grype-0.92.1-1.1 on GA media SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2025:16198 Final 1 1 2025-05-20T00:00:00Z current 2025-05-20T00:00:00Z 2025-05-20T00:00:00Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z grype-0.92.1-1.1 on GA media These are all security issues fixed in the grype-0.92.1-1.1 package on the GA media of openSUSE Tumbleweed. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-Tumbleweed-2025-16198 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/security/rating/ SUSE Security Ratings https://www.suse.com/security/cve/CVE-2021-3711/ SUSE CVE CVE-2021-3711 page https://www.suse.com/security/cve/CVE-2022-2068/ SUSE CVE CVE-2022-2068 page openSUSE Tumbleweed grype-0.92.1-1.1 grype-bash-completion-0.92.1-1.1 grype-fish-completion-0.92.1-1.1 grype-zsh-completion-0.92.1-1.1 grype-0.92.1-1.1 as a component of openSUSE Tumbleweed grype-bash-completion-0.92.1-1.1 as a component of openSUSE Tumbleweed grype-fish-completion-0.92.1-1.1 as a component of openSUSE Tumbleweed grype-zsh-completion-0.92.1-1.1 as a component of openSUSE Tumbleweed In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt(). Typically an application will call this function twice. The first time, on entry, the "out" parameter can be NULL and, on exit, the "outlen" parameter is populated with the buffer size required to hold the decrypted plaintext. The application can then allocate a sufficiently sized buffer and call EVP_PKEY_decrypt() again, but this time passing a non-NULL value for the "out" parameter. A bug in the implementation of the SM2 decryption code means that the calculation of the buffer size required to hold the plaintext returned by the first call to EVP_PKEY_decrypt() can be smaller than the actual size required by the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is called by the application a second time with a buffer that is too small. A malicious attacker who is able present SM2 content for decryption to an application could cause attacker chosen data to overflow the buffer by up to a maximum of 62 bytes altering the contents of other data held after the buffer, possibly changing application behaviour or causing the application to crash. The location of the buffer is application dependent but is typically heap allocated. Fixed in OpenSSL 1.1.1l (Affected 1.1.1-1.1.1k). CVE-2021-3711 openSUSE Tumbleweed:grype-0.92.1-1.1 openSUSE Tumbleweed:grype-bash-completion-0.92.1-1.1 openSUSE Tumbleweed:grype-fish-completion-0.92.1-1.1 openSUSE Tumbleweed:grype-zsh-completion-0.92.1-1.1 moderate 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-3711.html CVE-2021-3711 https://bugzilla.suse.com/1189520 SUSE Bug 1189520 https://bugzilla.suse.com/1190129 SUSE Bug 1190129 https://bugzilla.suse.com/1192100 SUSE Bug 1192100 https://bugzilla.suse.com/1205663 SUSE Bug 1205663 https://bugzilla.suse.com/1225628 SUSE Bug 1225628 In addition to the c_rehash shell command injection identified in CVE-2022-1292, further circumstances where the c_rehash script does not properly sanitise shell metacharacters to prevent command injection were found by code review. When the CVE-2022-1292 was fixed it was not discovered that there are other places in the script where the file names of certificates being hashed were possibly passed to a command executed through the shell. This script is distributed by some operating systems in a manner where it is automatically executed. On such operating systems, an attacker could execute arbitrary commands with the privileges of the script. Use of the c_rehash script is considered obsolete and should be replaced by the OpenSSL rehash command line tool. Fixed in OpenSSL 3.0.4 (Affected 3.0.0,3.0.1,3.0.2,3.0.3). Fixed in OpenSSL 1.1.1p (Affected 1.1.1-1.1.1o). Fixed in OpenSSL 1.0.2zf (Affected 1.0.2-1.0.2ze). CVE-2022-2068 openSUSE Tumbleweed:grype-0.92.1-1.1 openSUSE Tumbleweed:grype-bash-completion-0.92.1-1.1 openSUSE Tumbleweed:grype-fish-completion-0.92.1-1.1 openSUSE Tumbleweed:grype-zsh-completion-0.92.1-1.1 moderate 10 AV:N/AC:L/Au:N/C:C/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2022-2068.html CVE-2022-2068 https://bugzilla.suse.com/1200550 SUSE Bug 1200550 https://bugzilla.suse.com/1207568 SUSE Bug 1207568 https://bugzilla.suse.com/1225628 SUSE Bug 1225628