OPENSUSE-SU-2026:21884-1

Vulnerability from csaf_opensuse - Published: 2026-09-20 03:28 - Updated: 2026-09-24 17:48
Summary
Security update for amazon-ssm-agent
Severity
Important
Notes
Title of the patch: Security update for amazon-ssm-agent
Description of the patch: This update for amazon-ssm-agent fixes the following issues: - CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278681). - CVE-2026-71556: github.com/go-git/go-git/v5: arbitrary file read/write via symbolic link resolution (bsc#1276981). - CVE-2026-71557: github.com/go-git/go-git/v5: malicious reference names may modify files outside the reference storage (bsc#1276994). Changes for amazon-ssm-agent: - Update to version 3.3.5390.0 * Bump github.com/gorilla/websocket from v1.4.2 to v1.5.3 * Bump golang.org/x/crypto from v0.53.0 to v0.56.0 * Bump golang.org/x/net from v0.56.0 to v0.57.0 * Bump golang.org/x/sys from v0.46.0 to v0.47.0 * Upgrade GoLang version from 1.25 to 1.26 * Mint control-channel token after dial to fix AZ-fault token expiry * Resume patch documents interrupted by an external shutdown * Use systemctl for systemd in aws: configureDocker on Amazon Linux * Update greengrass component version to 1.3.5 - Update to version 3.3.5226.0 * Add bounds check for HeaderLength in AgentMessage Deserialize * Bump github.com/go-git/go-git/v5 to v5.19.2 * Bump golang.org/x/sync to v0.21.0 * Detect Azure Linux and potential future unregistered Linux platforms * Fix Windows session command parsing by removing shlex * Fix shell injection in Windows domainjoin plugin parameters * Prevent control channel deadlock on ProcessorBufferFull * Revert migration from aws-sdk-go v1 to aws-sdk-go-v2 change * Update the logic for loading RegistrationInfo * Upgrade Go version to 1.25.13 - Update to version 3.3.5068.0 * Migrate from aws-sdk-go v1 to aws-sdk-go-v2 * Fix flaky registration/connection channel tests * Sync AWS SDK fork in extra/ with multicloud vendor changes * Harden function create file with permissions in a single syscall * Upgrade Go version to 1.25.12 * Bump golang.org/x/net@v0.55.0 to golang.org/x/net@v0.56.0 * Fix loopback bypass in remote-host port forwarding denylist - Update to version 3.3.4851.0 * Add ECS/EKS credential endpoints and loopback to port-forward denylist * Canonicalize IP addresses before port-forwarding denylist check * Pass the ActiveDirectory domain password via stdin using -y /dev/stdin instead of the -w flag * Fix false StuckAtInProgress timeout for associations with rate >= 2h * Fix non-interactive session big file transfer issues * Prevent ssm-user race condition with flock-based serialization * Send AWS::EC2::Instance as source type when registered with provider EC2 * Validate process name in orphan worker detection - Update to version 3.3.4793.0 * Add multicloud support enabling SSM Agent registration with Azure cloud providers * Add support for the upcoming public key in the agent code
Patchnames: openSUSE-Leap-16.0-1711
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
CVE-2026-56854
8.1 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Affected products
Product Identifier Version Remediation
Unresolved product id: openSUSE Leap 16.0:amazon-ssm-agent-0:3.3.5390.0-160000.1.1.aarch64 —
Vendor Fix
Unresolved product id: openSUSE Leap 16.0:amazon-ssm-agent-0:3.3.5390.0-160000.1.1.x86_64 —
Vendor Fix
Threats
Impact important
CVE-2026-56855
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
Recommended 2 products, the same list as for CVE-2026-56854
Threats
Impact important
CVE-2026-71556
7.1 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L
Affected products
Recommended 2 products, the same list as for CVE-2026-56854
Threats
Impact important
CVE-2026-71557
5.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Affected products
Recommended 2 products, the same list as for CVE-2026-56854
Threats
Impact moderate
CVE-2026-78662
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected products
Recommended 2 products, the same list as for CVE-2026-56854
Threats
Impact important
References
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://www.suse.com/support/security/rating/",
      "text": "important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright 2024 SUSE LLC. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Security update for amazon-ssm-agent",
        "title": "Title of the patch"
      },
      {
        "category": "description",
