{
   document: {
      aggregate_severity: {
         namespace: "https://www.suse.com/support/security/rating/",
         text: "moderate",
      },
      category: "csaf_security_advisory",
      csaf_version: "2.0",
      distribution: {
         text: "Copyright 2024 SUSE LLC. All rights reserved.",
         tlp: {
            label: "WHITE",
            url: "https://www.first.org/tlp/",
         },
      },
      lang: "en",
      notes: [
         {
            category: "summary",
            text: "Security update for govulncheck-vulndb",
            title: "Title of the patch",
         },
         {
            category: "description",
            text: "This update for govulncheck-vulndb fixes the following issues:\n\n- Update to version 0.0.20250128T150132 2025-01-28T15:01:32Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2025-3409 CVE-2025-23208 GHSA-c9p4-xwr9-rfhx\n  * GO-2025-3410 CVE-2025-24337 GHSA-3qc3-mx6x-267h\n  * GO-2025-3413 CVE-2025-0377 GHSA-wpfp-cm49-9m9q\n  * GO-2025-3414 CVE-2024-11218 GHSA-5vpc-35f4-r8w6\n  * GO-2025-3415 CVE-2025-23028 GHSA-9m5p-c77c-f9j7\n  * GO-2025-3416 CVE-2025-23047 GHSA-h78m-j95m-5356\n  * GO-2025-3418 CVE-2025-24030 GHSA-j777-63hf-hx76\n  * GO-2025-3419 CVE-2025-24355 GHSA-v34r-vj4r-38j6\n  * GO-2025-3422 CVE-2025-24354\n\n- Update to version 0.0.20250128T004730 2025-01-28T00:47:30Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2025-3372 CVE-2024-45339\n  * GO-2025-3373 CVE-2024-45341\n  * GO-2025-3383 CVE-2024-45340\n  * GO-2025-3420 CVE-2024-45336\n  * GO-2025-3421 CVE-2025-22865\n\n- Update to version 0.0.20250117T214834 2025-01-17T21:48:34Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2025-3392 CVE-2025-20086 GHSA-5m7j-6gc4-ff5g\n  * GO-2025-3393 CVE-2025-21088 GHSA-8j3q-gc9x-7972\n  * GO-2025-3394 CVE-2025-20088 GHSA-45v9-w9fh-33j6\n  * GO-2025-3396 CVE-2024-52594\n  * GO-2025-3397 CVE-2024-36402 GHSA-8vmr-h7h5-cqhg\n  * GO-2025-3398 CVE-2024-52791 GHSA-gp86-q8hg-fpxj\n  * GO-2025-3399 CVE-2024-52602 GHSA-r6jg-jfv6-2fjv\n  * GO-2025-3400 CVE-2024-56515 GHSA-rcxc-wjgw-579r\n  * GO-2025-3401 CVE-2024-36403 GHSA-vc2m-hw89-qjxf\n  * GO-2025-3407 CVE-2025-20621 GHSA-w6xh-c82w-h997\n\n- Update to version 0.0.20250115T172141 2025-01-15T17:21:41Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2025-3381 CVE-2024-56138 GHSA-45v3-38pc-874v\n  * GO-2025-3382 CVE-2024-51491 GHSA-qjh3-4j3h-vmwp\n  * GO-2025-3384 CVE-2024-56323 GHSA-32q6-rr98-cjqv\n  * GO-2025-3390 CVE-2024-53263 GHSA-q6r2-x2cc-vrp7\n  * GO-2025-3391 CVE-2024-52281 GHSA-2v2w-8v8c-wcm9\n\n- Update to version 0.0.20250109T194159 2025-01-09T19:41:59Z.\n  Refs jsc#PED-11136\n  Go CVE Numbering Authority IDs added or updated with aliases:\n  * GO-2025-3376 CVE-2025-22149 GHSA-675f-rq2r-jw82\n  * GO-2025-3377 CVE-2025-22449 GHSA-q8fg-cp3q-5jwm\n  * GO-2025-3379 CVE-2025-20033 GHSA-2549-xh72-qrpm\n  * GO-2025-3380 CVE-2025-22445 GHSA-7rgp-4j56-fm79\n",
            title: "Description of the patch",
         },
         {
            category: "details",
            text: "SUSE-2025-297,SUSE-SLE-Module-Packagehub-Subpackages-15-SP6-2025-297,openSUSE-SLE-15.6-2025-297",
            title: "Patchnames",
         },
         {
            category: "legal_disclaimer",
            text: "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
            title: "Terms of use",
         },
      ],
      publisher: {
         category: "vendor",
         contact_details: "https://www.suse.com/support/security/contact/",
         name: "SUSE Product Security Team",
         namespace: "https://www.suse.com/",
      },
      references: [
         {
            category: "external",
            summary: "SUSE ratings",
            url: "https://www.suse.com/support/security/rating/",
         },
         {
            category: "self",
            summary: "URL of this CSAF notice",
            url: "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2025_0297-1.json",
         },
         {
            category: "self",
            summary: "URL for SUSE-SU-2025:0297-1",
            url: "https://www.suse.com/support/update/announcement/2025/suse-su-20250297-1/",
         },
         {
            category: "self",
            summary: "E-Mail link for SUSE-SU-2025:0297-1",
            url: "https://lists.suse.com/pipermail/sle-security-updates/2025-January/020248.html",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2024-11218 page",
            url: "https://www.suse.com/security/cve/CVE-2024-11218/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2024-36402 page",
            url: "https://www.suse.com/security/cve/CVE-2024-36402/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2024-36403 page",
            url: "https://www.suse.com/security/cve/CVE-2024-36403/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2024-45336 page",
            url: "https://www.suse.com/security/cve/CVE-2024-45336/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2024-45339 page",
            url: "https://www.suse.com/security/cve/CVE-2024-45339/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2024-45340 page",
            url: "https://www.suse.com/security/cve/CVE-2024-45340/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2024-45341 page",
            url: "https://www.suse.com/security/cve/CVE-2024-45341/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2024-51491 page",
            url: "https://www.suse.com/security/cve/CVE-2024-51491/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2024-52281 page",
            url: "https://www.suse.com/security/cve/CVE-2024-52281/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2024-52594 page",
            url: "https://www.suse.com/security/cve/CVE-2024-52594/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2024-52602 page",
            url: "https://www.suse.com/security/cve/CVE-2024-52602/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2024-52791 page",
            url: "https://www.suse.com/security/cve/CVE-2024-52791/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2024-53263 page",
            url: "https://www.suse.com/security/cve/CVE-2024-53263/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2024-56138 page",
            url: "https://www.suse.com/security/cve/CVE-2024-56138/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2024-56323 page",
            url: "https://www.suse.com/security/cve/CVE-2024-56323/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2024-56515 page",
            url: "https://www.suse.com/security/cve/CVE-2024-56515/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2025-0377 page",
            url: "https://www.suse.com/security/cve/CVE-2025-0377/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2025-20033 page",
            url: "https://www.suse.com/security/cve/CVE-2025-20033/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2025-20086 page",
            url: "https://www.suse.com/security/cve/CVE-2025-20086/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2025-20088 page",
