SUSE-SU-2026:4931-1

Dashboard / Vulnerabilities / SUSE-SU-2026:4931-1

SUSE-SU-2026:4931-1

Summary: Security update for rust-keylime

Details: This update for rust-keylime fixes the following issue: - CVE-2026-115905: zip: security control bypass via parser differential between central directory and local headers (bsc#1287921) - CVE-2026-115906: zip: authentication bypass in AES encrypted entries due to improper HMAC verification (bsc#1287921) - CVE-2026-115907: zip: denial of service via unbounded memory allocation in legacy decoders (bsc#1287921) - CVE-2026-115908: zip: path traversal via lexical symlink validation during extraction (bsc#1287921) - CVE-2026-115909: zip: denial of service via uncontrolled memory allocation on symlink targets (bsc#1287921) Changes for rust-keylime: - Update to version 0.2.10+12: * log Agent UUID at push agent startup * Limit actix-web workers * Fix clippy needless_late_init warnings * Unwrap OCTET STRING wrapped EK certificates * build(deps): bump rand from 0.9.4 to 0.10.1 * build(deps): bump glob from 0.3.3 to 0.3.4 * build(deps): bump reqwest from 0.13.3 to 0.13.4 * Check shutdown marker inside ml_extend loop * Fix clippy useless_borrows_in_formatting warnings * build(deps): bump tokio from 1.52.2 to 1.53.1 * Fix payload key upgrade regression by falling back to mTLS key * Accept any RSA key size for payload encryption * Bump version to 0.2.10 * keylime: use runtime OpenSSL algorithm detection instead of compile-time symbols

References: https://www.suse.com/support/update/announcement/2026/suse-su-20264931-1/, https://bugzilla.suse.com/1287921, https://www.suse.com/security/cve/CVE-2026-115905, https://www.suse.com/security/cve/CVE-2026-115906, https://www.suse.com/security/cve/CVE-2026-115907, https://www.suse.com/security/cve/CVE-2026-115908, https://www.suse.com/security/cve/CVE-2026-115909