govulncheck-vulndb-0.0.20250807T150727-1.1 on GA media SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2025:16486 Final 1 1 2025-08-08T00:00:00Z current 2025-08-08T00:00:00Z 2025-08-08T00:00:00Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z govulncheck-vulndb-0.0.20250807T150727-1.1 on GA media These are all security issues fixed in the govulncheck-vulndb-0.0.20250807T150727-1.1 package on the GA media of openSUSE Tumbleweed. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). openSUSE-Tumbleweed-2025-16486 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/security/rating/ SUSE Security Ratings https://www.suse.com/security/cve/CVE-2015-7561/ SUSE CVE CVE-2015-7561 page https://www.suse.com/security/cve/CVE-2016-9962/ SUSE CVE CVE-2016-9962 page https://www.suse.com/security/cve/CVE-2017-1000056/ SUSE CVE CVE-2017-1000056 page https://www.suse.com/security/cve/CVE-2017-1002102/ SUSE CVE CVE-2017-1002102 page https://www.suse.com/security/cve/CVE-2018-1002100/ SUSE CVE CVE-2018-1002100 page https://www.suse.com/security/cve/CVE-2018-1002101/ SUSE CVE CVE-2018-1002101 page https://www.suse.com/security/cve/CVE-2018-16733/ SUSE CVE CVE-2018-16733 page https://www.suse.com/security/cve/CVE-2018-19184/ SUSE CVE CVE-2018-19184 page https://www.suse.com/security/cve/CVE-2019-1002100/ SUSE CVE CVE-2019-1002100 page https://www.suse.com/security/cve/CVE-2019-1002101/ SUSE CVE CVE-2019-1002101 page https://www.suse.com/security/cve/CVE-2019-11245/ SUSE CVE CVE-2019-11245 page https://www.suse.com/security/cve/CVE-2019-11251/ SUSE CVE CVE-2019-11251 page https://www.suse.com/security/cve/CVE-2019-11253/ SUSE CVE CVE-2019-11253 page https://www.suse.com/security/cve/CVE-2020-26240/ SUSE CVE CVE-2020-26240 page https://www.suse.com/security/cve/CVE-2020-26241/ SUSE CVE CVE-2020-26241 page https://www.suse.com/security/cve/CVE-2020-8551/ SUSE CVE CVE-2020-8551 page https://www.suse.com/security/cve/CVE-2020-8555/ SUSE CVE CVE-2020-8555 page https://www.suse.com/security/cve/CVE-2020-8557/ SUSE CVE CVE-2020-8557 page https://www.suse.com/security/cve/CVE-2020-8558/ SUSE CVE CVE-2020-8558 page https://www.suse.com/security/cve/CVE-2020-8562/ SUSE CVE CVE-2020-8562 page https://www.suse.com/security/cve/CVE-2020-8563/ SUSE CVE CVE-2020-8563 page https://www.suse.com/security/cve/CVE-2020-8566/ SUSE CVE CVE-2020-8566 page https://www.suse.com/security/cve/CVE-2021-25735/ SUSE CVE CVE-2021-25735 page https://www.suse.com/security/cve/CVE-2021-25736/ SUSE CVE CVE-2021-25736 page https://www.suse.com/security/cve/CVE-2021-25737/ SUSE CVE CVE-2021-25737 page https://www.suse.com/security/cve/CVE-2021-25741/ SUSE CVE CVE-2021-25741 page https://www.suse.com/security/cve/CVE-2021-25743/ SUSE CVE CVE-2021-25743 page https://www.suse.com/security/cve/CVE-2021-30465/ SUSE CVE CVE-2021-30465 page https://www.suse.com/security/cve/CVE-2022-29162/ SUSE CVE CVE-2022-29162 page https://www.suse.com/security/cve/CVE-2022-29177/ SUSE CVE CVE-2022-29177 page https://www.suse.com/security/cve/CVE-2022-3162/ SUSE CVE CVE-2022-3162 page https://www.suse.com/security/cve/CVE-2022-3294/ SUSE CVE CVE-2022-3294 page https://www.suse.com/security/cve/CVE-2023-2431/ SUSE CVE CVE-2023-2431 page https://www.suse.com/security/cve/CVE-2023-25809/ SUSE CVE CVE-2023-25809 page https://www.suse.com/security/cve/CVE-2023-2727/ SUSE CVE CVE-2023-2727 page https://www.suse.com/security/cve/CVE-2023-2728/ SUSE CVE CVE-2023-2728 page https://www.suse.com/security/cve/CVE-2023-27561/ SUSE CVE CVE-2023-27561 page https://www.suse.com/security/cve/CVE-2023-28642/ SUSE CVE CVE-2023-28642 page https://www.suse.com/security/cve/CVE-2023-5528/ SUSE CVE CVE-2023-5528 page https://www.suse.com/security/cve/CVE-2024-45310/ SUSE CVE CVE-2024-45310 page https://www.suse.com/security/cve/CVE-2024-5321/ SUSE CVE CVE-2024-5321 page https://www.suse.com/security/cve/CVE-2025-3445/ SUSE CVE CVE-2025-3445 page https://www.suse.com/security/cve/CVE-2025-47907/ SUSE CVE CVE-2025-47907 page https://www.suse.com/security/cve/CVE-2025-47908/ SUSE CVE CVE-2025-47908 page openSUSE Tumbleweed govulncheck-vulndb-0.0.20250807T150727-1.1 govulncheck-vulndb-0.0.20250807T150727-1.1 as a component of openSUSE Tumbleweed Kubernetes in OpenShift3 allows remote authenticated users to use the private images of other users should they know the name of said image. CVE-2015-7561 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1 moderate 3.5 AV:N/AC:M/Au:S/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2015-7561.html