            url: "https://www.suse.com/security/cve/CVE-2025-20088/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2025-20621 page",
            url: "https://www.suse.com/security/cve/CVE-2025-20621/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2025-21088 page",
            url: "https://www.suse.com/security/cve/CVE-2025-21088/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2025-22149 page",
            url: "https://www.suse.com/security/cve/CVE-2025-22149/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2025-22445 page",
            url: "https://www.suse.com/security/cve/CVE-2025-22445/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2025-22449 page",
            url: "https://www.suse.com/security/cve/CVE-2025-22449/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2025-22865 page",
            url: "https://www.suse.com/security/cve/CVE-2025-22865/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2025-23028 page",
            url: "https://www.suse.com/security/cve/CVE-2025-23028/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2025-23047 page",
            url: "https://www.suse.com/security/cve/CVE-2025-23047/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2025-23208 page",
            url: "https://www.suse.com/security/cve/CVE-2025-23208/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2025-24030 page",
            url: "https://www.suse.com/security/cve/CVE-2025-24030/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2025-24337 page",
            url: "https://www.suse.com/security/cve/CVE-2025-24337/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2025-24354 page",
            url: "https://www.suse.com/security/cve/CVE-2025-24354/",
         },
         {
            category: "self",
            summary: "SUSE CVE CVE-2025-24355 page",
            url: "https://www.suse.com/security/cve/CVE-2025-24355/",
         },
      ],
      title: "Security update for govulncheck-vulndb",
      tracking: {
         current_release_date: "2025-01-30T14:03:37Z",
         generator: {
            date: "2025-01-30T14:03:37Z",
            engine: {
               name: "cve-database.git:bin/generate-csaf.pl",
               version: "1",
            },
         },
         id: "SUSE-SU-2025:0297-1",
         initial_release_date: "2025-01-30T14:03:37Z",
         revision_history: [
            {
               date: "2025-01-30T14:03:37Z",
               number: "1",
               summary: "Current version",
            },
         ],
         status: "final",
         version: "1",
      },
   },
   product_tree: {
      branches: [
         {
            branches: [
               {
                  branches: [
                     {
                        category: "product_version",
                        name: "govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
                        product: {
                           name: "govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
                           product_id: "govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
                        },
                     },
                  ],
                  category: "architecture",
                  name: "noarch",
               },
               {
                  branches: [
                     {
                        category: "product_name",
                        name: "SUSE Linux Enterprise Module for Package Hub 15 SP6",
                        product: {
                           name: "SUSE Linux Enterprise Module for Package Hub 15 SP6",
                           product_id: "SUSE Linux Enterprise Module for Package Hub 15 SP6",
                           product_identification_helper: {
                              cpe: "cpe:/o:suse:packagehub:15:sp6",
                           },
                        },
                     },
                     {
                        category: "product_name",
                        name: "openSUSE Leap 15.6",
                        product: {
                           name: "openSUSE Leap 15.6",
                           product_id: "openSUSE Leap 15.6",
                           product_identification_helper: {
                              cpe: "cpe:/o:opensuse:leap:15.6",
                           },
                        },
                     },
                  ],
                  category: "product_family",
                  name: "SUSE Linux Enterprise",
               },
            ],
            category: "vendor",
            name: "SUSE",
         },
      ],
      relationships: [
         {
            category: "default_component_of",
            full_product_name: {
               name: "govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch as component of SUSE Linux Enterprise Module for Package Hub 15 SP6",
               product_id: "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
            },
            product_reference: "govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
            relates_to_product_reference: "SUSE Linux Enterprise Module for Package Hub 15 SP6",
         },
         {
            category: "default_component_of",
            full_product_name: {
               name: "govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch as component of openSUSE Leap 15.6",
               product_id: "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
            },
            product_reference: "govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
            relates_to_product_reference: "openSUSE Leap 15.6",
         },
      ],
   },
   vulnerabilities: [
      {
         cve: "CVE-2024-11218",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2024-11218",
            },
         ],
         notes: [
            {
               category: "general",
               text: "A vulnerability was found in `podman build` and `buildah.` This issue occurs in a container breakout by using --jobs=2 and a race condition when building a malicious Containerfile. SELinux might mitigate it, but even with SELinux on, it still allows the enumeration of files and directories on the host.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
               "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2024-11218",
               url: "https://www.suse.com/security/cve/CVE-2024-11218",
            },
            {
               category: "external",
               summary: "SUSE Bug 1236269 for CVE-2024-11218",
               url: "https://bugzilla.suse.com/1236269",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
                  "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.7,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
                  "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2025-01-30T14:03:37Z",
               details: "important",
            },
         ],
         title: "CVE-2024-11218",
      },
