opensuse-su-2025:14893-1
Vulnerability from csaf_opensuse
Published
2025-03-15 00:00
Modified
2025-03-15 00:00
Summary
govulncheck-vulndb-0.0.20250313T170021-1.1 on GA media

Notes

Title of the patch
govulncheck-vulndb-0.0.20250313T170021-1.1 on GA media
Description of the patch
These are all security issues fixed in the govulncheck-vulndb-0.0.20250313T170021-1.1 package on the GA media of openSUSE Tumbleweed.
Patchnames
openSUSE-Tumbleweed-2025-14893
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "govulncheck-vulndb-0.0.20250313T170021-1.1 on GA media",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "These are all security issues fixed in the govulncheck-vulndb-0.0.20250313T170021-1.1 package on the GA media of openSUSE Tumbleweed.",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Tumbleweed-2025-14893",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2025_14893-1.json"
      },
      {
        "category": "self",
        "summary": "URL for openSUSE-SU-2025:14893-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/IISU33DXNWHOYGRCT77IPABZTMARV5T6/"
      },
      {
        "category": "self",
        "summary": "E-Mail link for openSUSE-SU-2025:14893-1",
        "url": "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/IISU33DXNWHOYGRCT77IPABZTMARV5T6/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-1725 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-1725/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2024-52812 page",
        "url": "https://www.suse.com/security/cve/CVE-2024-52812/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-1296 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-1296/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-26260 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-26260/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-27403 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-27403/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-27616 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-27616/"
      }
    ],
    "title": "govulncheck-vulndb-0.0.20250313T170021-1.1 on GA media",
    "tracking": {
      "current_release_date": "2025-03-15T00:00:00Z",
      "generator": {
        "date": "2025-03-15T00:00:00Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2025:14893-1",
      "initial_release_date": "2025-03-15T00:00:00Z",
      "revision_history": [
        {
          "date": "2025-03-15T00:00:00Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "govulncheck-vulndb-0.0.20250313T170021-1.1.aarch64",
                "product": {
                  "name": "govulncheck-vulndb-0.0.20250313T170021-1.1.aarch64",
                  "product_id": "govulncheck-vulndb-0.0.20250313T170021-1.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "govulncheck-vulndb-0.0.20250313T170021-1.1.ppc64le",
                "product": {
                  "name": "govulncheck-vulndb-0.0.20250313T170021-1.1.ppc64le",
                  "product_id": "govulncheck-vulndb-0.0.20250313T170021-1.1.ppc64le"
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "govulncheck-vulndb-0.0.20250313T170021-1.1.s390x",
                "product": {
                  "name": "govulncheck-vulndb-0.0.20250313T170021-1.1.s390x",
                  "product_id": "govulncheck-vulndb-0.0.20250313T170021-1.1.s390x"
                }
              }
            ],
            "category": "architecture",
            "name": "s390x"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "govulncheck-vulndb-0.0.20250313T170021-1.1.x86_64",
                "product": {
                  "name": "govulncheck-vulndb-0.0.20250313T170021-1.1.x86_64",
                  "product_id": "govulncheck-vulndb-0.0.20250313T170021-1.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Tumbleweed",
                "product": {
                  "name": "openSUSE Tumbleweed",
                  "product_id": "openSUSE Tumbleweed",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:opensuse:tumbleweed"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "govulncheck-vulndb-0.0.20250313T170021-1.1.aarch64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250313T170021-1.1.aarch64"
        },
        "product_reference": "govulncheck-vulndb-0.0.20250313T170021-1.1.aarch64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "govulncheck-vulndb-0.0.20250313T170021-1.1.ppc64le as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250313T170021-1.1.ppc64le"
        },
        "product_reference": "govulncheck-vulndb-0.0.20250313T170021-1.1.ppc64le",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "govulncheck-vulndb-0.0.20250313T170021-1.1.s390x as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250313T170021-1.1.s390x"
        },
        "product_reference": "govulncheck-vulndb-0.0.20250313T170021-1.1.s390x",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "govulncheck-vulndb-0.0.20250313T170021-1.1.x86_64 as component of openSUSE Tumbleweed",
          "product_id": "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250313T170021-1.1.x86_64"
        },
        "product_reference": "govulncheck-vulndb-0.0.20250313T170021-1.1.x86_64",
        "relates_to_product_reference": "openSUSE Tumbleweed"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-1725",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-1725"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "A flaw was found in the kubevirt-csi component of OpenShift Virtualization\u0027s Hosted Control Plane (HCP). This issue could allow an authenticated attacker to gain access to the root HCP worker node\u0027s volume by creating a custom Persistent Volume that matches the name of a worker node.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250313T170021-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250313T170021-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250313T170021-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250313T170021-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-1725",
          "url": "https://www.suse.com/security/cve/CVE-2024-1725"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250313T170021-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250313T170021-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250313T170021-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250313T170021-1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250313T170021-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250313T170021-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250313T170021-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250313T170021-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-03-15T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2024-1725"
    },
    {
      "cve": "CVE-2024-52812",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2024-52812"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "LF Edge eKuiper is an internet-of-things data analytics and stream processing engine. Prior to version 2.0.8, auser with rights to modify the service (e.g. kuiperUser role) can inject a cross-site scripting payload into the rule `id` parameter. Then, after any user with access to this service (e.g. admin) tries make any modifications with the rule (update, run, stop, delete), a payload acts in the victim\u0027s browser. Version 2.0.8 fixes the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250313T170021-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250313T170021-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250313T170021-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250313T170021-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2024-52812",
