{"id":"SUSE-SU-2026:4930-1","summary":"Security update for rust-keylime","details":"This update for rust-keylime fixes the following issue:\n\n- CVE-2026-115905: zip: security control bypass via parser differential between central directory and local headers\n  (bsc#1287921)\n- CVE-2026-115906: zip: authentication bypass in AES encrypted entries due to improper HMAC verification (bsc#1287921)\n- CVE-2026-115907: zip: denial of service via unbounded memory allocation in legacy decoders (bsc#1287921)\n- CVE-2026-115908: zip: path traversal via lexical symlink validation during extraction (bsc#1287921)\n- CVE-2026-115909: zip: denial of service via uncontrolled memory allocation on symlink targets (bsc#1287921)\n\nChanges for rust-keylime:\n\n- Update to version 0.2.10+12:\n * log Agent UUID at push agent startup\n * Limit actix-web workers\n * Fix clippy needless_late_init warnings\n * Unwrap OCTET STRING wrapped EK certificates\n * build(deps): bump rand from 0.9.4 to 0.10.1\n * build(deps): bump glob from 0.3.3 to 0.3.4\n * build(deps): bump reqwest from 0.13.3 to 0.13.4\n * Check shutdown marker inside ml_extend loop\n * Fix clippy useless_borrows_in_formatting warnings\n * build(deps): bump tokio from 1.52.2 to 1.53.1\n * Fix payload key upgrade regression by falling back to mTLS key\n * Accept any RSA key size for payload encryption\n * Bump version to 0.2.10\n * keylime: use runtime OpenSSL algorithm detection instead of compile-time symbols\n","modified":"2026-10-31T18:00:03.940330945Z","published":"2026-10-29T08:53:34Z","related":["CVE-2026-115905","CVE-2026-115906","CVE-2026-115907","CVE-2026-115908","CVE-2026-115909"],"upstream":["CVE-2026-115905","CVE-2026-115906","CVE-2026-115907","CVE-2026-115908","CVE-2026-115909"],"references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264930-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1287921"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-115905"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-115906"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-115907"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-115908"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-115909"}],"affected":[{"package":{"name":"rust-keylime","ecosystem":"SUSE:Linux Enterprise Micro 5.4","purl":"pkg:rpm/suse/rust-keylime&distro=SUSE%20Linux%20Enterprise%20Micro%205.4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.10+12-150400.3.22.1"}]}],"ecosystem_specific":{"binaries":[{"rust-keylime":"0.2.10+12-150400.3.22.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:4930-1.json"}}],"schema_version":"1.9.2"}