      {
         cve: "CVE-2024-36402",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2024-36402",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Matrix Media Repo (MMR) is a highly configurable multi-homeserver media repository for Matrix. MMR before version 1.3.5 allows, by design, unauthenticated remote participants to trigger a download and caching of remote media from a remote homeserver to the local media repository. Such content then also becomes available for download from the local homeserver in an unauthenticated way. The implication is that unauthenticated remote adversaries can use this functionality to plant problematic content into the media repository. MMR 1.3.5 introduces a partial mitigation in the form of new endpoints which require authentication for media downloads. The unauthenticated endpoints will be frozen in a future release, closing the attack vector. Though extremely limited, server operators can use more strict rate limits based on IP address as a partial workaround.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
               "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2024-36402",
               url: "https://www.suse.com/security/cve/CVE-2024-36402",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
                  "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2025-01-30T14:03:37Z",
               details: "moderate",
            },
         ],
         title: "CVE-2024-36402",
      },
      {
         cve: "CVE-2024-36403",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2024-36403",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Matrix Media Repo (MMR) is a highly configurable multi-homeserver media repository for Matrix. MMR before version 1.3.5 is vulnerable to unbounded disk consumption, where an unauthenticated adversary can induce it to download and cache large amounts of remote media files. MMR's typical operating environment uses S3-like storage as a backend, with file-backed store as an alternative option. Instances using a file-backed store or those which self-host an S3 storage system are therefore vulnerable to a disk fill attack. Once the disk is full, authenticated users will be unable to upload new media, resulting in denial of service. For instances configured to use a cloud-based S3 storage option, this could result in high service fees instead of a denial of service. MMR 1.3.5 introduces a new default-on \"leaky bucket\" rate limit to reduce the amount of data a user can request at a time. This does not fully address the issue, but does limit an unauthenticated user's ability to request large amounts of data. Operators should note that the leaky bucket implementation introduced in MMR 1.3.5 requires the IP address associated with the request to be forwarded, to avoid mistakenly applying the rate limit to the reverse proxy instead. To avoid this issue, the reverse proxy should populate the X-Forwarded-For header when sending the request to MMR. Operators who cannot update may wish to lower the maximum file size they allow and implement harsh rate limits, though this can still lead to a large amount of data to be downloaded.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
               "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2024-36403",
               url: "https://www.suse.com/security/cve/CVE-2024-36403",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
                  "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2025-01-30T14:03:37Z",
               details: "moderate",
            },
         ],
         title: "CVE-2024-36403",
      },
      {
         cve: "CVE-2024-45336",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2024-45336",
            },
         ],
         notes: [
            {
               category: "general",
               text: "The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header which is redirected to b.com/ will not send that header to b.com. In the event that the client received a subsequent same-domain redirect, however, the sensitive headers would be restored. For example, a chain of redirects from a.com/, to b.com/1, and finally to b.com/2 would incorrectly send the Authorization header to b.com/2.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
               "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2024-45336",
               url: "https://www.suse.com/security/cve/CVE-2024-45336",
            },
            {
               category: "external",
               summary: "SUSE Bug 1236046 for CVE-2024-45336",
               url: "https://bugzilla.suse.com/1236046",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
                  "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 5.9,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
                  "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2025-01-30T14:03:37Z",
               details: "moderate",
            },
         ],
         title: "CVE-2024-45336",
      },
      {
         cve: "CVE-2024-45339",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2024-45339",
            },
         ],
         notes: [
            {
               category: "general",
               text: "When logs are written to a widely-writable directory (the default), an unprivileged attacker may predict a privileged process's log file path and pre-create a symbolic link to a sensitive file in its place. When that privileged process runs, it will follow the planted symlink and overwrite that sensitive file. To fix that, glog now causes the program to exit (with status code 2) when it finds that the configured log file already exists.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
               "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2024-45339",
               url: "https://www.suse.com/security/cve/CVE-2024-45339",
            },
            {
               category: "external",
               summary: "SUSE Bug 1236541 for CVE-2024-45339",
               url: "https://bugzilla.suse.com/1236541",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
                  "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.1,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
                  "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2025-01-30T14:03:37Z",
               details: "important",
            },
         ],
         title: "CVE-2024-45339",
      },
      {
         cve: "CVE-2024-45340",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2024-45340",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Credentials provided via the new GOAUTH feature were not being properly segmented by domain, allowing a malicious server to request credentials they should not have access to. By default, unless otherwise set, this only affected credentials stored in the users .netrc file.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
               "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2024-45340",