          "url": "https://www.suse.com/security/cve/CVE-2024-52812"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250313T170021-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250313T170021-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250313T170021-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250313T170021-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-03-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2024-52812"
    },
    {
      "cve": "CVE-2025-1296",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-1296"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Nomad Community and Nomad Enterprise (\"Nomad\") are vulnerable to unintentional exposure of the workload identity token and client secret token in audit logs. This vulnerability, identified as CVE-2025-1296, is fixed in Nomad Community Edition 1.9.7 and Nomad Enterprise 1.9.7, 1.8.11, and 1.7.19.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250313T170021-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250313T170021-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250313T170021-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250313T170021-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-1296",
          "url": "https://www.suse.com/security/cve/CVE-2025-1296"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250313T170021-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250313T170021-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250313T170021-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250313T170021-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-03-15T00:00:00Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-1296"
    },
    {
      "cve": "CVE-2025-26260",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-26260"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Plenti \u003c= 0.7.16 is vulnerable to code execution. Users uploading \u0027.svelte\u0027 files with the /postLocal endpoint can define the file name as javascript codes. The server executes the uploaded file name in host, and cause code execution.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250313T170021-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250313T170021-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250313T170021-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250313T170021-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-26260",
          "url": "https://www.suse.com/security/cve/CVE-2025-26260"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250313T170021-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250313T170021-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250313T170021-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250313T170021-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-03-15T00:00:00Z",
          "details": "not set"
        }
      ],
      "title": "CVE-2025-26260"
    },
    {
      "cve": "CVE-2025-27403",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-27403"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Ratify is a verification engine as a binary executable and on Kubernetes which enables verification of artifact security metadata and admits for deployment only those that comply with policies the user creates. In a Kubernetes environment, Ratify can be configured to authenticate to a private Azure Container Registry (ACR). The Azure workload identity and Azure managed identity authentication providers are configured in this setup. Users that configure a private ACR to be used with the Azure authentication providers may be impacted by a vulnerability that exists in versions prior to 1.2.3 and 1.3.2. Both Azure authentication providers attempt to exchange an Entra ID (EID) token for an ACR refresh token. However, Ratify\u0027s Azure authentication providers did not verify that the target registry is an ACR. This could have led to the EID token being presented to a non-ACR registry during token exchange. EID tokens with ACR access can potentially be extracted and abused if a user workload contains an image reference to a malicious registry. As of versions 1.2.3 and 1.3.2, the Azure workload identity and Azure managed identity authentication providers are updated to add new validation prior to EID token exchange. Validation relies upon registry domain validation against a pre-configured list of well-known ACR endpoints. EID token exchange will be executed only if at least one of the configured well-known domain suffixes (wildcard support included) matches the registry domain of the image reference.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250313T170021-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250313T170021-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250313T170021-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250313T170021-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-27403",
          "url": "https://www.suse.com/security/cve/CVE-2025-27403"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250313T170021-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250313T170021-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250313T170021-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250313T170021-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-03-15T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-27403"
    },
    {
      "cve": "CVE-2025-27616",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-27616"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Vela is a Pipeline Automation (CI/CD) framework built on Linux container technology written in Golang. Prior to versions 0.25.3 and 0.26.3, by spoofing a webhook payload with a specific set of headers and body data, an attacker could transfer ownership of a repository and its repo level secrets to a separate repository. These secrets could be exfiltrated by follow up builds to the repository. Users with an enabled repository with access to repo level CI secrets in Vela are vulnerable to the exploit, and any user with access to the CI instance and the linked source control manager can perform the exploit. Versions 0.25.3 and 0.26.3 fix the issue. No known workarounds are available.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250313T170021-1.1.aarch64",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250313T170021-1.1.ppc64le",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250313T170021-1.1.s390x",
          "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250313T170021-1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-27616",
          "url": "https://www.suse.com/security/cve/CVE-2025-27616"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250313T170021-1.1.aarch64",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250313T170021-1.1.ppc64le",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250313T170021-1.1.s390x",
            "openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250313T170021-1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2025-03-15T00:00:00Z",
          "details": "important"
        }
      ],
      "title": "CVE-2025-27616"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.