        "text": "This update for amazon-ssm-agent fixes the following issues:\n\n- CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the\n  crypto/ssh library (bsc#1278681).\n- CVE-2026-71556: github.com/go-git/go-git/v5: arbitrary file read/write via symbolic link resolution (bsc#1276981).\n- CVE-2026-71557: github.com/go-git/go-git/v5: malicious reference names may modify files outside the reference storage\n  (bsc#1276994).\n\nChanges for amazon-ssm-agent:\n\n- Update to version 3.3.5390.0\n * Bump github.com/gorilla/websocket from v1.4.2 to v1.5.3\n * Bump golang.org/x/crypto from v0.53.0 to v0.56.0\n * Bump golang.org/x/net from v0.56.0 to v0.57.0\n * Bump golang.org/x/sys from v0.46.0 to v0.47.0\n * Upgrade GoLang version from 1.25 to 1.26\n * Mint control-channel token after dial to fix AZ-fault token expiry\n * Resume patch documents interrupted by an external shutdown\n * Use systemctl for systemd in aws: configureDocker on Amazon Linux\n * Update greengrass component version to 1.3.5\n\n- Update to version 3.3.5226.0\n * Add bounds check for HeaderLength in AgentMessage Deserialize\n * Bump github.com/go-git/go-git/v5 to v5.19.2\n * Bump golang.org/x/sync to v0.21.0\n * Detect Azure Linux and potential future unregistered Linux platforms\n * Fix Windows session command parsing by removing shlex\n * Fix shell injection in Windows domainjoin plugin parameters\n * Prevent control channel deadlock on ProcessorBufferFull\n * Revert migration from aws-sdk-go v1 to aws-sdk-go-v2 change\n * Update the logic for loading RegistrationInfo\n * Upgrade Go version to 1.25.13\n\n- Update to version 3.3.5068.0\n\n * Migrate from aws-sdk-go v1 to aws-sdk-go-v2\n * Fix flaky registration/connection channel tests\n * Sync AWS SDK fork in extra/ with multicloud vendor changes\n * Harden function create file with permissions in a single syscall\n * Upgrade Go version to 1.25.12\n * Bump golang.org/x/net@v0.55.0 to golang.org/x/net@v0.56.0\n * Fix loopback bypass in remote-host port forwarding denylist\n\n- Update to version 3.3.4851.0\n\n * Add ECS/EKS credential endpoints and loopback to port-forward denylist\n * Canonicalize IP addresses before port-forwarding denylist check\n * Pass the ActiveDirectory domain password via stdin using -y /dev/stdin\n instead of the -w flag\n * Fix false StuckAtInProgress timeout for associations with rate \u003e= 2h\n * Fix non-interactive session big file transfer issues\n * Prevent ssm-user race condition with flock-based serialization\n * Send AWS::EC2::Instance as source type when registered with provider EC2\n * Validate process name in orphan worker detection\n\n- Update to version 3.3.4793.0\n\n * Add multicloud support enabling SSM Agent registration with\n Azure cloud providers\n * Add support for the upcoming public key in the agent code\n",
        "title": "Description of the patch"
      },
      {
        "category": "details",
        "text": "openSUSE-Leap-16.0-1711",
        "title": "Patchnames"
      },
      {
        "category": "legal_disclaimer",
        "text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
        "title": "Terms of use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://www.suse.com/support/security/contact/",
      "name": "SUSE Product Security Team",
      "namespace": "https://www.suse.com/"
    },
    "references": [
      {
        "category": "external",
        "summary": "SUSE ratings",
        "url": "https://www.suse.com/support/security/rating/"
      },
      {
        "category": "self",
        "summary": "URL of this CSAF notice",
        "url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_21884-1.json"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1276981",
        "url": "https://bugzilla.suse.com/1276981"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1276994",
        "url": "https://bugzilla.suse.com/1276994"
      },
      {
        "category": "self",
        "summary": "SUSE Bug 1278681",
        "url": "https://bugzilla.suse.com/1278681"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-56854 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-56854/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-56855 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-56855/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-71556 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-71556/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-71557 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-71557/"
      },
      {
        "category": "self",
        "summary": "SUSE CVE CVE-2026-78662 page",
        "url": "https://www.suse.com/security/cve/CVE-2026-78662/"
      }
    ],
    "title": "Security update for amazon-ssm-agent",
    "tracking": {
      "current_release_date": "2026-09-24T17:48:05Z",
      "generator": {
        "date": "2026-09-20T03:28:14Z",
        "engine": {
          "name": "cve-database.git:bin/generate-csaf.pl",
          "version": "1"
        }
      },
      "id": "openSUSE-SU-2026:21884-1",
      "initial_release_date": "2026-09-20T03:28:14Z",
      "revision_history": [
        {
          "date": "2026-09-20T03:28:14Z",
          "number": "1",
          "summary": "Current version"
        },
        {
          "date": "2026-09-24T17:48:05Z",
          "number": "2",
          "summary": "unknown changes"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "amazon-ssm-agent-0:3.3.5390.0-160000.1.1.aarch64",