CVE-2015-7561 RunC allowed additional container processes via 'runc exec' to be ptraced by the pid 1 of the container. This allows the main processes of the container, if running as root, to gain access to file-descriptors of these new processes during the initialization and can lead to container escapes or modification of runC state before the process is fully placed inside the container. CVE-2016-9962 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1 moderate 4.1 AV:L/AC:M/Au:S/C:P/I:P/A:P 4.4 AV:L/AC:M/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2016-9962.html CVE-2016-9962 https://bugzilla.suse.com/1012568 SUSE Bug 1012568 https://bugzilla.suse.com/1173425 SUSE Bug 1173425 Kubernetes version 1.5.0-1.5.4 is vulnerable to a privilege escalation in the PodSecurityPolicy admission plugin resulting in the ability to make use of any existing PodSecurityPolicy object. CVE-2017-1000056 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1 moderate 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-1000056.html CVE-2017-1000056 https://bugzilla.suse.com/1010675 SUSE Bug 1010675 In Kubernetes versions 1.3.x, 1.4.x, 1.5.x, 1.6.x and prior to versions 1.7.14, 1.8.9 and 1.9.4 containers using a secret, configMap, projected or downwardAPI volume can trigger deletion of arbitrary files/directories from the nodes where they are running. CVE-2017-1002102 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1 moderate 6.3 AV:L/AC:M/Au:N/C:N/I:C/A:C To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2017-1002102.html CVE-2017-1002102 In Kubernetes versions 1.5.x, 1.6.x, 1.7.x, 1.8.x, and prior to version 1.9.6, the kubectl cp command insecurely handles tar data returned from the container, and can be caused to overwrite arbitrary local files. CVE-2018-1002100 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1 moderate 3.6 AV:L/AC:L/Au:N/C:N/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-1002100.html CVE-2018-1002100 https://bugzilla.suse.com/1089654 SUSE Bug 1089654 https://bugzilla.suse.com/1089991 SUSE Bug 1089991 In Kubernetes versions 1.9.0-1.9.9, 1.10.0-1.10.5, and 1.11.0-1.11.1, user input was handled insecurely while setting up volume mounts on Windows nodes, which could lead to command line argument injection. CVE-2018-1002101 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1 moderate 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-1002101.html CVE-2018-1002101 https://bugzilla.suse.com/1118791 SUSE Bug 1118791 In Go Ethereum (aka geth) before 1.8.14, TraceChain in eth/api_tracer.go does not verify that the end block is after the start block. CVE-2018-16733 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-16733.html CVE-2018-16733 cmd/evm/runner.go in Go Ethereum (aka geth) 1.8.17 allows attackers to cause a denial of service (SEGV) via crafted bytecode. CVE-2018-19184 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2018-19184.html CVE-2018-19184 https://bugzilla.suse.com/1115634 SUSE Bug 1115634 In all Kubernetes versions prior to v1.11.8, v1.12.6, and v1.13.4, users that are authorized to make patch requests to the Kubernetes API Server can send a specially crafted patch of type "json-patch" (e.g. `kubectl patch --type json` or `"Content-Type: application/json-patch+json"`) that consumes excessive resources while processing, causing a Denial of Service on the API Server. CVE-2019-1002100 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1 moderate 4 AV:N/AC:L/Au:S/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-1002100.html CVE-2019-1002100 https://bugzilla.suse.com/1127554 SUSE Bug 1127554 The kubectl cp command allows copying files between containers and the user machine. To copy files from a container, Kubernetes creates a tar inside the container, copies it over the network, and kubectl unpacks it on the user's machine. If the tar binary in the container is malicious, it could run any code and output unexpected, malicious results. An attacker could use this to write files to any path on the user's machine when kubectl cp is called, limited only by the system permissions of the local user. The untar function can both create and follow symbolic links. The issue is resolved in kubectl v1.11.9, v1.12.7, v1.13.5, and v1.14.0. CVE-2019-1002101 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1 moderate 5.8 AV:N/AC:M/Au:N/C:N/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-1002101.html CVE-2019-1002101 https://bugzilla.suse.com/1131056 SUSE Bug 