Mehrere Probleme in alloy (SUSE)

Дата публикации: 24-09-2026 23:49:10

Основное содержимое страницы с новостью.

--===============6951148124631595832==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit

# Security update for alloy

Announcement ID: SUSE-SU-2026:23853-1
Release Date: 2026-09-21T12:26:04Z
Rating: important
References:

* bsc#1263289
* bsc#1263324
* bsc#1264949
* bsc#1265542
* bsc#1265845
* bsc#1266654

Cross-References:

* CVE-2026-10722
* CVE-2026-1229
* CVE-2026-33814
* CVE-2026-39821
* CVE-2026-41506
* CVE-2026-41606
* CVE-2026-41607

CVSS scores:

* CVE-2026-10722 ( SUSE ): 6.8
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
* CVE-2026-10722 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-10722 ( NVD ): 1.9

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
* CVE-2026-10722 ( NVD ): 3.3 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
* CVE-2026-10722 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-1229 ( SUSE ): 8.3
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N
* CVE-2026-1229 ( SUSE ): 7.0 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L
* CVE-2026-1229 ( NVD ): 2.9

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:X/V:X/RE:X/U:Amber
* CVE-2026-1229 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
* CVE-2026-33814 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-33814 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-33814 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-33814 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-39821 ( SUSE ): 9.1
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
* CVE-2026-39821 ( SUSE ): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
* CVE-2026-39821 ( NVD ): 9.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
* CVE-2026-39821 ( NVD ): 8.2 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
* CVE-2026-41506 ( SUSE ): 7.1
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
* CVE-2026-41506 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
* CVE-2026-41506 ( NVD ): 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
* CVE-2026-41506 ( NVD ): 7.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
* CVE-2026-41606 ( SUSE ): 6.9
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
* CVE-2026-41606 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
* CVE-2026-41606 ( NVD ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
* CVE-2026-41606 ( NVD ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-41607 ( SUSE ): 6.9
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
* CVE-2026-41607 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
* CVE-2026-41607 ( NVD ): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
* CVE-2026-41607 ( NVD ): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Affected Products:

* SUSE Linux Enterprise Server 16.0

An update that solves seven vulnerabilities can now be installed.

## Description:

This update for alloy fixes the following issues:

* CVE-2026-1229: github.com/cloudflare/circl: the CombinedMult function in
the
ecc/p384 package produces an incorrect value for specific inputs
(bsc#1265542).
* CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport
when given bad SETTINGS_MAX_FRAME_SIZE (bsc#1265845).
* CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only
Punycode-encoded labels allows for validation bypass and privilege
escalation (bsc#1266654).
* CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential
leak when following redirects during smart-HTTP clone and fetch operations
(bsc#1264949).
* CVE-2026-41606: github.com/apache/thrift: crafted nested messages in c_glib
dispatch can lead to uncontrolled recursion and denial of service
(bsc#1263324).
* CVE-2026-41607: github.com/apache/thrift: crafted message with improper
length validation can lead to an out-of-bounds read and potential
information disclosure (bsc#1263289).

Changes for alloy:

* Update to version 1.18.0:
* BREAKING: otelcol HTTP receivers default to idle_timeout="1m",
read_header_timeout="1m", write_timeout="30s" to match
upstream. Affects
otlp, faro, jaeger, zipkin, influxdb, splunkhec, datadog and
jaeger_remote_sampling.
* Back off usage reporting on persistent failure
* Fix Beyla glob parsing
* Bump github.com/prometheus/procfs for XFS Collector fix
* database_observability.mysql: Simplify denylist in-memory map
* database_observability.postgres: Handle DSN with unix sockets
* database_observability.postgres: Update collect intervals
* database_observability: Explain-plan conditions now redact
* Don't emit error log when remotecfg is unused
* For a full list of changes, please refer to the CHANGELOG:
https://github.com/grafana/alloy/blob/v1.18.0/CHANGELOG.md

## Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:

* SUSE Linux Enterprise Server 16.0
zypper in -t patch SUSE-SLES-16.0-1727

## Package List:

* SUSE Linux Enterprise Server 16.0 (aarch64 ppc64le s390x x86_64)
* alloy-debuginfo-1.18.0-160000.1.1
* alloy-1.18.0-160000.1.1

## References:

* https://www.suse.com/security/cve/CVE-2026-10722.html
* https://www.suse.com/security/cve/CVE-2026-1229.html
* https://www.suse.com/security/cve/CVE-2026-33814.html
* https://www.suse.com/security/cve/CVE-2026-39821.html
* https://www.suse.com/security/cve/CVE-2026-41506.html
* https://www.suse.com/security/cve/CVE-2026-41606.html
* https://www.suse.com/security/cve/CVE-2026-41607.html
* https://bugzilla.suse.com/show_bug.cgi?id=1263289
* https://bugzilla.suse.com/show_bug.cgi?id=1263324
* https://bugzilla.suse.com/show_bug.cgi?id=1264949
* https://bugzilla.suse.com/show_bug.cgi?id=1265542
* https://bugzilla.suse.com/show_bug.cgi?id=1265845
* https://bugzilla.suse.com/show_bug.cgi?id=1266654

--===============6951148124631595832==
Content-Type: text/html; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit

<div class="container">
<h1>Security update for alloy</h1>

<table class="table table-striped table-bordered">
<tbody>
<tr>
<th>Announcement ID:</th>
<td>SUSE-SU-2026:23853-1</td>
</tr>
<tr>
<th>Release Date:</th>
<td>2026-09-21T12:26:04Z</td>
</tr>

<tr>
<th>Rating:</th>
<td>important</td>
</tr>
<tr>
<th>References:</th>
<td>
<ul>

</ul>
</td>
</tr>

<tr>
<th>
Cross-References:
</th>
<td>
<ul>

</ul>
</td>
</tr>
<tr>
<th>CVSS scores:</th>
<td>
<ul class="list-group">