                "product": {
                  "name": "amazon-ssm-agent-0:3.3.5390.0-160000.1.1.aarch64",
                  "product_id": "amazon-ssm-agent-0:3.3.5390.0-160000.1.1.aarch64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:amazon:amazon_ssm_agent:3.3.5390.0:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/amazon-ssm-agent@3.3.5390.0-160000.1.1?arch=aarch64\u0026upstream=amazon-ssm-agent-0:3.3.5390.0-160000.1.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "aarch64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "amazon-ssm-agent-0:3.3.5390.0-160000.1.1.x86_64",
                "product": {
                  "name": "amazon-ssm-agent-0:3.3.5390.0-160000.1.1.x86_64",
                  "product_id": "amazon-ssm-agent-0:3.3.5390.0-160000.1.1.x86_64",
                  "product_identification_helper": {
                    "cpe": "cpe:2.3:a:amazon:amazon_ssm_agent:3.3.5390.0:*:*:*:*:*:*:*",
                    "purl": "pkg:rpm/suse/amazon-ssm-agent@3.3.5390.0-160000.1.1?arch=x86_64\u0026upstream=amazon-ssm-agent-0:3.3.5390.0-160000.1.1.src.rpm"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "openSUSE Leap 16.0",
                "product": {
                  "name": "openSUSE Leap 16.0",
                  "product_id": "openSUSE Leap 16.0"
                }
              }
            ],
            "category": "product_family",
            "name": "SUSE Linux Enterprise"
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "amazon-ssm-agent-0:3.3.5390.0-160000.1.1.aarch64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:amazon-ssm-agent-0:3.3.5390.0-160000.1.1.aarch64"
        },
        "product_reference": "amazon-ssm-agent-0:3.3.5390.0-160000.1.1.aarch64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "amazon-ssm-agent-0:3.3.5390.0-160000.1.1.x86_64 as component of openSUSE Leap 16.0",
          "product_id": "openSUSE Leap 16.0:amazon-ssm-agent-0:3.3.5390.0-160000.1.1.x86_64"
        },
        "product_reference": "amazon-ssm-agent-0:3.3.5390.0-160000.1.1.x86_64",
        "relates_to_product_reference": "openSUSE Leap 16.0"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-56854",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-56854"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client\u0027s remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:amazon-ssm-agent-0:3.3.5390.0-160000.1.1.aarch64",
          "openSUSE Leap 16.0:amazon-ssm-agent-0:3.3.5390.0-160000.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-56854",
          "url": "https://www.suse.com/security/cve/CVE-2026-56854"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1278446 for CVE-2026-56854",
          "url": "https://bugzilla.suse.com/1278446"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1280553 for CVE-2026-56854",
          "url": "https://bugzilla.suse.com/1280553"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:amazon-ssm-agent-0:3.3.5390.0-160000.1.1.aarch64",
            "openSUSE Leap 16.0:amazon-ssm-agent-0:3.3.5390.0-160000.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:amazon-ssm-agent-0:3.3.5390.0-160000.1.1.aarch64",
            "openSUSE Leap 16.0:amazon-ssm-agent-0:3.3.5390.0-160000.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-20T03:28:14Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-56854"
    },
    {
      "cve": "CVE-2026-56855",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-56855"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection. Now, we handle all RFC 4254 channel messages; global requests are handled explicitly. Then, treat all other messages as a protocol error and tear the connection down instead of buffering and blocking.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:amazon-ssm-agent-0:3.3.5390.0-160000.1.1.aarch64",
          "openSUSE Leap 16.0:amazon-ssm-agent-0:3.3.5390.0-160000.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-56855",
          "url": "https://www.suse.com/security/cve/CVE-2026-56855"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1278446 for CVE-2026-56855",
          "url": "https://bugzilla.suse.com/1278446"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1280553 for CVE-2026-56855",
          "url": "https://bugzilla.suse.com/1280553"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:amazon-ssm-agent-0:3.3.5390.0-160000.1.1.aarch64",
            "openSUSE Leap 16.0:amazon-ssm-agent-0:3.3.5390.0-160000.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:amazon-ssm-agent-0:3.3.5390.0-160000.1.1.aarch64",
            "openSUSE Leap 16.0:amazon-ssm-agent-0:3.3.5390.0-160000.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-20T03:28:14Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-56855"
    },
    {