               url: "https://www.suse.com/security/cve/CVE-2024-45340",
            },
            {
               category: "external",
               summary: "SUSE Bug 1236360 for CVE-2024-45340",
               url: "https://bugzilla.suse.com/1236360",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
                  "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.7,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
                  "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2025-01-30T14:03:37Z",
               details: "important",
            },
         ],
         title: "CVE-2024-45340",
      },
      {
         cve: "CVE-2024-45341",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2024-45341",
            },
         ],
         notes: [
            {
               category: "general",
               text: "A certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain. Certificates containing URIs are not permitted in the web PKI, so this only affects users of private PKIs which make use of URIs.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
               "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2024-45341",
               url: "https://www.suse.com/security/cve/CVE-2024-45341",
            },
            {
               category: "external",
               summary: "SUSE Bug 1236045 for CVE-2024-45341",
               url: "https://bugzilla.suse.com/1236045",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
                  "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 4.2,
                  baseSeverity: "MEDIUM",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
                  "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2025-01-30T14:03:37Z",
               details: "moderate",
            },
         ],
         title: "CVE-2024-45341",
      },
      {
         cve: "CVE-2024-51491",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2024-51491",
            },
         ],
         notes: [
            {
               category: "general",
               text: "notion-go is a collection of libraries for supporting sign and verify OCI artifacts. Based on Notary Project specifications. The issue was identified during Quarkslab's security audit on the Certificate Revocation List (CRL) based revocation check feature.\nAfter retrieving the CRL, notation-go attempts to update the CRL cache using the os.Rename method. However, this operation may fail due to operating system-specific limitations, particularly when the source and destination paths are on different mount points. This failure could lead to an unexpected program termination. In method `crl.(*FileCache).Set`, a temporary file is created in the OS dedicated area (like /tmp for, usually, Linux/Unix). The file is written and then it is tried to move it to the dedicated `notation` cache directory thanks `os.Rename`. As specified in Go documentation, OS specific restriction may apply. When used with Linux OS, it is relying on rename syscall from the libc and as per the documentation, moving a file to a different mountpoint raises an EXDEV error, interpreted as Cross device link not permitted error. Some Linux distribution, like RedHat use a dedicated filesystem (tmpfs), mounted on a specific mountpoint (usually /tmp) for temporary files. When using such OS, revocation check based on CRL will repeatedly crash notation. As a result the signature verification process is aborted as process crashes. This issue has been addressed in version 1.3.0-rc.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
               "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2024-51491",
               url: "https://www.suse.com/security/cve/CVE-2024-51491",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
                  "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2025-01-30T14:03:37Z",
               details: "low",
            },
         ],
         title: "CVE-2024-51491",
      },
      {
         cve: "CVE-2024-52281",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2024-52281",
            },
         ],
         notes: [
            {
               category: "general",
               text: "** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
               "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2024-52281",
               url: "https://www.suse.com/security/cve/CVE-2024-52281",
            },
            {
               category: "external",
               summary: "SUSE Bug 1233339 for CVE-2024-52281",
               url: "https://bugzilla.suse.com/1233339",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
                  "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2025-01-30T14:03:37Z",
               details: "important",
            },
         ],
         title: "CVE-2024-52281",
      },
      {
         cve: "CVE-2024-52594",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2024-52594",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Gomatrixserverlib is a Go library for matrix federation. Gomatrixserverlib is vulnerable to server-side request forgery, serving content from a private network it can access, under certain conditions. The commit `c4f1e01` fixes this issue. Users are advised to upgrade. Users unable to upgrade should use a local firewall to limit the network segments and hosts the service using gomatrixserverlib can access.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
               "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2024-52594",
               url: "https://www.suse.com/security/cve/CVE-2024-52594",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
                  "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2025-01-30T14:03:37Z",
               details: "moderate",
            },
         ],
         title: "CVE-2024-52594",
      },
      {
         cve: "CVE-2024-52602",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2024-52602",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Matrix Media Repo (MMR) is a highly configurable multi-homeserver media repository for Matrix. Matrix Media Repo (MMR) is vulnerable to server-side request forgery, serving content from a private network it can access, under certain conditions. This is fixed in MMR v1.3.8. Users are advised to upgrade. Restricting which hosts MMR is allowed to contact via (local) firewall rules or a transparent proxy and may provide a workaround for users unable to upgrade.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
               "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2024-52602",
               url: "https://www.suse.com/security/cve/CVE-2024-52602",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
                  "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2025-01-30T14:03:37Z",
               details: "moderate",
            },
         ],
         title: "CVE-2024-52602",
      },
