govulncheck-vulndb-0.0.20250422T181640-1.1 on GA media SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2025:15017-1 Final 1 1 2025-04-23T00:00:00Z current 2025-04-23T00:00:00Z 2025-04-23T00:00:00Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z govulncheck-vulndb-0.0.20250422T181640-1.1 on GA media These are all security issues fixed in the govulncheck-vulndb-0.0.20250422T181640-1.1 package on the GA media of openSUSE Tumbleweed. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-Tumbleweed-2025-15017 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XCF7AZBKQYAQXK32J6F54H6NREFBK2V7/ E-Mail link for openSUSE-SU-2025:15017-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://www.suse.com/security/cve/CVE-2019-15119/ SUSE CVE CVE-2019-15119 page https://www.suse.com/security/cve/CVE-2025-1386/ SUSE CVE CVE-2025-1386 page https://www.suse.com/security/cve/CVE-2025-2424/ SUSE CVE CVE-2025-2424 page https://www.suse.com/security/cve/CVE-2025-24358/ SUSE CVE CVE-2025-24358 page https://www.suse.com/security/cve/CVE-2025-2475/ SUSE CVE CVE-2025-2475 page https://www.suse.com/security/cve/CVE-2025-24839/ SUSE CVE CVE-2025-24839 page https://www.suse.com/security/cve/CVE-2025-24866/ SUSE CVE CVE-2025-24866 page https://www.suse.com/security/cve/CVE-2025-2564/ SUSE CVE CVE-2025-2564 page https://www.suse.com/security/cve/CVE-2025-27538/ SUSE CVE CVE-2025-27538 page https://www.suse.com/security/cve/CVE-2025-27571/ SUSE CVE CVE-2025-27571 page https://www.suse.com/security/cve/CVE-2025-27936/ SUSE CVE CVE-2025-27936 page https://www.suse.com/security/cve/CVE-2025-30206/ SUSE CVE CVE-2025-30206 page https://www.suse.com/security/cve/CVE-2025-31363/ SUSE CVE CVE-2025-31363 page https://www.suse.com/security/cve/CVE-2025-32093/ SUSE CVE CVE-2025-32093 page https://www.suse.com/security/cve/CVE-2025-32431/ SUSE CVE CVE-2025-32431 page https://www.suse.com/security/cve/CVE-2025-32445/ SUSE CVE CVE-2025-32445 page https://www.suse.com/security/cve/CVE-2025-32793/ SUSE CVE CVE-2025-32793 page https://www.suse.com/security/cve/CVE-2025-32963/ SUSE CVE CVE-2025-32963 page https://www.suse.com/security/cve/CVE-2025-3801/ SUSE CVE CVE-2025-3801 page https://www.suse.com/security/cve/CVE-2025-43970/ SUSE CVE CVE-2025-43970 page https://www.suse.com/security/cve/CVE-2025-43971/ SUSE CVE CVE-2025-43971 page https://www.suse.com/security/cve/CVE-2025-43972/ SUSE CVE CVE-2025-43972 page https://www.suse.com/security/cve/CVE-2025-43973/ SUSE CVE CVE-2025-43973 page openSUSE Tumbleweed govulncheck-vulndb-0.0.20250422T181640-1.1 govulncheck-vulndb-0.0.20250422T181640-1.1 as a component of openSUSE Tumbleweed lib/install/install.go in cnlh nps through 0.23.2 uses 0777 permissions for /usr/local/bin/nps and/or /usr/bin/nps, leading to a file overwrite by a local user. CVE-2019-15119 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250422T181640-1.1 moderate 5.8 AV:N/AC:M/Au:N/C:N/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XCF7AZBKQYAQXK32J6F54H6NREFBK2V7/ https://www.suse.com/security/cve/CVE-2019-15119.html CVE-2019-15119 When using the ch-go library, under a specific condition when the query includes a large, uncompressed malicious external data, it is possible for an attacker in control of such data to smuggle another query packet into the connection stream. CVE-2025-1386 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250422T181640-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XCF7AZBKQYAQXK32J6F54H6NREFBK2V7/ https://www.suse.com/security/cve/CVE-2025-1386.html CVE-2025-1386 https://bugzilla.suse.com/1241100 SUSE Bug 1241100 Mattermost versions 10.5.x <= 10.5.1, 9.11.x <= 9.11.9 fail to check if a file has been deleted when creating a bookmark which allows an attacker who knows the IDs of deleted files to obtain metadata of the files via bookmark creation. CVE-2025-2424 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250422T181640-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XCF7AZBKQYAQXK32J6F54H6NREFBK2V7/ https://www.suse.com/security/cve/CVE-2025-2424.html CVE-2025-2424 gorilla/csrf provides Cross Site Request Forgery (CSRF) prevention middleware for Go web applications & services. Prior to 1.7.2, gorilla/csrf does not validate the Origin header against an allowlist. Its executes its validation of the Referer header for cross-origin requests only when it believes the request is being served over TLS. It determines this by inspecting the r.URL.Scheme value. However, this value is never populated for "server" requests per the Go spec, and so this check does not run in practice. This vulnerability allows an attacker who has gained XSS on a subdomain or top level domain to perform authenticated form submissions against gorilla/csrf protected targets that share the same top level domain. This vulnerability is fixed in 1.7.2. CVE-2025-24358 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250422T181640-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XCF7AZBKQYAQXK32J6F54H6NREFBK2V7/ https://www.suse.com/security/cve/CVE-2025-24358.html CVE-2025-24358 https://bugzilla.suse.com/1241233 SUSE Bug 1241233 Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to invalidate the cache when a user account is converted to a bot which allows an attacker to login to the bot exactly one time via normal credentials. CVE-2025-2475 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250422T181640-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XCF7AZBKQYAQXK32J6F54H6NREFBK2V7/ https://www.suse.com/security/cve/CVE-2025-2475.html CVE-2025-2475 Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to prevent Wrangler posts from triggering AI responses. This vulnerability allows users without access to the AI bot to activate it by attaching the activate_ai override property to a post via the Wrangler plugin, provided both the AI and Wrangler plugins are enabled. CVE-2025-24839 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250422T181640-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XCF7AZBKQYAQXK32J6F54H6NREFBK2V7/ https://www.suse.com/security/cve/CVE-2025-24839.html CVE-2025-24839 Mattermost versions 9.11.x <= 9.11.8 fail to enforce proper access controls on the /api/v4/audits endpoint, allowing users with delegated granular administration roles who lack access to Compliance Monitoring to retrieve User Activity Logs. CVE-2025-24866 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250422T181640-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XCF7AZBKQYAQXK32J6F54H6NREFBK2V7/ https://www.suse.com/security/cve/CVE-2025-24866.html CVE-2025-24866 Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to properly enforce the 'Allow users to view/update archived channels' System Console setting, which allows authenticated users to view members and member information of archived channels even when this setting is disabled. CVE-2025-2564 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250422T181640-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XCF7AZBKQYAQXK32J6F54H6NREFBK2V7/ https://www.suse.com/security/cve/CVE-2025-2564.html CVE-2025-2564 Mattermost versions 10.5.x <= 10.5.1, 9.11.x <= 9.11.9 fail to enforce MFA checks in PUT /api/v4/users/user-id/mfa when the requesting user differs from the target user ID, which allows users with edit_other_users permission to activate or deactivate MFA for other users, even if those users have not set up MFA. CVE-2025-27538 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250422T181640-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XCF7AZBKQYAQXK32J6F54H6NREFBK2V7/ https://www.suse.com/security/cve/CVE-2025-27538.html CVE-2025-27538 Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to check the "Allow Users to View Archived Channels" configuration when fetching channel metadata of a post from archived channels, which allows authenticated users to access such information when a channel is archived. CVE-2025-27571 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250422T181640-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XCF7AZBKQYAQXK32J6F54H6NREFBK2V7/ https://www.suse.com/security/cve/CVE-2025-27571.html CVE-2025-27571 Mattermost Plugin MSTeams versions <2.1.0 and Mattermost Server versions 10.5.x <=10.5.1 with the MS Teams plugin enabled fail to perform constant time comparison on a MSTeams