.toml\n  * cargo: update to Rust 2021; bump MSRV to 1.56.0\n  * copr: abort if specfile fetch fails\n  * providers/aws: add AWS_IPV6 attribute\n  * providers/aws: bump metadata version to 2021-01-03\n  * kubevirt: Add KubeVirt platform support\n  * *.service: add/update Documentation field\n  * aws/mock_tests: explicitly drop mocks before resetting\n  * aws/mock_tests: split out IMDS tests\n  * aws/mock_tests: factor out map building\n  * *: use `RemainAfterExit` on all oneshot services\n  * Update several build dependencies\n","status":"published","published":"2025-10-24T13:28:30Z","modified":"2026-02-04T02:22:28.955192Z","updated_at":"2026-11-02T15:54:00.344164Z"},{"id":"SUSE-SU-2026:22917-1","title":"Security update for afterburn","description":"This update for afterburn fixes the following issues\n\nUpdate to version 5.10.0.git73.b97f772.\n\nSecurity issues fixed:\n\n- CVE-2022-24713: regex: high complexity when parsing regexes with large repetitions on empty sub-expressions can lead\n  to DoS (bsc#1196972).\n- CVE-2024-12224: idna: privilege escalation due acceptance Punycode labels that do not produce any non-ASCII when\n  decoded (bsc#1243850).\n- CVE-2025-3416: openssl: use-after-free in `Md::fetch` and `Cipher::fetch` (bsc#1242665).\n- CVE-2025-5791: users: `root` appended to group listings unless the correct listing has exactly 1024 groups\n  (bsc#1244199).\n- CVE-2026-41676: openssl: `Deriver:derive` and `PkeyCtxRef:derive` can overflow short buffers on OpenSSL 1.1.1\n  (bsc#1270175).\n- CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length\n  (bsc#1270555).\n- CVE-2026-41678: openssl: incorrect bounds assertion in `aes::unwrap_key()` can lead to OOB write (bsc#1270651).\n- CVE-2026-41681: openssl: `MdCtxRef::digest_final()` writes past caller buffer with no length check (bsc#1270787).\n- CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent\n  memory to network peers (bsc#1270817).\n- CVE-2026-42327: openssl: undefined behavior in `X509Ref::ocsp_responders` when processing certificates with non-UTF-8\n  OCSP URLs (bsc#1270483).\n- CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding (bsc#1270886).\n- CVE-2026-45784: openssl: out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers\n  (bsc#1270949).\n- CVE-2026-25541: bytes: integer overflow in `BytesMut:reserve` can lead to undefined behavior and crashes\n  (bsc#1271348).\n\nOther updates and bugfixes:\n\n- Version 5.10.0.git73.b97f772:\n  * build(deps): bump anyhow from 1.0.99 to 1.0.103\n    https://github.com/coreos/afterburn/pull/1284\n  * build(deps): bump libflate from 2.1.0 to 2.2.2\n    https://github.com/coreos/afterburn/pull/1283\n  * build(deps): bump openssl from 0.10.79 to 0.10.80\n    https://github.com/coreos/afterburn/pull/1277\n- Version 5.10.0.git70.9cc2a7b:\n  * build(deps): bump openssl from 0.10.78 to 0.10.79\n  * providers/hetzner: Add the HETZNER_PUBLIC_IPV6 attribute\n  * providers/hetzner: Add support for network configuration\n  * build(deps): bump rustls-webpki from 0.103.10 to 0.103.13\n  * build(deps): bump openssl from 0.10.73 to 0.10.78\n  * docs: Add AGENTS.md and CLAUDE.md for AI coding assistants\n  * build(deps): bump rand from 0.9.2 to 0.9.4\n  * opencode: add skills for provider scaffolding and release automation\n  * ibmcloud-classic: Add missing network_id to fixture\n  * kubevirt: Support static gateway and DNS with DHCP\n  * build(deps): bump rustls-webpki from 0.103.6 to 0.103.10\n  * fix(proxmoxve): Define DNS entries for every interface\n  * Makefile: download `90-afterburn-authorized-keys-file.conf` for rpm building\n  * Sync repo templates ⚙\n  * build(deps): bump bytes from 1.10.1 to 1.11.1\n  * util/dhcp: Fix clippy lints\n  * build(deps): bump actions/checkout from 4 to 6\n  * build(deps): bump actions/upload-artifact from 4 to 5\n  * kubevirt: modprobe for virtio_blk; remove dracut preload\n  * kubevirt: Add NoCloud network configuration support\n  * kubevirt: Support config drive network data\n  * kubevirt: Refactor the provider to follow the proxmoxve structure\n  * dracut: Add virtio_blk module preload to afterburn-network-kargs service\n  * docs: Add release notes\n  * cargo: Afterburn release 5.10.0\n- Version 5.10.0:\n  * docs/release-notes: update for release 5.10.0\n  * cargo: update dependencies\n  * microsoft/azure: Add XML attribute alias for serde-xml-rs Fedora compat\n  * docs/release-notes: Add entry for Azure SharedConfig XML parsing fix\n  * microsoft/azure: Fix SharedConfig parsing of XML attributes\n  * microsoft/azure: Mock goalstate.SharedConfig output in tests\n  * providers/azure: switch SSH key retrieval from certs endpoint to IMDS\n  * build(deps): bump the build group with 8 updates\n  * build(deps): bump slab from 0.4.10 to 0.4.11\n  * build(deps): bump actions/checkout from 4 to 5\n  * upcloud: implement UpCloud provider\n  * build(deps): bump the build group with 4 updates\n","status":"published","published":"2026-07-23T11:09:40Z","modified":"2026-07-28T18:24:14.839227879Z","updated_at":"2026-11-02T15:54:03.080707Z"},{"id":"SUSE-SU-2026:23071-1","title":"Security update for afterburn","description":"This update for afterburn fixes the following issues:\n\nUpdate to version 5.10.0.git73.b97f772.\n\nSecurity issues fixed:\n\n- CVE-2026-41676: openssl: `Deriver:derive` and `PkeyCtxRef:derive` can overflow short buffers on OpenSSL 1.1.1\n  (bsc#1270175).\n- CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length\n  (bsc#1270555).\n- CVE-2026-41678: openssl: incorrect bounds assertion in `aes::unwrap_key()` can lead to OOB write (bsc#1270651).\n- CVE-2026-41681: openssl: `MdCtxRef::digest_final()` writes past caller buffer with no length check (bsc#1270787).\n- CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent\n  memory to network peers (bsc#1270817).\n- CVE-2026-42327: openssl: undefined behavior in `X509Ref::ocsp_responders` when processing certificates with non-UTF-8\n  OCSP URLs (bsc#1270483).\n- CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding (bsc#1270886).\n- CVE-2026-45784: openssl: out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers\n  (bsc#1270949).\n- CVE-2026-25541: bytes: integer overflow in `BytesMut:reserve` can lead to undefined behavior and crashes\n  (bsc#1271348).\n\nOther updates and bugfixes:\n\n- Version 5.10.0.git73.b97f772:\n  * build(deps): bump anyhow from 1.0.99 to 1.0.103\n    https://github.com/coreos/afterburn/pull/1284\n  * build(deps): bump libflate from 2.1.0 to 2.2.2\n    https://github.com/coreos/afterburn/pull/1283\n  * build(deps): bump openssl from 0.10.79 to 0.10.80\n    https://github.com/coreos/afterburn/pull/1277\n- Version 5.10.0.git70.9cc2a7b:\n  * build(deps): bump openssl from 0.10.78 to 0.10.79\n  * providers/hetzner: Add the HETZNER_PUBLIC_IPV6 attribute\n  * providers/hetzner: Add support for network configuration\n  * build(deps): bump rustls-webpki from 0.103.10 to 0.103.13\n  * build(deps): bump openssl from 0.10.73 to 0.10.78\n  * docs: Add AGENTS.md and CLAUDE.md for AI coding assistants\n  * build(deps): bump rand from 0.9.2 to 0.9.4\n  * opencode: add skills for provider scaffolding and release automation\n  * ibmcloud-classic: Add missing network_id to fixture\n  * kubevirt: Support static gateway and DNS with DHCP\n  * build(deps): bump rustls-webpki from 0.103.6 to 0.103.10\n  * fix(proxmoxve): Define DNS entries for every interface\n  * Makefile: download `90-afterburn-authorized-keys-file.conf` for rpm building\n  * Sync repo templates ⚙\n  * build(deps): bump bytes from 1.10.1 to 1.11.1\n  * util/dhcp: Fix clippy lints\n  * build(deps): bump actions/checkout from 4 to 6\n  * build(deps): bump actions/upload-artifact from 4 to 5\n  * kubevirt: modprobe for virtio_blk; remove dracut preload\n  * kubevirt: Add NoCloud network configuration support\n  * kubevirt: Support config drive network data\n  * kubevirt: Refactor the provider to follow the proxmoxve structure\n  * dracut: Add virtio_blk module preload to afterburn-network-kargs service\n  * docs: Add release notes\n  * cargo: Afterburn release 5.10.0\n- Version 5.10.0:\n  * docs/release-notes: update for release 5.10.0\n  * cargo: update dependencies\n  * microsoft/azure: Add XML attribute alias for serde-xml-rs Fedora compat\n  * docs/release-notes: Add entry for Azure SharedConfig XML parsing fix\n  * microsoft/azure: Fix SharedConfig parsing of XML attributes\n  * microsoft/azure: Mock goalstate.SharedConfig output in tests\n  * providers/azure: switch SSH key retrieval from certs endpoint to IMDS\n  * build(deps): bump the build group with 8 updates\n  * build(deps): bump slab from 0.4.10 to 0.4.11\n  * build(deps): bump actions/checkout from 4 to 5\n  * upcloud: implement UpCloud provider\n  * build(deps): bump the build group with 4 updates\n","status":"published","published":"2026-07-30T08:59:18Z","modified":"2026-08-14T18:23:35.54834852Z","updated_at":"2026-11-02T15:54:03.503431Z"}]}}