      {
         cve: "CVE-2024-52791",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2024-52791",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Matrix Media Repo (MMR) is a highly configurable multi-homeserver media repository for Matrix. MMR makes requests to other servers as part of normal operation, and these resource owners can return large amounts of JSON back to MMR for parsing. In parsing, MMR can consume large amounts of memory and exhaust available memory. This is fixed in MMR v1.3.8. Users are advised to upgrade. For users unable to upgrade; forward proxies can be configured to block requests to unsafe hosts. Alternatively, MMR processes can be configured with memory limits and auto-restart. Running multiple MMR processes concurrently can help ensure a restart does not overly impact users.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
               "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2024-52791",
               url: "https://www.suse.com/security/cve/CVE-2024-52791",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
                  "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2025-01-30T14:03:37Z",
               details: "moderate",
            },
         ],
         title: "CVE-2024-52791",
      },
      {
         cve: "CVE-2024-53263",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2024-53263",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Git LFS is a Git extension for versioning large files. When Git LFS requests credentials from Git for a remote host, it passes portions of the host's URL to the `git-credential(1)` command without checking for embedded line-ending control characters, and then sends any credentials it receives back from the Git credential helper to the remote host. By inserting URL-encoded control characters such as line feed (LF) or carriage return (CR) characters into the URL, an attacker may be able to retrieve a user's Git credentials. This problem exists in all previous versions and is patched in v3.6.1. All users should upgrade to v3.6.1. There are no workarounds known at this time.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
               "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2024-53263",
               url: "https://www.suse.com/security/cve/CVE-2024-53263",
            },
            {
               category: "external",
               summary: "SUSE Bug 1235876 for CVE-2024-53263",
               url: "https://bugzilla.suse.com/1235876",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
                  "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2025-01-30T14:03:37Z",
               details: "important",
            },
         ],
         title: "CVE-2024-53263",
      },
      {
         cve: "CVE-2024-56138",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2024-56138",
            },
         ],
         notes: [
            {
               category: "general",
               text: "notion-go is a collection of libraries for supporting sign and verify OCI artifacts. Based on Notary Project specifications. This issue was identified during Quarkslab's audit of the timestamp feature. During the timestamp signature generation, the revocation status of the certificate(s) used to generate the timestamp signature was not verified. During timestamp signature generation, notation-go did not check the revocation status of the certificate chain used by the TSA. This oversight creates a vulnerability that could be exploited through a Man-in-The-Middle attack. An attacker could potentially use a compromised, intermediate, or revoked leaf certificate to generate a malicious countersignature, which would then be accepted and stored by `notation`. This could lead to denial of service scenarios, particularly in CI/CD environments during signature verification processes because timestamp signature would fail due to the presence of a revoked certificate(s) potentially disrupting operations. This issue has been addressed in release version 1.3.0-rc.2 and all users are advised to upgrade. There are no known workarounds for this vulnerability.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
               "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2024-56138",
               url: "https://www.suse.com/security/cve/CVE-2024-56138",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
                  "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2025-01-30T14:03:37Z",
               details: "low",
            },
         ],
         title: "CVE-2024-56138",
      },
      {
         cve: "CVE-2024-56323",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2024-56323",
            },
         ],
         notes: [
            {
               category: "general",
               text: "OpenFGA is an authorization/permission engine. IN OpenFGA v1.3.8 to v1.8.2 (Helm chart openfga-0.1.38 to openfga-0.2.19, docker v1.3.8 to v.1.8.2)  are vulnerable to authorization bypass under the following conditions: 1. calling Check API or ListObjects with a model that uses [conditions](https://openfga.dev/docs/modeling/conditions), and 2. calling Check API or ListObjects API with [contextual tuples](https://openfga.dev/docs/concepts#what-are-contextual-tuples) that include conditions and 3. OpenFGA is configured with caching enabled (`OPENFGA_CHECK_QUERY_CACHE_ENABLED`). Users are advised to upgrade to v1.8.3. There are no known workarounds for this vulnerability.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
               "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2024-56323",
               url: "https://www.suse.com/security/cve/CVE-2024-56323",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
                  "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2025-01-30T14:03:37Z",
               details: "moderate",
            },
         ],
         title: "CVE-2024-56323",
      },
      {
         cve: "CVE-2024-56515",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2024-56515",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Matrix Media Repo (MMR) is a highly configurable multi-homeserver media repository for Matrix. If SVG or JPEGXL thumbnailers are enabled (they are disabled by default), a user may upload a file which claims to be either of these types and request a thumbnail to invoke a different decoder in ImageMagick. In some ImageMagick installations, this includes the capability to run Ghostscript to decode the image/file. If MP4 thumbnailers are enabled (also disabled by default), the same issue as above may occur with the ffmpeg installation instead. MMR uses a number of other decoders for all other file types when preparing thumbnails. Theoretical issues are possible with these decoders, however in testing they were not possible to exploit. This is fixed in MMR v1.3.8. MMR now inspects the mimetype of media prior to thumbnailing, and picks a thumbnailer based on those results instead of relying on user-supplied values. This may lead to fewer thumbnails when obscure file shapes are used. This also helps narrow scope of theoretical issues with all decoders MMR uses for thumbnails. Users are advised to upgrade. Users unable to upgrade may disable the SVG, JPEGXL, and MP4 thumbnail types in the MMR config which prevents the decoders from being invoked. Further disabling uncommon file types on the server is recommended to limit risk surface. Containers and other similar technologies may also be used to limit the impact of vulnerabilities in external decoders, like ImageMagick and ffmpeg. Some installations of ImageMagick may disable \"unsafe\" file types, like PDFs, already. This option can be replicated to other environments as needed. ffmpeg may be compiled with limited decoders/codecs. The Docker image for MMR disables PDFs and similar formats by default.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