1131056 https://bugzilla.suse.com/1138929 SUSE Bug 1138929 https://bugzilla.suse.com/1144507 SUSE Bug 1144507 In kubelet v1.13.6 and v1.14.2, containers for pods that do not specify an explicit runAsUser attempt to run as uid 0 (root) on container restart, or if the image was previously pulled to the node. If the pod specified mustRunAsNonRoot: true, the kubelet will refuse to start the container as root. If the pod did not specify mustRunAsNonRoot: true, the kubelet will run the container as uid 0. CVE-2019-11245 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1 moderate 4.6 AV:L/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-11245.html CVE-2019-11245 https://bugzilla.suse.com/1136944 SUSE Bug 1136944 The Kubernetes kubectl cp command in versions 1.1-1.12, and versions prior to 1.13.11, 1.14.7, and 1.15.4 allows a combination of two symlinks provided by tar output of a malicious container to place a file outside of the destination directory specified in the kubectl cp invocation. This could be used to allow an attacker to place a nefarious file using a symlink, outside of the destination tree. CVE-2019-11251 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-11251.html CVE-2019-11251 https://bugzilla.suse.com/1151300 SUSE Bug 1151300 Improper input validation in the Kubernetes API server in versions v1.0-1.12 and versions prior to v1.13.12, v1.14.8, v1.15.5, and v1.16.2 allows authorized users to send malicious YAML or JSON payloads, causing the API server to consume excessive CPU or memory, potentially crashing and becoming unavailable. Prior to v1.14.0, default RBAC policy authorized anonymous users to submit requests that could trigger this vulnerability. Clusters upgraded from a version prior to v1.14.0 keep the more permissive policy by default for backwards compatibility. CVE-2019-11253 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2019-11253.html CVE-2019-11253 https://bugzilla.suse.com/1152861 SUSE Bug 1152861 Go Ethereum, or "Geth", is the official Golang implementation of the Ethereum protocol. An ethash mining DAG generation flaw in Geth before version 1.9.24 could cause miners to erroneously calculate PoW in an upcoming epoch (estimated early January, 2021). This happened on the ETC chain on 2020-11-06. This issue is relevant only for miners, non-mining nodes are unaffected. This issue is fixed as of 1.9.24 CVE-2020-26240 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1 moderate 5 AV:N/AC:L/Au:N/C:N/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2020-26240.html CVE-2020-26240 Go Ethereum, or "Geth", is the official Golang implementation of the Ethereum protocol. This is a Consensus vulnerability in Geth before version 1.9.17 which can be used to cause a chain-split where vulnerable nodes reject the canonical chain. Geth's pre-compiled dataCopy (at 0x00...04) contract did a shallow copy on invocation. An attacker could deploy a contract that writes X to an EVM memory region R, then calls 0x00..04 with R as an argument, then overwrites R to Y, and finally invokes the RETURNDATACOPY opcode. When this contract is invoked, a consensus-compliant node would push X on the EVM stack, whereas Geth would push Y. This is fixed in version 1.9.17. CVE-2020-26241 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1 moderate 5.5 AV:N/AC:L/Au:S/C:N/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2020-26241.html CVE-2020-26241 The Kubelet component in versions 1.15.0-1.15.9, 1.16.0-1.16.6, and 1.17.0-1.17.2 has been found to be vulnerable to a denial of service attack via the kubelet API, including the unauthenticated HTTP read-only API typically served on port 10255, and the authenticated HTTPS API typically served on port 10250. CVE-2020-8551 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1 moderate 3.3 AV:A/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2020-8551.html CVE-2020-8551 https://bugzilla.suse.com/1167509 SUSE Bug 1167509 The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9, v1.17.5, and version v1.18.0 are vulnerable to a Server Side Request Forgery (SSRF) that allows certain authorized users to leak up to 500 bytes of arbitrary information from unprotected endpoints within the master's host network (such as link-local or loopback services). CVE-2020-8555 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1 moderate 3.5 AV:N/AC:M/Au:S/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2020-8555.html CVE-2020-8555 https://bugzilla.suse.com/1171106 SUSE Bug 1171106 