OPENSUSE-SU-2026:20105-1

Vulnerability from csaf_opensuse - Published: 2026-01-23 10:02 - Updated: 2026-01-23 10:02
Summary
Security update for sbctl

Notes

Title of the patch
Security update for sbctl
Description of the patch
This update for sbctl fixes the following issues: Changes in sbctl: - Upgrade the embedded golang.org/x/net to 0.46.0 * Fixes: bsc#1251399, CVE-2025-47911: various algorithms with quadratic complexity when parsing HTML documents * Fixes: bsc#1251609, CVE-2025-58190: excessive memory consumption by 'html.ParseFragment' when processing specially crafted input - Update to version 0.18: * logging: fixup new go vet warning * workflows: add cc for cross compile * workflow: add sudo to apt * workflow: add pcsclite to ci * workflow: try enable cgo * go.mod: update golang.org/x/ dependencies * fix: avoid adding bogus Country attribute to subject DNs * sbctl: only store file if we did actually sign the file * installkernel: add post install hook for Debian's traditional installkernel * CI: missing libpcsclite pkg * workflows: add missing depends and new pattern keyword * Add yubikey example for create keys to the README * Initial yubikey backend keytype support * verify: ensure we pass args in correct order - bsc#1248949 (CVE-2025-58058): Bump xz to 0.5.14 - Update to version 0.17: * Ensure we don't wrongly compare input/output files when signing * Added --json supprt to sbctl verify * Ensure sbctl setup with no arguments returns a helpful output * Import latest Microsoft keys for KEK and db databases * Ensure we print the path of the file when encountering an invalid PE file * Misc fixups in tests * Misc typo fixes in prints - Update to version 0.16: * Ensure sbctl reads --config even if /etc/sbctl/sbctl.conf is present * Fixed a bug where sbctl would abort if the TPM eventlog contains the same byte multiple times * Fixed a landlock bug where enroll-keys --export did not work * Fixed a bug where an ESP mounted to multiple paths would not be detected * Exporting keys without efivars present work again * sbctl sign will now use the saved output path if the signed file is enrolled * enroll-keys --append will now work without --force. - Updates from version 0.15.4: * Fixed an issue where sign-all did not report a non-zero exit code when something failed * Fixed and issue where we couldn't write to a file with landlock * Fixed an issue where --json would print the human readable output and the json * Fixes landlock for UKI/bundles by disabling the sandbox feature * Some doc fixups that mentioned /usr/share/
Patchnames
openSUSE-Leap-16.0-packagehub-93
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for sbctl",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for sbctl fixes the following issues:\n\nChanges in sbctl:\n\n- Upgrade the embedded golang.org/x/net to 0.46.0\n  * Fixes: bsc#1251399, CVE-2025-47911: various algorithms with\n    quadratic complexity when parsing HTML documents\n  * Fixes: bsc#1251609, CVE-2025-58190: excessive memory consumption\n    by \u0027html.ParseFragment\u0027 when processing specially crafted input\n\n- Update to version 0.18:\n  * logging: fixup new go vet warning\n  * workflows: add cc for cross compile\n  * workflow: add sudo to apt\n  * workflow: add pcsclite to ci\n  * workflow: try enable cgo\n  * go.mod: update golang.org/x/ dependencies\n  * fix: avoid adding bogus Country attribute to subject DNs\n  * sbctl: only store file if we did actually sign the file\n  * installkernel: add post install hook for Debian\u0027s traditional installkernel\n  * CI: missing libpcsclite pkg\n  * workflows: add missing depends and new pattern keyword\n  * Add yubikey example for create keys to the README\n  * Initial yubikey backend keytype support\n  * verify: ensure we pass args in correct order\n\n- bsc#1248949 (CVE-2025-58058):\n  Bump xz to 0.5.14\n\n- Update to version 0.17:\n  * Ensure we don\u0027t wrongly compare input/output files when signing\n  * Added --json supprt to sbctl verify\n  * Ensure sbctl setup with no arguments returns a helpful output\n  * Import latest Microsoft keys for KEK and db databases\n  * Ensure we print the path of the file when encountering an invalid PE file\n  * Misc fixups in tests\n  * Misc typo fixes in prints\n\n- Update to version 0.16:\n  * Ensure sbctl reads --config even if /etc/sbctl/sbctl.conf is\n    present\n  * Fixed a bug where sbctl would abort if the TPM eventlog\n    contains the same byte multiple times\n  * Fixed a landlock bug where enroll-keys --export did not work\n  * Fixed a bug where an ESP mounted to multiple paths would not be\n    detected\n  * Exporting keys without efivars present work again\n  * sbctl sign will now use the saved output path if the signed\n    file is enrolled\n  * enroll-keys --append will now work without --force.\n- Updates from version 0.15.4:\n  * Fixed an issue where sign-all did not report a non-zero exit\n    code when something failed\n  * Fixed and issue where we couldn\u0027t write to a file with landlock\n  * Fixed an issue where --json would print the human readable\n    output and the json\n  * Fixes landlock for UKI/bundles by disabling the sandbox feature\n  * Some doc fixups that mentioned /usr/share/\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Leap-16.0-packagehub-93",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_20105-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1248949",
        "url": "https://bugzilla.suse.com/1248949"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1251399",
        "url": "https://bugzilla.suse.com/1251399"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1251609",