               "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2024-56515",
               url: "https://www.suse.com/security/cve/CVE-2024-56515",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
                  "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2025-01-30T14:03:37Z",
               details: "moderate",
            },
         ],
         title: "CVE-2024-56515",
      },
      {
         cve: "CVE-2025-0377",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2025-0377",
            },
         ],
         notes: [
            {
               category: "general",
               text: "HashiCorp's go-slug library is vulnerable to a zip-slip style attack when a non-existing user-provided path is extracted from the tar entry.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
               "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2025-0377",
               url: "https://www.suse.com/security/cve/CVE-2025-0377",
            },
            {
               category: "external",
               summary: "SUSE Bug 1236209 for CVE-2025-0377",
               url: "https://bugzilla.suse.com/1236209",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
                  "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2025-01-30T14:03:37Z",
               details: "important",
            },
         ],
         title: "CVE-2025-0377",
      },
      {
         cve: "CVE-2025-20033",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2025-20033",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Mattermost versions 10.2.0, 9.11.x <= 9.11.5, 10.0.x <= 10.0.3, 10.1.x <= 10.1.3 fail to properly validate post types, which allows attackers to deny service to users with the sysconsole_read_plugins permission via creating a post with the custom_pl_notification type and specific props.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
               "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2025-20033",
               url: "https://www.suse.com/security/cve/CVE-2025-20033",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
                  "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2025-01-30T14:03:37Z",
               details: "moderate",
            },
         ],
         title: "CVE-2025-20033",
      },
      {
         cve: "CVE-2025-20086",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2025-20086",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Mattermost versions 10.2.x <= 10.2.0, 9.11.x <= 9.11.5, 10.0.x <= 10.0.3, 10.1.x <= 10.1.3 fail to properly validate post props which allows a malicious authenticated user to cause a crash via a malicious post.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
               "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2025-20086",
               url: "https://www.suse.com/security/cve/CVE-2025-20086",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
                  "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2025-01-30T14:03:37Z",
               details: "moderate",
            },
         ],
         title: "CVE-2025-20086",
      },
      {
         cve: "CVE-2025-20088",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2025-20088",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Mattermost versions 10.2.x <= 10.2.0, 9.11.x <= 9.11.5, 10.0.x <= 10.0.3, 10.1.x <= 10.1.3 fail to properly validate post props which allows a malicious authenticated user to cause a crash via a malicious post.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
               "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2025-20088",
               url: "https://www.suse.com/security/cve/CVE-2025-20088",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
                  "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2025-01-30T14:03:37Z",
               details: "moderate",
            },
         ],
         title: "CVE-2025-20088",
      },
      {
         cve: "CVE-2025-20621",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2025-20621",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Mattermost versions 10.2.x <= 10.2.0, 9.11.x <= 9.11.5, 10.0.x <= 10.0.3, 10.1.x <= 10.1.3 fail to properly handle posts with attachments containing fields that cannot be cast to a String, which allows an attacker to cause the webapp to crash via creating and sending such a post to a channel.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
               "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2025-20621",
               url: "https://www.suse.com/security/cve/CVE-2025-20621",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
                  "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2025-01-30T14:03:37Z",
               details: "moderate",
            },
         ],
         title: "CVE-2025-20621",
      },
      {
         cve: "CVE-2025-21088",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2025-21088",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Mattermost versions 10.2.x <= 10.2.0, 9.11.x <= 9.11.5, 10.0.x <= 10.0.3, 10.1.x <= 10.1.3 fail to properly validate the style of proto supplied to an action's style in post.props.attachments, which allows an attacker to crash the frontend via crafted malicious input.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
               "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2025-21088",
               url: "https://www.suse.com/security/cve/CVE-2025-21088",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
                  "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2025-01-30T14:03:37Z",
               details: "moderate",
            },
         ],
         title: "CVE-2025-21088",
      },
      {
         cve: "CVE-2025-22149",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2025-22149",
            },
         ],
         notes: [
            {
               category: "general",