https://bugzilla.suse.com/1185502 SUSE Bug 1185502 The Kubernetes kubelet component in versions 1.1-1.16.12, 1.17.0-1.17.8 and 1.18.0-1.18.5 do not account for disk usage by a pod which writes to its own /etc/hosts file. The /etc/hosts file mounted in a pod by kubelet is not included by the kubelet eviction manager when calculating ephemeral storage usage by a pod. If a pod writes a large amount of data to the /etc/hosts file, it could fill the storage space of the node and cause the node to fail. CVE-2020-8557 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1 moderate 2.1 AV:L/AC:L/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2020-8557.html CVE-2020-8557 https://bugzilla.suse.com/1173984 SUSE Bug 1173984 The Kubelet and kube-proxy components in versions 1.1.0-1.16.10, 1.17.0-1.17.6, and 1.18.0-1.18.3 were found to contain a security issue which allows adjacent hosts to reach TCP and UDP services bound to 127.0.0.1 running on the node or in the node's network namespace. Such a service is generally thought to be reachable only by other processes on the same host, but due to this defeect, could be reachable by other hosts on the same LAN as the node, or by containers running on the same node as the service. CVE-2020-8558 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1 moderate 5.8 AV:A/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2020-8558.html CVE-2020-8558 https://bugzilla.suse.com/1172945 SUSE Bug 1172945 As mitigations to a report from 2019 and CVE-2020-8555, Kubernetes attempts to prevent proxied connections from accessing link-local or localhost networks when making user-driven connections to Services, Pods, Nodes, or StorageClass service providers. As part of this mitigation Kubernetes does a DNS name resolution check and validates that response IPs are not in the link-local (169.254.0.0/16) or localhost (127.0.0.0/8) range. Kubernetes then performs a second DNS resolution without validation for the actual connection. If a non-standard DNS server returns different non-cached responses, a user may be able to bypass the proxy IP restriction and access private networks on the control plane. CVE-2020-8562 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1 moderate 3.5 AV:N/AC:M/Au:S/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2020-8562.html CVE-2020-8562 https://bugzilla.suse.com/1185502 SUSE Bug 1185502 In Kubernetes clusters using VSphere as a cloud provider, with a logging level set to 4 or above, VSphere cloud credentials will be leaked in the cloud controller manager's log. This affects < v1.19.3. CVE-2020-8563 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1 moderate 2.1 AV:L/AC:L/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2020-8563.html CVE-2020-8563 https://bugzilla.suse.com/1177659 SUSE Bug 1177659 In Kubernetes clusters using Ceph RBD as a storage provisioner, with logging level of at least 4, Ceph RBD admin secrets can be written to logs. This occurs in kube-controller-manager's logs during provisioning of Ceph RBD persistent claims. This affects < v1.19.3, < v1.18.10, < v1.17.13. CVE-2020-8566 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1 moderate 2.1 AV:L/AC:L/Au:N/C:P/I:N/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2020-8566.html CVE-2020-8566 https://bugzilla.suse.com/1177662 SUSE Bug 1177662 A security issue was discovered in kube-apiserver that could allow node updates to bypass a Validating Admission Webhook. Clusters are only affected by this vulnerability if they run a Validating Admission Webhook for Nodes that denies admission based at least partially on the old state of the Node object. Validating Admission Webhook does not observe some previous fields. CVE-2021-25735 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1 moderate 5.5 AV:N/AC:L/Au:S/C:N/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-25735.html CVE-2021-25735 https://bugzilla.suse.com/1183409 SUSE Bug 1183409 Kube-proxy on Windows can unintentionally forward traffic to local processes listening on the same port ("spec.ports[*].port") as a LoadBalancer Service when the LoadBalancer controller does not set the "status.loadBalancer.ingress[].ip" field. Clusters where the LoadBalancer controller sets the "status.loadBalancer.ingress[].ip" field are unaffected. CVE-2021-25736 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-25736.html CVE-2021-25736 https://bugzilla.suse.com/1185894 SUSE Bug 1185894 A security issue was discovered in Kubernetes where a user may