govulncheck-vulndb-0.0.20250506T153719-1.1 on GA media SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2025:16121 Final 1 1 2025-05-07T00:00:00Z current 2025-05-07T00:00:00Z 2025-05-07T00:00:00Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z govulncheck-vulndb-0.0.20250506T153719-1.1 on GA media These are all security issues fixed in the govulncheck-vulndb-0.0.20250506T153719-1.1 package on the GA media of openSUSE Tumbleweed. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-Tumbleweed-2025-16121 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/security/rating/ SUSE Security Ratings https://www.suse.com/security/cve/CVE-2019-11243/ SUSE CVE CVE-2019-11243 page https://www.suse.com/security/cve/CVE-2023-32198/ SUSE CVE CVE-2023-32198 page https://www.suse.com/security/cve/CVE-2024-22031/ SUSE CVE CVE-2024-22031 page https://www.suse.com/security/cve/CVE-2025-23390/ SUSE CVE CVE-2025-23390 page https://www.suse.com/security/cve/CVE-2025-32777/ SUSE CVE CVE-2025-32777 page https://www.suse.com/security/cve/CVE-2025-3879/ SUSE CVE CVE-2025-3879 page https://www.suse.com/security/cve/CVE-2025-4166/ SUSE CVE CVE-2025-4166 page https://www.suse.com/security/cve/CVE-2025-4210/ SUSE CVE CVE-2025-4210 page https://www.suse.com/security/cve/CVE-2025-46327/ SUSE CVE CVE-2025-46327 page https://www.suse.com/security/cve/CVE-2025-46342/ SUSE CVE CVE-2025-46342 page https://www.suse.com/security/cve/CVE-2025-46569/ SUSE CVE CVE-2025-46569 page https://www.suse.com/security/cve/CVE-2025-46599/ SUSE CVE CVE-2025-46599 page openSUSE Tumbleweed govulncheck-vulndb-0.0.20250506T153719-1.1 govulncheck-vulndb-0.0.20250506T153719-1.1 as a component of openSUSE Tumbleweed In Kubernetes v1.12.0-v1.12.4 and v1.13.0, the rest.AnonymousClientConfig() method returns a copy of the provided config, with credentials removed (bearer token, username/password, and client certificate/key data). In the affected versions, rest.AnonymousClientConfig() did not effectively clear service account credentials loaded using rest.InClusterConfig() CVE-2019-11243 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250506T153719-1.1 moderate 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-11243.html CVE-2019-11243 https://bugzilla.suse.com/1133146 SUSE Bug 1133146 unknown CVE-2023-32198 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250506T153719-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2023-32198.html CVE-2023-32198 https://bugzilla.suse.com/1241557 SUSE Bug 1241557 unknown CVE-2024-22031 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250506T153719-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2024-22031.html CVE-2024-22031 https://bugzilla.suse.com/1223154 SUSE Bug 1223154 unknown CVE-2025-23390 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250506T153719-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-23390.html CVE-2025-23390 https://bugzilla.suse.com/1238987 SUSE Bug 1238987 Volcano is a Kubernetes-native batch scheduling system. Prior to versions 1.11.2, 1.10.2, 1.9.1, 1.11.0-network-topology-preview.3, and 1.12.0-alpha.2, attacker compromise of either the Elastic service or the extender plugin can cause denial of service of the scheduler. This is a privilege escalation, because Volcano users may run their Elastic service and extender plugins in separate pods or nodes from the scheduler. In the Kubernetes security model, node isolation is a security boundary, and as such an attacker is able to cross that boundary in Volcano's case if they have compromised either the vulnerable services or the pod/node in which they are deployed. The scheduler will become unavailable to other users and workloads in the cluster. The scheduler will either crash with an unrecoverable OOM panic or freeze while consuming excessive amounts of memory. This issue has been patched in versions 1.11.2, 1.10.2, 1.9.1, 1.11.0-network-topology-preview.3, and 1.12.0-alpha.2. CVE-2025-32777 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250506T153719-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-32777.html CVE-2025-32777 Vault Community, Vault Enterprise ("Vault") Azure Auth method did not correctly validate the claims in the Azure-issued token, resulting in the potential bypass of the bound_locations parameter on login. Fixed in Vault Community Edition 1.19.1 and Vault Enterprise 1.19.1, 1.18.7, 1.17.14, 1.16.18. CVE-2025-3879 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250506T153719-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-3879.html CVE-2025-3879 https://bugzilla.suse.com/1242742 SUSE Bug 1242742 https://bugzilla.suse.com/1242795 SUSE Bug 1242795 Vault Community and Vault Enterprise Key/Value (kv) Version 2 plugin may