        "url": "https://bugzilla.suse.com/1251609"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-47911 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-47911/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-58058 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-58058/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2025-58190 page",
        "url": "https://www.suse.com/security/cve/CVE-2025-58190/"
      }
    ],
    "title": "Security update for sbctl",
    "tracking": {
      "current_release_date": "2026-01-23T10:02:42Z",
      "generator": {
        "date": "2026-01-23T10:02:42Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:20105-1",
      "initial_release_date": "2026-01-23T10:02:42Z",
      "revision_history": [
        {
          "date": "2026-01-23T10:02:42Z",
          "number": "1",
          "summary": "Current version"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "sbctl-0.18-bp160.1.1.aarch64",
                "product": {
                  "name": "sbctl-0.18-bp160.1.1.aarch64",
                  "product_id": "sbctl-0.18-bp160.1.1.aarch64"
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "sbctl-0.18-bp160.1.1.x86_64",
                "product": {
                  "name": "sbctl-0.18-bp160.1.1.x86_64",
                  "product_id": "sbctl-0.18-bp160.1.1.x86_64"
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Leap 16.0",
                "product": {
                  "name": "openSUSE Leap 16.0",
                  "product_id": "openSUSE Leap 16.0"
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "sbctl-0.18-bp160.1.1.aarch64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:sbctl-0.18-bp160.1.1.aarch64"
        },
        "product_reference": "sbctl-0.18-bp160.1.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "sbctl-0.18-bp160.1.1.x86_64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:sbctl-0.18-bp160.1.1.x86_64"
        },
        "product_reference": "sbctl-0.18-bp160.1.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-47911",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-47911"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "unknown",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:sbctl-0.18-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:sbctl-0.18-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-47911",
          "url": "https://www.suse.com/security/cve/CVE-2025-47911"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1251308 for CVE-2025-47911",
          "url": "https://bugzilla.suse.com/1251308"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:sbctl-0.18-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:sbctl-0.18-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:sbctl-0.18-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:sbctl-0.18-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-01-23T10:02:42Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-47911"
    },
    {
      "cve": "CVE-2025-58058",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-58058"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "xz is a pure golang package for reading and writing xz-compressed files. Prior to version 0.5.14, it is possible to put data in front of an LZMA-encoded byte stream without detecting the situation while reading the header. This can lead to increased memory consumption because the current implementation allocates the full decoding buffer directly after reading the header. The LZMA header doesn\u0027t include a magic number or has a checksum to detect such an issue according to the specification. Note that the code recognizes the issue later while reading the stream, but at this time the memory allocation has already been done. This issue has been patched in version 0.5.14.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:sbctl-0.18-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:sbctl-0.18-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-58058",
          "url": "https://www.suse.com/security/cve/CVE-2025-58058"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1248889 for CVE-2025-58058",
          "url": "https://bugzilla.suse.com/1248889"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:sbctl-0.18-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:sbctl-0.18-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:sbctl-0.18-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:sbctl-0.18-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-01-23T10:02:42Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-58058"
    },
    {
      "cve": "CVE-2025-58190",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2025-58190"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "unknown",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:sbctl-0.18-bp160.1.1.aarch64",
          "openSUSE Leap 16.0:sbctl-0.18-bp160.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2025-58190",
          "url": "https://www.suse.com/security/cve/CVE-2025-58190"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1251309 for CVE-2025-58190",
          "url": "https://bugzilla.suse.com/1251309"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:sbctl-0.18-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:sbctl-0.18-bp160.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:sbctl-0.18-bp160.1.1.aarch64",
            "openSUSE Leap 16.0:sbctl-0.18-bp160.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-01-23T10:02:42Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2025-58190"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.