be able to redirect pod traffic to private networks on a Node. Kubernetes already prevents creation of Endpoint IPs in the localhost or link-local range, but the same validation was not performed on EndpointSlice IPs. CVE-2021-25737 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1 moderate 4.9 AV:N/AC:M/Au:S/C:P/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-25737.html CVE-2021-25737 https://bugzilla.suse.com/1185503 SUSE Bug 1185503 A security issue was discovered in Kubernetes where a user may be able to create a container with subpath volume mounts to access files & directories outside of the volume, including on the host filesystem. CVE-2021-25741 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1 moderate 5.5 AV:N/AC:L/Au:S/C:P/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-25741.html CVE-2021-25741 https://bugzilla.suse.com/1189416 SUSE Bug 1189416 kubectl does not neutralize escape, meta or control sequences contained in the raw data it outputs to a terminal. This includes but is not limited to the unstructured string fields in objects such as Events. CVE-2021-25743 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1 moderate 2.1 AV:N/AC:H/Au:S/C:N/I:P/A:N To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-25743.html CVE-2021-25743 https://bugzilla.suse.com/1194400 SUSE Bug 1194400 runc before 1.0.0-rc95 allows a Container Filesystem Breakout via Directory Traversal. To exploit the vulnerability, an attacker must be able to create multiple containers with a fairly specific mount configuration. The problem occurs via a symlink-exchange attack that relies on a race condition. CVE-2021-30465 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1 moderate 6 AV:N/AC:M/Au:S/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2021-30465.html CVE-2021-30465 https://bugzilla.suse.com/1185405 SUSE Bug 1185405 https://bugzilla.suse.com/1189161 SUSE Bug 1189161 runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. A bug was found in runc prior to version 1.1.2 where `runc exec --cap` created processes with non-empty inheritable Linux process capabilities, creating an atypical Linux environment and enabling programs with inheritable file capabilities to elevate those capabilities to the permitted set during execve(2). This bug did not affect the container security sandbox as the inheritable set never contained more capabilities than were included in the container's bounding set. This bug has been fixed in runc 1.1.2. This fix changes `runc exec --cap` behavior such that the additional capabilities granted to the process being executed (as specified via `--cap` arguments) do not include inheritable capabilities. In addition, `runc spec` is changed to not set any inheritable capabilities in the created example OCI spec (`config.json`) file. CVE-2022-29162 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1 moderate 4.6 AV:L/AC:L/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2022-29162.html CVE-2022-29162 https://bugzilla.suse.com/1199460 SUSE Bug 1199460 Go Ethereum is the official Golang implementation of the Ethereum protocol. Prior to version 1.10.17, a vulnerable node, if configured to use high verbosity logging, can be made to crash when handling specially crafted p2p messages sent from an attacker node. Version 1.10.17 contains a patch that addresses the problem. As a workaround, setting loglevel to default level (`INFO`) makes the node not vulnerable to this attack. CVE-2022-29177 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2022-29177.html CVE-2022-29177 Users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different type in the same API group without authorization. Clusters are impacted by this vulnerability if all of the following are true: 1. There are 2+ CustomResourceDefinitions sharing the same API group 2. Users have cluster-wide list or watch authorization on one of those custom resources. 