SUSE-SU-2025:20328-1

See a problem?
Please try reporting it to the source first.

Source

https://www.suse.com/support/update/announcement/2025/suse-su-202520328-1/

Import Source

https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2025:20328-1.json

JSON Data

https://api.test.osv.dev/v1/vulns/SUSE-SU-2025:20328-1

Upstream

CVE (2)

Related

CVE (2)

Published

2025-05-15T17:45:43Z

Modified

2026-03-11T07:29:43Z

Summary

Security update for elemental-operator

Details

This update for elemental-operator fixes the following issues:

Updated to v1.7.2:
- Updated header year
- CVE-2025-22870: golang.org/x/net/proxy: Fixed proxy bypass using IPv6 zone IDs (bsc#1238700)
- CVE-2025-22869: golang.org/x/crypto/ssh: Fixed Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (bsc#1239335)
- Label Templates: add IP addresses to the Network variables (#885, #894)
- Fixed generation of already present resources (#892, #893)

References

Affected packages

SUSE:Linux Micro 6.1 / elemental-operator

Package

Name: elemental-operator
Purl: pkg:rpm/suse/elemental-operator&distro=SUSE%20Linux%20Micro%206.1

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.7.2-slfo.1.1_1.1

Ecosystem specific

{
    "binaries": [
        {
            "elemental-register": "1.7.2-slfo.1.1_1.1",
            "elemental-support": "1.7.2-slfo.1.1_1.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2025:20328-1.json"