SUSE-SU-2026:2832-1: important: Security update for rustup

OPENSUSE-SECURITY-UPDATES <[email protected]>
Newsgroups gmane.linux.suse.security.announce
Message-ID <178367228418.944.12706276665900081890@530c474df1e7> 
# Security update for rustup

Announcement ID: SUSE-SU-2026:2832-1  
Release Date: 2026-07-09T19:02:15Z  
Rating: important  
References:

  * bsc#1203257
  * bsc#1230032
  * bsc#1243862
  * bsc#1249008
  * bsc#1270186
  * bsc#1270521
  * bsc#1270619
  * bsc#1270644
  * bsc#1270795
  * bsc#1270870
  * bsc#1270874
  * bsc#1270989

  
Cross-References:

  * CVE-2024-12224
  * CVE-2025-58160
  * CVE-2026-41676
  * CVE-2026-41677
  * CVE-2026-41678
  * CVE-2026-41681
  * CVE-2026-41898
  * CVE-2026-42327
  * CVE-2026-44662
  * CVE-2026-45784

  
CVSS scores:

  * CVE-2024-12224 ( SUSE ):  2.1
    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
  * CVE-2024-12224 ( SUSE ):  4.2 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
  * CVE-2024-12224 ( NVD ):  5.1
    CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  * CVE-2025-58160 ( SUSE ):  2.3
    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
  * CVE-2025-58160 ( SUSE ):  3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
  * CVE-2025-58160 ( NVD ):  2.3
    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  * CVE-2026-41676 ( SUSE ):  8.3
    CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
  * CVE-2026-41676 ( SUSE ):  6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
  * CVE-2026-41676 ( NVD ):  7.2
    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  * CVE-2026-41676 ( NVD ):  9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  * CVE-2026-41677 ( SUSE ):  1.7
    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:U
  * CVE-2026-41677 ( SUSE ):  3.7 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
  * CVE-2026-41677 ( NVD ):  1.7
    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  * CVE-2026-41677 ( NVD ):  9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
  * CVE-2026-41678 ( SUSE ):  8.3
    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
  * CVE-2026-41678 ( SUSE ):  7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
  * CVE-2026-41678 ( NVD ):  7.2
    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  * CVE-2026-41678 ( NVD ):  9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  * CVE-2026-41681 ( SUSE ):  8.2
    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
  * CVE-2026-41681 ( SUSE ):  5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
  * CVE-2026-41681 ( NVD ):  8.1
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  * CVE-2026-41681 ( NVD ):  9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  * CVE-2026-41898 ( SUSE ):  8.3
    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N
  * CVE-2026-41898 ( SUSE ):  6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L
  * CVE-2026-41898 ( NVD ):  8.3
    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  * CVE-2026-41898 ( NVD ):  9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  * CVE-2026-42327 ( SUSE ):  8.7
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
  * CVE-2026-42327 ( SUSE ):  7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
  * CVE-2026-42327 ( NVD ):  8.7
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  * CVE-2026-44662 ( SUSE ):  5.1
    CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
  * CVE-2026-44662 ( SUSE ):  4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
  * CVE-2026-44662 ( NVD ):  5.1
    CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  * CVE-2026-45784 ( SUSE ):  5.1
    CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
  * CVE-2026-45784 ( SUSE ):  6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

  
Affected Products:

  * Development Tools Module 15-SP7
  * openSUSE Leap 15.6
  * SUSE Linux Enterprise Desktop 15 SP7
  * SUSE Linux Enterprise Real Time 15 SP7
  * SUSE Linux Enterprise Server 15 SP6
  * SUSE Linux Enterprise Server 15 SP6 LTSS
  * SUSE Linux Enterprise Server 15 SP7
  * SUSE Linux Enterprise Server for SAP Applications 15 SP6
  * SUSE Linux Enterprise Server for SAP Applications 15 SP7

  
  
An update that solves 10 vulnerabilities and has two security fixes can now be
installed.