3. The same users are not authorized to read another custom resource in the same API group. CVE-2022-3162 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2022-3162.html CVE-2022-3162 https://bugzilla.suse.com/1204388 SUSE Bug 1204388 Users may have access to secure endpoints in the control plane network. Kubernetes clusters are only affected if an untrusted user can modify Node objects and send proxy requests to them. Kubernetes supports node proxying, which allows clients of kube-apiserver to access endpoints of a Kubelet to establish connections to Pods, retrieve container logs, and more. While Kubernetes already validates the proxying address for Nodes, a bug in kube-apiserver made it possible to bypass this validation. Bypassing this validation could allow authenticated requests destined for Nodes to to the API server's private network. CVE-2022-3294 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2022-3294.html CVE-2022-3294 https://bugzilla.suse.com/1204387 SUSE Bug 1204387 A security issue was discovered in Kubelet that allows pods to bypass the seccomp profile enforcement. Pods that use localhost type for seccomp profile but specify an empty profile field, are affected by this issue. In this scenario, this vulnerability allows the pod to run in unconfined (seccomp disabled) mode. This bug affects Kubelet. CVE-2023-2431 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2023-2431.html CVE-2023-2431 https://bugzilla.suse.com/1212493 SUSE Bug 1212493 runc is a CLI tool for spawning and running containers according to the OCI specification. In affected versions it was found that rootless runc makes `/sys/fs/cgroup` writable in following conditons: 1. when runc is executed inside the user namespace, and the `config.json` does not specify the cgroup namespace to be unshared (e.g.., `(docker|podman|nerdctl) run --cgroupns=host`, with Rootless Docker/Podman/nerdctl) or 2. when runc is executed outside the user namespace, and `/sys` is mounted with `rbind, ro` (e.g., `runc spec --rootless`; this condition is very rare). A container may gain the write access to user-owned cgroup hierarchy `/sys/fs/cgroup/user.slice/...` on the host . Other users's cgroup hierarchies are not affected. Users are advised to upgrade to version 1.1.5. Users unable to upgrade may unshare the cgroup namespace (`(docker|podman|nerdctl) run --cgroupns=private)`. This is the default behavior of Docker/Podman/nerdctl on cgroup v2 hosts. or add `/sys/fs/cgroup` to `maskedPaths`. CVE-2023-25809 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2023-25809.html CVE-2023-25809 https://bugzilla.suse.com/1209884 SUSE Bug 1209884 Users may be able to launch containers using images that are restricted by ImagePolicyWebhook when using ephemeral containers. Kubernetes clusters are only affected if the ImagePolicyWebhook admission plugin is used together with ephemeral containers. CVE-2023-2727 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2023-2727.html CVE-2023-2727 https://bugzilla.suse.com/1211630 SUSE Bug 1211630 Users may be able to launch containers that bypass the mountable secrets policy enforced by the ServiceAccount admission plugin when using ephemeral containers. The policy ensures pods running with a service account may only reference secrets specified in the service account's secrets field. Kubernetes clusters are only affected if the ServiceAccount admission plugin and the `kubernetes.io/enforce-mountable-secrets` annotation are used together with ephemeral containers. CVE-2023-2728 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2023-2728.html CVE-2023-2728 https://bugzilla.suse.com/1211631 SUSE Bug 1211631 runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go. To exploit this, an attacker must be able to spawn two containers with custom volume-mount configurations, and be able to run custom images. NOTE: this issue exists because of a CVE-2019-19921 regression. CVE-2023-27561 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2023-27561.html CVE-2023-27561 https://bugzilla.suse.com/1208962 SUSE Bug 1208962 runc is a CLI tool for spawning and running containers according to the OCI specification. It was found that AppArmor can be bypassed when `/proc` inside the container is symlinked with a specific mount configuration. This issue has been fixed in runc version 1.1.5, by prohibiting symlinked `/proc`. See PR #3785 for details. users are advised to upgrade. Users unable to upgrade should avoid using an untrusted container image. CVE-2023-28642 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2023-28642.html CVE-2023-28642 https://bugzilla.suse.com/1209888 SUSE Bug 1209888 A security issue was discovered in Kubernetes where a user that can create pods and persistent volumes on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they are using an in-tree storage plugin for Windows nodes. CVE-2023-5528 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2023-5528.html CVE-2023-5528 runc is a CLI tool for spawning and running containers according to the OCI specification. runc 1.1.13 and earlier, as