unintentionally expose sensitive information in server and audit logs when users submit malformed payloads during secret creation or update operations via the Vault REST API. This vulnerability, identified as CVE-2025-4166, is fixed in Vault Community 1.19.3 and Vault Enterprise 1.19.3, 1.18.9, 1.17.16, 1.16.20. CVE-2025-4166 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250506T153719-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-4166.html CVE-2025-4166 https://bugzilla.suse.com/1242800 SUSE Bug 1242800 A vulnerability classified as critical was found in Casdoor up to 1.811.0. This vulnerability affects the function HandleScim of the file controllers/scim.go of the component SCIM User Creation Endpoint. The manipulation leads to authorization bypass. The attack can be initiated remotely. Upgrading to version 1.812.0 is able to address this issue. The name of the patch is 3d12ac8dc2282369296c3386815c00a06c6a92fe. It is recommended to upgrade the affected component. CVE-2025-4210 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250506T153719-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-4210.html CVE-2025-4210 gosnowflake is the Snowflake Golang driver. Versions starting from 1.7.0 to before 1.13.3, are vulnerable to a Time-of-Check to Time-of-Use (TOCTOU) race condition. When using the Easy Logging feature on Linux and macOS, the Driver reads logging configuration from a user-provided file. On Linux and macOS the Driver verifies that the configuration file can be written to only by its owner. That check was vulnerable to a TOCTOU race condition and failed to verify that the file owner matches the user running the Driver. This could allow a local attacker with write access to the configuration file or the directory containing it to overwrite the configuration and gain control over logging level and output location. This issue has been patched in version 1.13.3. CVE-2025-46327 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250506T153719-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-46327.html CVE-2025-46327 https://bugzilla.suse.com/1242017 SUSE Bug 1242017 Kyverno is a policy engine designed for cloud native platform engineering teams. Prior to versions 1.13.5 and 1.14.0, it may happen that policy rules using namespace selector(s) in their match statements are mistakenly not applied during admission review request processing due to a missing error propagation in function `GetNamespaceSelectorsFromNamespaceLister` in `pkg/utils/engine/labels.go`. As a consequence, security-critical mutations and validations are bypassed, potentially allowing attackers with K8s API access to perform malicious operations. This issue has been patched in versions 1.13.5 and 1.14.0. CVE-2025-46342 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250506T153719-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-46342.html CVE-2025-46342 Open Policy Agent (OPA) is an open source, general-purpose policy engine. Prior to version 1.4.0, when run as a server, OPA exposes an HTTP Data API for reading and writing documents. Requesting a virtual document through the Data API entails policy evaluation, where a Rego query containing a single data document reference is constructed from the requested path. This query is then used for policy evaluation. A HTTP request path can be crafted in a way that injects Rego code into the constructed query. The evaluation result cannot be made to return any other data than what is generated by the requested path, but this path can be misdirected, and the injected Rego code can be crafted to make the query succeed or fail; opening up for oracle attacks or, given the right circumstances, erroneous policy decision results. Furthermore, the injected code can be crafted to be computationally expensive, resulting in a Denial Of Service (DoS) attack. This issue has been patched in version 1.4.0. A workaround involves having network access to OPA's RESTful APIs being limited to `localhost` and/or trusted networks, unless necessary for production reasons. CVE-2025-46569 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250506T153719-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-46569.html CVE-2025-46569 https://bugzilla.suse.com/1246710 SUSE Bug 1246710 CNCF K3s 1.32 before 1.32.4-rc1+k3s1 has a Kubernetes kubelet configuration change with the unintended consequence that, in some situations, ReadOnlyPort is set to 10255. For example, the default behavior of a K3s online installation might allow unauthenticated access to this port, exposing credentials. CVE-2025-46599 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250506T153719-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-46599.html CVE-2025-46599