## Description:

This update for rustup fixes the following issues

Security issues:

  * CVE-2024-12224: idna: idna accepts Punycode labels that do not produce any
    non-ASCII when decoded (bsc#1243862).
  * CVE-2025-58160: tracing-subscriber: Tracing log pollution (bsc#1249008).
  * CVE-2026-41676: openssl: `Deriver:derive` and `PkeyCtxRef:derive` can
    overflow short buffers on OpenSSL 1.1.1 (bsc#1270186).
  * CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when
    returning an oversized length in rust- openssl crate (bsc#1270619).
  * CVE-2026-41678: openssl: incorrect bounds assertion in aes key wrap in rust-
    openssl crate (bsc#1270644).
  * CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer
    with no length check in rust-openssl crate (bsc#1270795).
  * CVE-2026-41898: openssl: unchecked callback-returned length in PSK and
    cookie generate trampolines can leak adjacent memory in rust-openssl crate
    (bsc#1270870).
  * CVE-2026-42327: openssl: arbitrary code execution via specially crafted
    certificate in rust-openssl crate (bsc#1270521).
  * CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-
    wrap-with-padding in rust-openssl crate (bsc#1270874).
  * CVE-2026-45784: openssl: out-of-bounds write in
    `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers in rust-
    openssl crate (bsc#1270989).
  * rust-shlex: Multiple issues involving quote API ( RUSTSEC-2024-0006,
    GHSA-r7qv-8r2h-pg27) (bsc#1230032).

Non security issue:

  * devel:languages:rust/rustup: Missing symlink for rust-analyzer
    (bsc#1203257).

## Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".  
Alternatively you can run the command listed for your product:

  * SUSE Linux Enterprise Server for SAP Applications 15 SP6  
    zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP6-2026-2832=1

  * openSUSE Leap 15.6  
    zypper in -t patch SUSE-2026-2832=1

  * SUSE Linux Enterprise Server 15 SP6 LTSS  
    zypper in -t patch SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-2832=1

  * Development Tools Module 15-SP7  
    zypper in -t patch SUSE-SLE-Module-Development-Tools-15-SP7-2026-2832=1

## Package List:

  * SUSE Linux Enterprise Server 15 SP6 LTSS (aarch64 x86_64)
    * rustup-1.28.2~0-150600.10.13.1
    * rustup-debuginfo-1.28.2~0-150600.10.13.1
  * Development Tools Module 15-SP7 (aarch64 x86_64)
    * rustup-1.28.2~0-150600.10.13.1
    * rustup-debuginfo-1.28.2~0-150600.10.13.1
  * openSUSE Leap 15.6 (aarch64 x86_64)
    * rustup-1.28.2~0-150600.10.13.1
    * rustup-debugsource-1.28.2~0-150600.10.13.1
    * rustup-debuginfo-1.28.2~0-150600.10.13.1
  * SUSE Linux Enterprise Server for SAP Applications 15 SP6 (x86_64)
    * rustup-1.28.2~0-150600.10.13.1
    * rustup-debuginfo-1.28.2~0-150600.10.13.1

## References:

  * https://www.suse.com/security/cve/CVE-2024-12224.html
  * https://www.suse.com/security/cve/CVE-2025-58160.html
  * https://www.suse.com/security/cve/CVE-2026-41676.html
  * https://www.suse.com/security/cve/CVE-2026-41677.html
  * https://www.suse.com/security/cve/CVE-2026-41678.html
  * https://www.suse.com/security/cve/CVE-2026-41681.html
  * https://www.suse.com/security/cve/CVE-2026-41898.html
  * https://www.suse.com/security/cve/CVE-2026-42327.html
  * https://www.suse.com/security/cve/CVE-2026-44662.html
  * https://www.suse.com/security/cve/CVE-2026-45784.html
  * https://bugzilla.suse.com/show_bug.cgi?id=1203257
  * https://bugzilla.suse.com/show_bug.cgi?id=1230032
  * https://bugzilla.suse.com/show_bug.cgi?id=1243862
  * https://bugzilla.suse.com/show_bug.cgi?id=1249008
  * https://bugzilla.suse.com/show_bug.cgi?id=1270186
  * https://bugzilla.suse.com/show_bug.cgi?id=1270521
  * https://bugzilla.suse.com/show_bug.cgi?id=1270619
  * https://bugzilla.suse.com/show_bug.cgi?id=1270644
  * https://bugzilla.suse.com/show_bug.cgi?id=1270795
  * https://bugzilla.suse.com/show_bug.cgi?id=1270870
  * https://bugzilla.suse.com/show_bug.cgi?id=1270874
  * https://bugzilla.suse.com/show_bug.cgi?id=1270989
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.