SUSE-SU-2026:2493-1

See a problem?
Please try reporting it to the source first.

Source

Import Source

JSON Data

https://api.test.osv.dev/v1/vulns/SUSE-SU-2026:2493-1

Upstream

CVE (12)

Related

CVE (12)

Published

2026-06-22T15:34:20Z

Modified

2026-06-24T09:00:05Z

Summary

Security update for containerized-data-importer

Details

This update for containerized-data-importer fixes the following issues:

Security: re-vendor Go dependencies to address CVEs tracked against containerized-data-importer (backport of upstream PR #4110, post-v1.65.0). Fixed by this update:
- google.golang.org/grpc 1.65.0 -> 1.79.3: bsc#1260295 (CVE-2026-33186)
- golang.org/x/net 0.33.0 -> 0.48.0: bsc#1238699 (CVE-2025-22870), bsc#1241838 (CVE-2025-22872), bsc#1251495 (CVE-2025-47911), bsc#1251689 (CVE-2025-58190)
- golang.org/x/crypto 0.31.0 -> 0.46.0: CVE-2025-22869, CVE-2025-47913, CVE-2025-47914, CVE-2025-58181 (no separate CDI bug filed)
- go.opentelemetry.io/otel 1.28.0 -> 1.41.0: CVE-2026-29181 (otel is pulled in transitively at 1.39.0 by the grpc bump; pinned to 1.41.0 so the update does not introduce it)
Record CVEs already fixed by the x/net release vendored in 1.64.0 (x/net 0.33.0), not previously noted in the changelog: bsc#1236523 (CVE-2023-45288), bsc#1230323 (CVE-2023-39325)

References

Affected packages

Name: containerized-data-importer
Purl: pkg:rpm/suse/containerized-data-importer&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Containers%2015%20SP7

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.64.0-150700.9.11.1

{
    "binaries": [
        {
            "containerized-data-importer-manifests": "1.64.0-150700.9.11.1"
        }
    ]
}

source

"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:2493-1.json"