openSUSE-SU-2026:20438-1

Import Source

JSON Data

https://api.test.osv.dev/v1/vulns/openSUSE-SU-2026:20438-1

Upstream

CVE (3)

Related

CVE (3)

Published

2026-03-27T10:04:45Z

Modified

2026-04-03T17:24:37Z

Summary

Security update for docker-compose

Details

This update for docker-compose fixes the following issues:

CVE-2025-47913: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type in response to a key listing or signing request (bsc#1253584).
CVE-2025-47914: golang.org/x/crypto/ssh/agent: non validated message size can cause a panic due to an out of bounds read (bsc#1254041).
CVE-2025-62725: OCI compose artifacts can be used to escape the cache directory and overwrite arbitrary files (bsc#1252752).

References

Affected packages

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.33.1-160000.4.1

{
    "binaries": [
        {
            "docker-compose": "2.33.1-160000.4.1"
        }
    ]
}

source

"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:20438-1.json"