openSUSE-SU-2026:0243-1: important: Security update for afterburn

   openSUSE Security Update: Security update for afterburn
______________________________________________________________________________

Announcement ID:    openSUSE-SU-2026:0243-1
Rating:             important
References:         #1196972 #1242665 #1243850 #1244199 #1270175 
                    #1270483 #1270555 #1270651 #1270787 #1270817 
                    #1270886 #1270949 
Cross-References:   CVE-2022-24713 CVE-2024-12224 CVE-2025-3416
                    CVE-2025-5791 CVE-2026-25541 CVE-2026-41676
                    CVE-2026-41677 CVE-2026-41678 CVE-2026-41681
                    CVE-2026-41898 CVE-2026-42327 CVE-2026-44662
                    CVE-2026-45784
CVSS scores:
                    CVE-2022-24713 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
                    CVE-2024-12224 (SUSE): 2.1 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
                    CVE-2025-3416 (SUSE): 6.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
                    CVE-2025-5791 (SUSE): 8.4 CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
                    CVE-2026-25541 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
                    CVE-2026-41676 (SUSE): 8.3 CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
                    CVE-2026-41677 (SUSE): 1.7 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:U
                    CVE-2026-41678 (SUSE): 8.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
                    CVE-2026-41681 (SUSE): 8.2 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
                    CVE-2026-41898 (SUSE): 8.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N
                    CVE-2026-42327 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
                    CVE-2026-44662 (SUSE): 5.1 CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
                    CVE-2026-45784 (SUSE): 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Affected Products:
                    openSUSE Backports SLE-15-SP7
______________________________________________________________________________

   An update that fixes 13 vulnerabilities is now available.

Description:

   This update for afterburn fixes the following issues:

   - Update to version 5.10.0.git73.b97f772:
     * build(deps): bump anyhow from 1.0.99 to 1.0.103
       https://github.com/coreos/afterburn/pull/1284
     * build(deps): bump libflate from 2.1.0 to 2.2.2
       https://github.com/coreos/afterburn/pull/1283
     * build(deps): bump openssl from 0.10.79 to 0.10.80 not vulnerable but
       patches CVE-2026-45784 AKA boo#1270949
       https://github.com/coreos/afterburn/pull/1277

   - Update to version 5.10.0.git70.9cc2a7b:
     * build(deps): bump openssl from 0.10.78 to 0.10.79 fixes CVE-2026-42327
       AKA boo#1270483 , CVE-2026-44662 AKA boo#1270886
     * providers/hetzner: Add the HETZNER_PUBLIC_IPV6 attribute
     * providers/hetzner: Add support for network configuration
     * build(deps): bump rustls-webpki from 0.103.10 to 0.103.13 fixes
       GHSA-82j2-j2ch-gfr8 , GHSA-965h-392x-2mh5 , GHSA-xgp8-3hg3-c2mh
     * build(deps): bump openssl from 0.10.73 to 0.10.78 fixes CVE-2026-41898
       AKA boo#1270817 , CVE-2026-41681 AKA boo#1270787 , CVE-2026-41676 AKA
       boo#1270175 , CVE-2026-41678 AKA boo#1270651 , CVE-2026-41677 AKA
       boo#1270555
     * docs: Add AGENTS.md and CLAUDE.md for AI coding assistants
     * build(deps): bump rand from 0.9.2 to 0.9.4 not vulnerable but patches
       RUSTSEC-2026-0097 AKA GHSA-cq8v-f236-94qc
     * opencode: add skills for provider scaffolding and release automation
     * ibmcloud-classic: Add missing network_id to fixture
     * kubevirt: Support static gateway and DNS with DHCP
     * build(deps): bump rustls-webpki from 0.103.6 to 0.103.10 fixes
       GHSA-pwjx-qhcg-rvj4
     * fix(proxmoxve): Define DNS entries for every interface
     * Makefile: download `90-afterburn-authorized-keys-file.conf` for rpm
       building
     * Sync repo templates
     * build(deps): bump bytes from 1.10.1 to 1.11.1 fixes CVE-2026-25541
     * util/dhcp: Fix clippy lints
     * build(deps): bump actions/checkout from 4 to 6
     * build(deps): bump actions/upload-artifact from 4 to 5
     * kubevirt: modprobe for virtio_blk; remove dracut preload
     * kubevirt: Add NoCloud network configuration support
     * kubevirt: Support config drive network data
     * kubevirt: Refactor the provider to follow the proxmoxve structure
     * dracut: Add virtio_blk module preload to afterburn-network-kargs
       service
     * docs: Add release notes
     * cargo: Afterburn release 5.10.0

   - Update to version 5.10.0:
     * cargo: Afterburn release 5.10.0
     * docs/release-notes: update for release 5.10.0
     * cargo: update dependencies
     * microsoft/azure: Add XML attribute alias for serde-xml-rs Fedora compat
     * docs/release-notes: Add entry for Azure SharedConfig XML parsing fix
     * microsoft/azure: Fix SharedConfig parsing of XML attributes
     * microsoft/azure: Mock goalstate.SharedConfig output in tests
     * providers/azure: switch SSH key retrieval from certs endpoint to IMDS
     * build(deps): bump the build group with 8 updates
     * build(deps): bump slab from 0.4.10 to 0.4.11
     * build(deps): bump actions/checkout from 4 to 5
     * upcloud: implement UpCloud provider
     * build(deps): bump the build group with 4 updates
     * Sync repo templates


Patch Instructions:

   To install this openSUSE Security Update use the SUSE recommended installation methods
   like YaST online_update or "zypper patch".

   Alternatively you can run the command listed for your product:

   - openSUSE Backports SLE-15-SP7:

      zypper in -t patch openSUSE-2026-243=1



Package List:

   - openSUSE Backports SLE-15-SP7 (aarch64 i586 ppc64le s390x x86_64):

      afterburn-5.10.0.git73.b97f772-bp157.2.9.1

   - openSUSE Backports SLE-15-SP7 (noarch):

      afterburn-dracut-5.10.0.git73.b97f772-bp157.2.9.1


References:

   https://www.suse.com/security/cve/CVE-2022-24713.html
   https://www.suse.com/security/cve/CVE-2024-12224.html
   https://www.suse.com/security/cve/CVE-2025-3416.html
   https://www.suse.com/security/cve/CVE-2025-5791.html
   https://www.suse.com/security/cve/CVE-2026-25541.html
   https://www.suse.com/security/cve/CVE-2026-41676.html
   https://www.suse.com/security/cve/CVE-2026-41677.html
   https://www.suse.com/security/cve/CVE-2026-41678.html
   https://www.suse.com/security/cve/CVE-2026-41681.html
   https://www.suse.com/security/cve/CVE-2026-41898.html
   https://www.suse.com/security/cve/CVE-2026-42327.html
   https://www.suse.com/security/cve/CVE-2026-44662.html
   https://www.suse.com/security/cve/CVE-2026-45784.html
   https://bugzilla.suse.com/1196972
   https://bugzilla.suse.com/1242665
   https://bugzilla.suse.com/1243850
   https://bugzilla.suse.com/1244199
   https://bugzilla.suse.com/1270175
   https://bugzilla.suse.com/1270483
   https://bugzilla.suse.com/1270555
   https://bugzilla.suse.com/1270651
   https://bugzilla.suse.com/1270787
   https://bugzilla.suse.com/1270817
   https://bugzilla.suse.com/1270886
   https://bugzilla.suse.com/1270949