      "cve": "CVE-2026-71556",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-71556"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, worktree operations (including checkout, status, and add) resolve symbolic links inside the working tree without confining resolution to the worktree boundary, so a maliciously crafted repository containing a symlink can cause go-git to read from or write to files outside the intended working directory when the repository is cloned and its worktree operations are used. Versions 5.19.2 and 6.0.0-alpha.5.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:amazon-ssm-agent-0:3.3.5390.0-160000.1.1.aarch64",
          "openSUSE Leap 16.0:amazon-ssm-agent-0:3.3.5390.0-160000.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-71556",
          "url": "https://www.suse.com/security/cve/CVE-2026-71556"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1276977 for CVE-2026-71556",
          "url": "https://bugzilla.suse.com/1276977"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:amazon-ssm-agent-0:3.3.5390.0-160000.1.1.aarch64",
            "openSUSE Leap 16.0:amazon-ssm-agent-0:3.3.5390.0-160000.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:amazon-ssm-agent-0:3.3.5390.0-160000.1.1.aarch64",
            "openSUSE Leap 16.0:amazon-ssm-agent-0:3.3.5390.0-160000.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-20T03:28:14Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-71556"
    },
    {
      "cve": "CVE-2026-71557",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-71557"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "go-git is an extensible git implementation library written in pure Go. Prior to 5.19.2 and 6.0.0-alpha.5, reference names are not sanitized before being used to construct on-disk paths under the reference storage directory, so a maliciously crafted reference name (for example containing directory-traversal sequences) can cause go-git to write files outside the intended reference storage directory. Versions 5.19.2 and 6.0.0-alpha.5 fix the issue.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:amazon-ssm-agent-0:3.3.5390.0-160000.1.1.aarch64",
          "openSUSE Leap 16.0:amazon-ssm-agent-0:3.3.5390.0-160000.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-71557",
          "url": "https://www.suse.com/security/cve/CVE-2026-71557"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1276986 for CVE-2026-71557",
          "url": "https://bugzilla.suse.com/1276986"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:amazon-ssm-agent-0:3.3.5390.0-160000.1.1.aarch64",
            "openSUSE Leap 16.0:amazon-ssm-agent-0:3.3.5390.0-160000.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:amazon-ssm-agent-0:3.3.5390.0-160000.1.1.aarch64",
            "openSUSE Leap 16.0:amazon-ssm-agent-0:3.3.5390.0-160000.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-20T03:28:14Z",
          "details": "moderate"
        }
      ],
      "title": "CVE-2026-71557"
    },
    {
      "cve": "CVE-2026-78662",
      "ids": [
        {
          "system_name": "SUSE CVE Page",
          "text": "https://www.suse.com/security/cve/CVE-2026-78662"
        }
      ],
      "notes": [
        {
          "category": "general",
          "text": "Previously, a channel registered in the mux\u0027s chanList is not usable until it is established. A malicious peer was able flood the channel\u0027s incomingRequests, deadlocking the entire connection. Now, we add an atomic established state, set when a channel becomes usable. Until such a time, handlePacket drops every packet other than the open confirmation/failure, without blocking and without tearing down the connection.",
          "title": "CVE description"
        }
      ],
      "product_status": {
        "recommended": [
          "openSUSE Leap 16.0:amazon-ssm-agent-0:3.3.5390.0-160000.1.1.aarch64",
          "openSUSE Leap 16.0:amazon-ssm-agent-0:3.3.5390.0-160000.1.1.x86_64"
        ]
      },
      "references": [
        {
          "category": "external",
          "summary": "CVE-2026-78662",
          "url": "https://www.suse.com/security/cve/CVE-2026-78662"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1278446 for CVE-2026-78662",
          "url": "https://bugzilla.suse.com/1278446"
        },
        {
          "category": "external",
          "summary": "SUSE Bug 1280553 for CVE-2026-78662",
          "url": "https://bugzilla.suse.com/1280553"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
          "product_ids": [
            "openSUSE Leap 16.0:amazon-ssm-agent-0:3.3.5390.0-160000.1.1.aarch64",
            "openSUSE Leap 16.0:amazon-ssm-agent-0:3.3.5390.0-160000.1.1.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "openSUSE Leap 16.0:amazon-ssm-agent-0:3.3.5390.0-160000.1.1.aarch64",
            "openSUSE Leap 16.0:amazon-ssm-agent-0:3.3.5390.0-160000.1.1.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "date": "2026-09-20T03:28:14Z",
          "details": "important"
        }
      ],
      "title": "CVE-2026-78662"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.