kind-0.29.0-1.1 on GA media SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2025:15146-1 Final 1 1 2025-05-22T00:00:00Z current 2025-05-22T00:00:00Z 2025-05-22T00:00:00Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z kind-0.29.0-1.1 on GA media These are all security issues fixed in the kind-0.29.0-1.1 package on the GA media of openSUSE Tumbleweed. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-Tumbleweed-2025-15146 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XU3W2GRJSEQXIANJXID5YIYCJA4B3VKT/ E-Mail link for openSUSE-SU-2025:15146-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://www.suse.com/security/cve/CVE-2025-47290/ SUSE CVE CVE-2025-47290 page openSUSE Tumbleweed kind-0.29.0-1.1 kind-bash-completion-0.29.0-1.1 kind-fish-completion-0.29.0-1.1 kind-zsh-completion-0.29.0-1.1 kind-0.29.0-1.1 as a component of openSUSE Tumbleweed kind-bash-completion-0.29.0-1.1 as a component of openSUSE Tumbleweed kind-fish-completion-0.29.0-1.1 as a component of openSUSE Tumbleweed kind-zsh-completion-0.29.0-1.1 as a component of openSUSE Tumbleweed containerd is a container runtime. A time-of-check to time-of-use (TOCTOU) vulnerability was found in containerd v2.1.0. While unpacking an image during an image pull, specially crafted container images could arbitrarily modify the host file system. The only affected version of containerd is 2.1.0. Other versions of containerd are not affected. This bug has been fixed in containerd 2.1.1. Users should update to this version to resolve the issue. As a workaround, ensure that only trusted images are used and that only trusted users have permissions to import images. CVE-2025-47290 openSUSE Tumbleweed:kind-0.29.0-1.1 openSUSE Tumbleweed:kind-bash-completion-0.29.0-1.1 openSUSE Tumbleweed:kind-fish-completion-0.29.0-1.1 openSUSE Tumbleweed:kind-zsh-completion-0.29.0-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XU3W2GRJSEQXIANJXID5YIYCJA4B3VKT/ https://www.suse.com/security/cve/CVE-2025-47290.html CVE-2025-47290 https://bugzilla.suse.com/1243392 SUSE Bug 1243392