openSUSE security update: security update for hauler
-------------------------------------------------------------
Announcement ID: openSUSE-SU-2026:21262-1
Rating: important
References:
* bsc#1267150
* bsc#1269433
Cross-References:
* CVE-2026-25680
* CVE-2026-25681
* CVE-2026-27136
* CVE-2026-42502
* CVE-2026-42506
* CVE-2026-48702
CVSS scores:
* CVE-2026-25680 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-25680 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
* CVE-2026-25681 ( SUSE ): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
* CVE-2026-25681 ( SUSE ): 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N
* CVE-2026-27136 ( SUSE ): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
* CVE-2026-27136 ( SUSE ): 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N
* CVE-2026-42502 ( SUSE ): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
* CVE-2026-42502 ( SUSE ): 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N
* CVE-2026-42506 ( SUSE ): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
* CVE-2026-42506 ( SUSE ): 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N
* CVE-2026-48702 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
* CVE-2026-48702 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Affected Products:
openSUSE Leap 16.0
-------------------------------------------------------------
An update that solves 6 vulnerabilities and has 2 bug fixes can now be installed.
Description:
This update for hauler fixes the following issues:
Changes in hauler:
- update to 2.0.1 (bsc#1269433, CVE-2026-48702):
* bump go to 1.26.4 to squash CVE noise
* Full v2 Release notes: https://github.com/hauler-
dev/hauler/releases/tag/v2.0.0
- update to 2.0.0:
* `v2.0.0` is a **major** release. It replaces Hauler's entire
OCI plumbing... the ORAS v1 dependency and the in-house
cosign fork with a native containerd based implementation,
drops the deprecated `v1alpha1` API, and layers on a
meaningful set of new capabilities and reliability fixes on
top of that new foundation.
* **Removed the ORAS v1 dependency** - push/pull is now driven
directly by containerd's docker resolver and `google/go-
containerregistry`, new `pkg/content/registry.go`
(`RegistryTarget`) and `pkg/content/types.go` (`Target`
interface, `IoContentWriter`) replaces what ORAS used to own.
* **Removed the hauler-maintained cosign fork** - `pkg/cosign`
is now a thin verify only wrapper around upstream
`sigstore/cosign/v3`. Images are added through a native
`s.AddImage()` path in `pkg/store`
* **Added OCI 1.1 Referrers support** - signatures,
attestations, and SBOMs are discovered both via the classic
cosign tag convention (`sha256-.sig` / `.att` / `.sbom`) and
the modern Referrers API, then correctly through the OCI
layout
- update x/net to v0.55.0 (bsc#1266602, CVE-2026-39821,
bsc#1267150, CVE-2026-25680, CVE-2026-42502, CVE-2026-27136,
CVE-2026-25681, CVE-2026-42506)
Patch instructions:
To install this openSUSE security update use the suse recommended installation methods
like YaST online_update or "zypper patch".
Alternatively you can run the command listed for your product:
- openSUSE Leap 16.0
zypper in -t patch openSUSE-Leap-16.0-packagehub-391=1
Package List:
- openSUSE Leap 16.0:
hauler-2.0.1-bp160.1.1
References:
* https://www.suse.com/security/cve/CVE-2026-25680.html
* https://www.suse.com/security/cve/CVE-2026-25681.html
* https://www.suse.com/security/cve/CVE-2026-27136.html
* https://www.suse.com/security/cve/CVE-2026-42502.html
* https://www.suse.com/security/cve/CVE-2026-42506.html
* https://www.suse.com/security/cve/CVE-2026-48702.html
lmpx.com only provides a reader for public news (NNTP) servers. It is not
affiliated with the servers or forums shown here and is not responsible for
the content of articles, which is written by their respective authors.