               text: "JWK Set (JSON Web Key Set) is a JWK and JWK Set Go implementation. Prior to 0.6.0, the project's provided HTTP client's local JWK Set cache should do a full replacement when the goroutine refreshes the remote JWK Set. The current behavior is to overwrite or append. This is a security issue for use cases that utilize the provided auto-caching HTTP client and where key removal from a JWK Set is equivalent to revocation. The affected auto-caching HTTP client was added in version v0.5.0 and fixed in v0.6.0. The only workaround would be to remove the provided auto-caching HTTP client and replace it with a custom implementation. This involves setting the HTTPClientStorageOptions.RefreshInterval to zero (or not specifying the value).",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
               "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2025-22149",
               url: "https://www.suse.com/security/cve/CVE-2025-22149",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
                  "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2025-01-30T14:03:37Z",
               details: "low",
            },
         ],
         title: "CVE-2025-22149",
      },
      {
         cve: "CVE-2025-22445",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2025-22445",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Mattermost versions 10.x <= 10.2 fail to accurately reflect missing settings, which allows confusion for admins regarding a Calls security-sensitive configuration via incorrect UI reporting.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
               "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2025-22445",
               url: "https://www.suse.com/security/cve/CVE-2025-22445",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
                  "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2025-01-30T14:03:37Z",
               details: "low",
            },
         ],
         title: "CVE-2025-22445",
      },
      {
         cve: "CVE-2025-22449",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2025-22449",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Mattermost versions 9.11.x <= 9.11.5 fail to enforce invite permissions, which allows team admins, with no permission to invite users to their team, to invite users by updating the \"allow_open_invite\" field via making their team public.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
               "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2025-22449",
               url: "https://www.suse.com/security/cve/CVE-2025-22449",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
                  "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2025-01-30T14:03:37Z",
               details: "low",
            },
         ],
         title: "CVE-2025-22449",
      },
      {
         cve: "CVE-2025-22865",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2025-22865",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Using ParsePKCS1PrivateKey to parse a RSA key that is missing the CRT values would panic when verifying that the key is well formed.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
               "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2025-22865",
               url: "https://www.suse.com/security/cve/CVE-2025-22865",
            },
            {
               category: "external",
               summary: "SUSE Bug 1236361 for CVE-2025-22865",
               url: "https://bugzilla.suse.com/1236361",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
                  "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
               ],
            },
         ],
         scores: [
            {
               cvss_v3: {
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  vectorString: "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
                  version: "3.1",
               },
               products: [
                  "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
                  "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2025-01-30T14:03:37Z",
               details: "important",
            },
         ],
         title: "CVE-2025-22865",
      },
      {
         cve: "CVE-2025-23028",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2025-23028",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Cilium is a networking, observability, and security solution with an eBPF-based dataplane. A denial of service vulnerability affects versions 1.14.0 through 1.14.7, 1.15.0 through 1.15.11, and 1.16.0 through 1.16.4. In a Kubernetes cluster where Cilium is configured to proxy DNS traffic, an attacker can crash Cilium agents by sending a crafted DNS response to workloads from outside the cluster. For traffic that is allowed but without using DNS-based policy, the dataplane will continue to pass traffic as configured at the time of the DoS. For workloads that have DNS-based policy configured, existing connections may continue to operate, and new connections made without relying on DNS resolution may continue to be established, but new connections which rely on DNS resolution may be disrupted. Any configuration changes that affect the impacted agent may not be applied until the agent is able to restart. This issue is fixed in Cilium v1.14.18, v1.15.12, and v1.16.5. No known workarounds are available.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
               "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2025-23028",
               url: "https://www.suse.com/security/cve/CVE-2025-23028",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
                  "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2025-01-30T14:03:37Z",
               details: "moderate",
            },
         ],
         title: "CVE-2025-23028",
      },
      {
         cve: "CVE-2025-23047",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2025-23047",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Cilium is a networking, observability, and security solution with an eBPF-based dataplane. An insecure default `Access-Control-Allow-Origin` header value could lead to sensitive data exposure for users of Cilium versions 1.14.0 through 1.14.7, 1.15.0 through 1.15.11, and 1.16.0 through 1.16.4 who deploy Hubble UI using either Cilium CLI or via the Cilium Helm chart. A user with access to a Hubble UI instance affected by this issue could leak configuration details about the Kubernetes cluster which Hubble UI is monitoring, including node names, IP addresses, and other metadata about workloads and the cluster networking configuration. In order for this vulnerability to be exploited, a victim would have to first visit a malicious page. This issue is fixed in Cilium v1.14.18, v1.15.12, and v1.16.5. As a workaround, users who deploy Hubble UI using the Cilium Helm chart directly can remove the CORS headers from the Helm template as shown in the patch from commit a3489f190ba6e87b5336ee685fb6c80b1270d06d.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
