openSUSE-SU-2026:22224-1

Dashboard / Vulnerabilities / openSUSE-SU-2026:22224-1

openSUSE-SU-2026:22224-1

Summary: Security update for rqlite

Details: This update for rqlite fixes the following issues: Changes in rqlite: - Update to version 10.6.6: * Keep the local auto-backup file if the metadata rename fails * Reject local auto-backup filenames reserved for internal use * POST /demote and POST /promote return a JSON error body, and 404 when the target node is not in the cluster. * DELETE /remove returns a JSON error body. - Includes changes from version 10.6.5: * Guard the inter-node backup stream handler directly against a missing backup request * POST /leader returns a JSON error body, and 404 when the target node is not in the cluster - Update to version 10.6.4: * BACKUP_STREAM authorization failures can disclose the database and crash rqlited (boo#1286934) * GET /leader returns a JSON error body when there is no leader * Close the connection after rejecting an unauthorized inter-node backup stream request, instead of streaming the database anyway * Decide inter-node command authorization once, before dispatch, and close the connection after rejecting any unauthorized command - Update to version 10.6.3: * Node probes honor request context and commit exactly one result * Make DB connections a first-class object * Prevent ATTACH on the query database connection - Update to version 10.6.2: * Check for trailing junk in request bodies * Console schema view handles table names that collide with JavaScript object properties * Set CommitTimestamps in CDC Events Group * Upgrade dependencies - Update to version 10.6.1: * Use constant-time comparison when comparing passwords * Conditionally rewrite SQL during queued writes and fix rewriting of CURRENT_TIMESTAMP and related tokens * More robust Leader stepdown node ID detection, reap checks, and SQL analyze start-time recording * CDC fixes: encode non-finite floats, always release flush waiters, and make the HTTP sink follow redirects * Converted _service from mode=disabled to mode=manual (legacy leftover; services are run by hand via osc service manualrun) * Package is not affected by CVE-2026-84445 (boo#1278793), CVE-2026-84304 (boo#1279102), CVE-2026-84303 (boo#1279253): vendored grpc is v1.84.0, above the v1.83.1/v1.83.2 fixes * Package is not affected by CVE-2026-89090 (boo#1280657): vendored eventstream is v1.7.20, above the v1.7.8 fix * Package is not affected by CVE-2026-63209 (boo#1283555): vendored klauspost/compress is v1.20.1, above the v1.18.7 fix * Package is not affected by CVE-2026-39821 (boo#1266544): vendored golang.org/x/net is v0.59.0, above the v0.55.0 fix - Update to version 10.6.0: * API addition: error_v2 may contain numeric SQLite error codes. * addresses a security issue related to Authentication files. A user with no explicit permissions could be grant elevated permissions. Correctly configured users do not suffer from this issue. * multiple implementation changes and bug fixes * Display interactive cluster topology on web console. * Support configurable queued-writes retries * release addresses a gap in the role-based access permissions related to change-data-capture (CDC) handling - Update to version 10.3.6: * Add query logging to database layer * Snapshot IDs now contain (optional) generation * Bump generation ID if snapshot IDs collide * Snapshots can be filtered by term and index * Add support for File Renaming and Removing with retries * Replace standard library with fsutil * Keep snapshot ordering correct regardless of clock * Remove snapshot name generation ID - Update to version 10.3.5: * Reject alternate form of unsupported PRAGMA commands * Handle negative trailing logs * Sync access to last backup time at http layer * Set the "Served by" header before first backup byte * Set DB load response time for all formats * Fix HTTP logic error for queued statements * Minor web console fixes - includes changes from 10.0.4: * Do not emit rolled-back events over CDC - includes changes from 10.0.3: * Refactor busy timeout methods * Fix edge-case bugs detected by GPT-6 Astra * Switch to quay.io/minio/minio:latest for testing purposes * Fix removing a node with different ID, but same Raft address * Use correct Foreign Key setting when recovering node * Only dump the indexes and triggers of the selected tables * Detect DB changes during Request(RETURNING) * Snapshot Open() first checks for failed reap * Sync snapshot plan directory * Propagate WAL stat errors * Clean up cancelled snapshots * Reject incomplete snapshot headers * Validate restore database header * Only reap a sole fullsnapshot if it has zero WALs * Keep database dumps consistent during writes to the database * Roll back DB Requests on statement-prepare errors - includes changes from 10.0.2: * Upgrade SQLite driver * Unit test reaping an installed Snapshot and streamed Snapshot combo * Use distinct Snapshot Namer type * Replace breaking-pragma regexes with ASCII prefix scanning * Consolidate pragma and txStatus reads onto a single connection per pool * Fix some magic strings in db package - Update to version 10.3.1: * Consolidate SQLite driver construction * Plumb Term and Index through during Snapshot Restore * Hard exit if FSM Restore fails post database-swap - Update to version 10.3.0: * Console app supports quickly querying for first 100 rows of a table * Rename read-only nodes to read replicas. Command-line flags unchanged * Bundles dependencies updated * Add infra for pushing OTLP metrics to an OpenTelemetry Collector * Add query logging at database level * Add CopyDir functionality to file utils. * Add ability to clone Snapshots, primarily for testing purposes * Store Index and Term in Fingerprint file and check during start-up - Update to version 10.2.7: * Remove explicit database-level read-only check from the pure Query path * Miscellaneous Store-level fixes related to resource management and shutdown sequence * Don't run CRC checks twice on Snapshot when fast-restart is explicitly disabled * Fixes to the http package including SQL rewriting control. * Address potential dropped CDC event on restart * Various minor fixes - includes changes from 10.2.6: * Handle a fully-executed Reap plan, but Plan file itself not removed * Close Snapshot streamer on error. - includes changes from 10.2.5: * Perform a Quick Integrity check after reaping snapshots, not Full - Update to version 10.2.4: * Fix some non-AWS S3-compatible stores - includes changes from 10.2.3 * Check snapshot store integrity before first actual use * Disable HTTP timeout for boot and restore operations via the shell * HTTP layer ignores ErrNoWALToSnapshot when snapshotting * Close Snapshot Streamer ASAP when restoring to local node

References: , https://bugzilla.suse.com/1266544, https://bugzilla.suse.com/1278793, https://bugzilla.suse.com/1279102, https://bugzilla.suse.com/1279253, https://bugzilla.suse.com/1280657, https://bugzilla.suse.com/1283555, https://bugzilla.suse.com/1286934, https://www.suse.com/security/cve/CVE-2026-39821, https://www.suse.com/security/cve/CVE-2026-63209, https://www.suse.com/security/cve/CVE-2026-84303, https://www.suse.com/security/cve/CVE-2026-84304, https://www.suse.com/security/cve/CVE-2026-84445, https://www.suse.com/security/cve/CVE-2026-89090