well as 1.2.0-rc2 and earlier, can be tricked into creating empty files or directories in arbitrary locations in the host filesystem by sharing a volume between two containers and exploiting a race with `os.MkdirAll`. While this could be used to create empty files, existing files would not be truncated. An attacker must have the ability to start containers using some kind of custom volume configuration. Containers using user namespaces are still affected, but the scope of places an attacker can create inodes can be significantly reduced. Sufficiently strict LSM policies (SELinux/Apparmor) can also in principle block this attack -- we suspect the industry standard SELinux policy may restrict this attack's scope but the exact scope of protection hasn't been analysed. This is exploitable using runc directly as well as through Docker and Kubernetes. The issue is fixed in runc v1.1.14 and v1.2.0-rc3. Some workarounds are available. Using user namespaces restricts this attack fairly significantly such that the attacker can only create inodes in directories that the remapped root user/group has write access to. Unless the root user is remapped to an actual user on the host (such as with rootless containers that don't use `/etc/sub[ug]id`), this in practice means that an attacker would only be able to create inodes in world-writable directories. A strict enough SELinux or AppArmor policy could in principle also restrict the scope if a specific label is applied to the runc runtime, though neither the extent to which the standard existing policies block this attack nor what exact policies are needed to sufficiently restrict this attack have been thoroughly tested. CVE-2024-45310 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2024-45310.html CVE-2024-45310 https://bugzilla.suse.com/1230092 SUSE Bug 1230092 A security issue was discovered in Kubernetes clusters with Windows nodes where BUILTIN\Users may be able to read container logs and NT AUTHORITY\Authenticated Users may be able to modify container logs. CVE-2024-5321 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2024-5321.html CVE-2024-5321 https://bugzilla.suse.com/1225420 SUSE Bug 1225420 A Path Traversal "Zip Slip" vulnerability has been identified in mholt/archiver in Go. This vulnerability allows using a crafted ZIP file containing path traversal symlinks to create or overwrite files with the user's privileges or application utilizing the library. When using the archiver.Unarchive functionality with ZIP files, like this: archiver.Unarchive(zipFile, outputDir), A crafted ZIP file can be extracted in such a way that it writes files to the affected system with the same privileges as the application executing this vulnerable functionality. Consequently, sensitive files may be overwritten, potentially leading to privilege escalation, code execution, and other severe outcomes in some cases. It's worth noting that a similar vulnerability was found in TAR files (CVE-2024-0406). Although a fix was implemented, it hasn't been officially released, and the affected project has since been deprecated. The successor to mholt/archiver is a new project called mholt/archives, and its initial release (v0.1.0) removes the Unarchive() functionality. CVE-2025-3445 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-3445.html CVE-2025-3445 https://bugzilla.suse.com/1241242 SUSE Bug 1241242 Cancelling a query (e.g. by cancelling the context passed to one of the query methods) during a call to the Scan method of the returned Rows can result in unexpected results if other queries are being made in parallel. This can result in a race condition that may overwrite the expected results with those of another query, causing the call to Scan to return either unexpected results from the other query or an error. CVE-2025-47907 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-47907.html CVE-2025-47907 https://bugzilla.suse.com/1247720 SUSE Bug 1247720 Middleware causes a prohibitive amount of heap allocations when processing malicious preflight requests that include a Access-Control-Request-Headers (ACRH) header whose value contains many commas. This behavior can be abused by attackers to produce undue load on the middleware/server as an attempt to cause a denial of service. CVE-2025-47908 openSUSE Tumbleweed:govulncheck-vulndb-0.0.20250807T150727-1.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/security/cve/CVE-2025-47908.html CVE-2025-47908 https://bugzilla.suse.com/1247746 SUSE Bug 1247746