{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Recommended update for hauler",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for hauler fixes the following issues:\n\nChanges in hauler:\n\n- Update to version 1.4.1 (bsc#1256546, CVE-2026-22772):\n  * fixed typos for containerd imports (#493)\n  * fix and support containerd imports of `hauls` (#492)\n  * bump github.com/sigstore/fulcio (#489)\n\n- Update to version 1.4.0:\n  * added/updated logging for `serve` and `remove` (#487)\n  * added/fixed helm chart images/dependencies features (#485)\n  * more experimental feature updates (#486)\n  * add experimental notes (#483)\n  * updated tempdir flag to store persistent flags (#484)\n  * delete artifacts from store (#473)\n  * path rewrites (#475)\n  * updated/fixed workflow dependency versions (#478)\n\n- Update to version 1.3.2:\n  * bump to latest cosign fork release (#481)\n  * Bump golang.org/x/crypto in the go_modules group across 1 directory (#476)\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Leap-16.0-packagehub-96",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-ru-2026_20161-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1256546",
        "url": "https://bugzilla.suse.com/1256546"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-22772 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-22772/"
      }
    ],
    "title": "Recommended update for hauler",
    "tracking": {
      "current_release_date": "2026-01-27T17:25:17Z",
      "generator": {
        "date": "2026-01-27T17:25:17Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-RU-2026:20161-1",
      "initial_release_date": "2026-01-27T17:25:17Z",
      "revision_history": [
        {
          "date": "2026-01-27T17:25:17Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "hauler-1.4.1-bp160.1.1.aarch64",
                "product": {
                  "name": "hauler-1.4.1-bp160.1.1.aarch64",
                  "product_id": "hauler-1.4.1-bp160.1.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "hauler-1.4.1-bp160.1.1.x86_64",
                "product": {
                  "name": "hauler-1.4.1-bp160.1.1.x86_64",
                  "product_id": "hauler-1.4.1-bp160.1.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Leap 16.0",
                "product": {
                  "name": "openSUSE Leap 16.0",
                  "product_id": "openSUSE Leap 16.0"
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "hauler-1.4.1-bp160.1.1.aarch64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:hauler-1.4.1-bp160.1.1.aarch64"
        },
        "product_reference": "hauler-1.4.1-bp160.1.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "hauler-1.4.1-bp160.1.1.x86_64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:hauler-1.4.1-bp160.1.1.x86_64"
        },
        "product_reference": "hauler-1.4.1-bp160.1.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-22772",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-22772"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Prior to 1.8.5, Fulcio\u0027s metaRegex() function uses unanchored regex, allowing attackers to bypass MetaIssuer URL validation and trigger SSRF to arbitrary internal services. Since the SSRF only can trigger GET requests, the request cannot mutate state. The response from the GET request is not returned to the caller so data exfiltration is not possible. A malicious actor could attempt to probe an internal network through Blind SSRF. This vulnerability is fixed in 1.8.5.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:hauler-1.4.1-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:hauler-1.4.1-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-22772",
          "url": "https://www.suse.com/security/cve/CVE-2026-22772"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1256532 for CVE-2026-22772",
          "url": "https://bugzilla.suse.com/1256532"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:hauler-1.4.1-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:hauler-1.4.1-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:hauler-1.4.1-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:hauler-1.4.1-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-01-27T17:25:17Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-22772"
    }
  ]
}