               "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2025-23047",
               url: "https://www.suse.com/security/cve/CVE-2025-23047",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
                  "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2025-01-30T14:03:37Z",
               details: "moderate",
            },
         ],
         title: "CVE-2025-23047",
      },
      {
         cve: "CVE-2025-23208",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2025-23208",
            },
         ],
         notes: [
            {
               category: "general",
               text: "zot is a production-ready vendor-neutral OCI image registry. The group data stored for users in the boltdb database (meta.db) is an append-list so group revocations/removals are ignored in the API. SetUserGroups is alled on login, but instead of replacing the group memberships, they are appended. This may be due to some conflict with the group definitions in the config file, but that wasn't obvious to me if it were the case. Any Zot configuration that relies on group-based authorization will not respect group remove/revocation by an IdP. This issue has been addressed in version 2.1.2. All users are advised to upgrade. There are no known workarounds for this vulnerability.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
               "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2025-23208",
               url: "https://www.suse.com/security/cve/CVE-2025-23208",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
                  "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2025-01-30T14:03:37Z",
               details: "important",
            },
         ],
         title: "CVE-2025-23208",
      },
      {
         cve: "CVE-2025-24030",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2025-24030",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. A user with access to the Kubernetes cluster can use a path traversal attack to execute Envoy Admin interface commands on proxies managed by any version of Envoy Gateway prior to 1.2.6. The admin interface can be used to terminate the Envoy process and extract the Envoy configuration (possibly containing confidential data). Version 1.2.6 fixes the issue. As a workaround, the `EnvoyProxy` API can be used to apply a bootstrap config patch that restricts access strictly to the prometheus stats endpoint. Find below an example of such a bootstrap patch.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
               "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2025-24030",
               url: "https://www.suse.com/security/cve/CVE-2025-24030",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
                  "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2025-01-30T14:03:37Z",
               details: "important",
            },
         ],
         title: "CVE-2025-24030",
      },
      {
         cve: "CVE-2025-24337",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2025-24337",
            },
         ],
         notes: [
            {
               category: "general",
               text: "WriteFreely through 0.15.1, when MySQL is used, allows local users to discover credentials by reading config.ini.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
               "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2025-24337",
               url: "https://www.suse.com/security/cve/CVE-2025-24337",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
                  "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2025-01-30T14:03:37Z",
               details: "important",
            },
         ],
         title: "CVE-2025-24337",
      },
      {
         cve: "CVE-2025-24354",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2025-24354",
            },
         ],
         notes: [
            {
               category: "general",
               text: "imgproxy is server for resizing, processing, and converting images. Imgproxy does not block the 0.0.0.0 address, even with IMGPROXY_ALLOW_LOOPBACK_SOURCE_ADDRESSES set to false. This can expose services on the local host. This vulnerability is fixed in 3.27.2.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
               "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2025-24354",
               url: "https://www.suse.com/security/cve/CVE-2025-24354",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
                  "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2025-01-30T14:03:37Z",
               details: "moderate",
            },
         ],
         title: "CVE-2025-24354",
      },
      {
         cve: "CVE-2025-24355",
         ids: [
            {
               system_name: "SUSE CVE Page",
               text: "https://www.suse.com/security/cve/CVE-2025-24355",
            },
         ],
         notes: [
            {
               category: "general",
               text: "Updatecli is a tool used to apply file update strategies. Prior to version 0.93.0, private maven repository credentials may be leaked in application logs in case of unsuccessful retrieval operation. During the execution of an updatecli pipeline which contains a `maven` source configured with basic auth credentials, the credentials are being leaked in the application execution logs in case of failure. Credentials are properly sanitized when the operation is successful but not when for whatever reason there is a failure in the maven repository, e.g. wrong coordinates provided, not existing artifact or version. Version 0.93.0 contains a patch for the issue.",
               title: "CVE description",
            },
         ],
         product_status: {
            recommended: [
               "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
               "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
            ],
         },
         references: [
            {
               category: "external",
               summary: "CVE-2025-24355",
               url: "https://www.suse.com/security/cve/CVE-2025-24355",
            },
            {
               category: "external",
               summary: "SUSE Bug 1236404 for CVE-2025-24355",
               url: "https://bugzilla.suse.com/1236404",
            },
         ],
         remediations: [
            {
               category: "vendor_fix",
               details: "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
               product_ids: [
                  "SUSE Linux Enterprise Module for Package Hub 15 SP6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
                  "openSUSE Leap 15.6:govulncheck-vulndb-0.0.20250128T150132-150000.1.29.1.noarch",
               ],
            },
         ],
         threats: [
            {
               category: "impact",
               date: "2025-01-30T14:03:37Z",
               details: "important",
            },
         ],
         title: "CVE-2025-24355",
      },
   ],
}