plugin webhook secret which allows an attacker to retrieve the webhook secret of the MSTeams plugin via a timing attack during webhook secret comparison. CVE-2025-27936 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250422T181640-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XCF7AZBKQYAQXK32J6F54H6NREFBK2V7/ https://www.suse.com/security/cve/CVE-2025-27936.html CVE-2025-27936 Dpanel is a Docker visualization panel system which provides complete Docker management functions. The Dpanel service contains a hardcoded JWT secret in its default configuration, allowing attackers to generate valid JWT tokens and compromise the host machine. This security flaw allows attackers to analyze the source code, discover the embedded secret, and craft legitimate JWT tokens. By forging these tokens, an attacker can successfully bypass authentication mechanisms, impersonate privileged users, and gain unauthorized administrative access. Consequently, this enables full control over the host machine, potentially leading to severe consequences such as sensitive data exposure, unauthorized command execution, privilege escalation, or further lateral movement within the network environment. This issue is patched in version 1.6.1. A workaround for this vulnerability involves replacing the hardcoded secret with a securely generated value and load it from secure configuration storage. CVE-2025-30206 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250422T181640-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XCF7AZBKQYAQXK32J6F54H6NREFBK2V7/ https://www.suse.com/security/cve/CVE-2025-30206.html CVE-2025-30206 Mattermost versions 10.4.x <= 10.4.2, 10.5.x <= 10.5.0, 9.11.x <= 9.11.9 fail to restrict domains the LLM can request to contact upstream which allows an authenticated user to exfiltrate data from an arbitrary server accessible to the victim via performing a prompt injection in the AI plugin's Jira tool. CVE-2025-31363 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250422T181640-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XCF7AZBKQYAQXK32J6F54H6NREFBK2V7/ https://www.suse.com/security/cve/CVE-2025-31363.html CVE-2025-31363 Mattermost versions 10.5.x <= 10.5.1, 10.4.x <= 10.4.3, 9.11.x <= 9.11.9 fail to restrict certain operations on system admins to only other system admins, which allows delegated granular administration users with the "Edit Other Users" permission to perform unauthorized modifications to system administrators via improper permission validation. CVE-2025-32093 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250422T181640-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XCF7AZBKQYAQXK32J6F54H6NREFBK2V7/ https://www.suse.com/security/cve/CVE-2025-32093.html CVE-2025-32093 Traefik (pronounced traffic) is an HTTP reverse proxy and load balancer. In versions prior to 2.11.24, 3.3.6, and 3.4.0-rc2. There is a potential vulnerability in Traefik managing the requests using a PathPrefix, Path or PathRegex matcher. When Traefik is configured to route the requests to a backend using a matcher based on the path, if the URL contains a /../ in its path, it's possible to target a backend, exposed using another router, by-passing the middlewares chain. This issue has been patched in versions 2.11.24, 3.3.6, and 3.4.0-rc2. A workaround involves adding a `PathRegexp` rule to the matcher to prevent matching a route with a `/../` in the path. CVE-2025-32431 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250422T181640-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XCF7AZBKQYAQXK32J6F54H6NREFBK2V7/ https://www.suse.com/security/cve/CVE-2025-32431.html CVE-2025-32431 Argo Events is an event-driven workflow automation framework for Kubernetes. A user with permission to create/modify EventSource and Sensor custom resources can gain privileged access to the host system and cluster, even without having direct administrative privileges. The EventSource and Sensor CRs allow the corresponding orchestrated pod to be customized with spec.template and spec.template.container (with type k8s.io/api/core/v1.Container), thus, any specification under container such as command, args, securityContext , volumeMount can be specified, and applied to the EventSource or Sensor pod. With these, a user would be able to gain privileged access to the cluster host, if he/she specified the EventSource/Sensor CR with some particular properties under template. This vulnerability is fixed in v1.9.6. CVE-2025-32445 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250422T181640-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XCF7AZBKQYAQXK32J6F54H6NREFBK2V7/ https://www.suse.com/security/cve/CVE-2025-32445.html CVE-2025-32445 Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Versions 1.15.0 to 1.15.15, 1.16.0 to 1.16.8, and 1.17.0 to 1.17.2, are vulnerable when using Wireguard transparent encryption in a Cilium cluster, packets that originate from a terminating endpoint can leave the source node without encryption due to a race condition in how traffic is processed by Cilium. This issue has been patched in versions 1.15.16, 1.16.9, and 1.17.3. There are no workarounds available for this issue. CVE-2025-32793 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250422T181640-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XCF7AZBKQYAQXK32J6F54H6NREFBK2V7/ https://www.suse.com/security/cve/CVE-2025-32793.html CVE-2025-32793 MinIO Operator STS is a native IAM Authentication for Kubernetes. Prior to version 7.1.0, if no audiences are provided for the `spec.audiences` field, the default will be of the Kubernetes apiserver. Without scoping, it can be replayed to other internal systems, which may unintentionally trust it. This issue has been patched in version 7.1.0. CVE-2025-32963 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250422T181640-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XCF7AZBKQYAQXK32J6F54H6NREFBK2V7/ https://www.suse.com/security/cve/CVE-2025-32963.html CVE-2025-32963 A vulnerability was found in songquanpeng one-api up to 0.6.10. It has been classified as problematic. This affects an unknown part of the component System Setting Handler. The manipulation of the argument Homepage Content/About System/Footer leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. CVE-2025-3801 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250422T181640-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XCF7AZBKQYAQXK32J6F54H6NREFBK2V7/ https://www.suse.com/security/cve/CVE-2025-3801.html CVE-2025-3801 An issue was discovered in GoBGP before 3.35.0. pkg/packet/mrt/mrt.go does not properly check the input length, e.g., by ensuring that there are 12 bytes or 36 bytes (depending on the address family). CVE-2025-43970 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250422T181640-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XCF7AZBKQYAQXK32J6F54H6NREFBK2V7/ https://www.suse.com/security/cve/CVE-2025-43970.html CVE-2025-43970 https://bugzilla.suse.com/1246518 SUSE Bug 1246518 An issue was discovered in GoBGP before 3.35.0. pkg/packet/bgp/bgp.go allows attackers to cause a panic via a zero value for softwareVersionLen. CVE-2025-43971 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250422T181640-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XCF7AZBKQYAQXK32J6F54H6NREFBK2V7/ https://www.suse.com/security/cve/CVE-2025-43971.html CVE-2025-43971 https://bugzilla.suse.com/1241606 SUSE Bug 1241606 An issue was discovered in GoBGP before 3.35.0. An attacker can cause a crash in the pkg/packet/bgp/bgp.go flowspec parser by sending fewer than 20 bytes in a certain context. CVE-2025-43972 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250422T181640-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XCF7AZBKQYAQXK32J6F54H6NREFBK2V7/ https://www.suse.com/security/cve/CVE-2025-43972.html CVE-2025-43972 https://bugzilla.suse.com/1246521 SUSE Bug 1246521 An issue was discovered in GoBGP before 3.35.0. pkg/packet/rtr/rtr.go does not verify that the input length corresponds to a situation in which all bytes are available for an RTR message. CVE-2025-43973 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250422T181640-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XCF7AZBKQYAQXK32J6F54H6NREFBK2V7/ https://www.suse.com/security/cve/CVE-2025-43973.html CVE-2025-43973