{"id":"openSUSE-SU-2026:22138-1","summary":"Security update for hashcat","details":"This update for hashcat fixes the following issues:\n\nChanges in hashcat:\n\nUpdate to snapshot v7.1.2-942-gef3508ed8:\n\n  * Addressed CVE-2026-68768 [boo#1276256],\n    CVE-2026-68767 [boo#1276255], CVE-2026-68766 [boo#1276254]\n  * Feed plugins and attack-mode 8\n  * Probability-ordered PCFG and targeted hints in attack-mode 4\n  * Device-accelerated table attacks in attack-mode 5\n  * Wordlists inside masks with attack-mode 12\n  * Account-aware association in attack-mode 9\n  * Seekable wordlists and one cache location\n  * A brain server built for large sessions\n  * Rules in every attack-mode\n  * A Python bridge that uses every CPU thread\n\nUpdate to release 7.1.2:\n\n  * New algorithms: AS/400 DES, AS/400 SHA1, Cisco-ISE SHA256,\n    LUKS2-Argon2i KDF, KeePass KDBX v4, SAP CODVN H SHA512,\n    sm3crypt, BLAKE2b-256, MD6, sha224\n\n- Use BUILD_MODE=cross to not optimize for build machine CPU (boo#1248352)\n\nUpdate to release 7.0.0:\n\n  * Full release notes at\n    /usr/share/doc/packages/hashcat/docs/releases_notes_v7.0.0.md\n  * Assimilation Bridge: Integrate external resources like CPUs,\n    FPGAs, embedded interpreters, and more into the cracking\n    pipeline.\n  * Python Bridge Plugin: Rapidly implement hash-matching logic in\n    Python. No recompilation needed, supports multithreading and\n    rule engine by default.\n  * Virtual Backend Devices: Internally partitions physical GPUs\n    into multiple logical devices for better bridge integration and\n    async workloads.\n  * Hash-Mode Autodetection: Omit the -m flag and let Hashcat\n    detect the hash-mode, or use --identify to list possibilities.\n  * 58 new application-specific hash types, including Argon2,\n    MetaMask, Microsoft Online Account, SNMPv3, GPG, OpenSSH, and\n    LUKS2\n  * 17 new generic hash constructions used in real-world web apps\n    and protocols\n  * 11 new primitives added to the crypto library, improving reuse\n    and plugin development\n  * 20 new tools to extract hashes from popular sources, including\n    APFS, Virtualbox, BitLocker, and various wallet formats\n  * Complete refactor of the autotuning engine for better device\n    utilization\n  * Major rewrite of memory management to eliminate previous 4GB\n    allocation caps and enable full memory usage across devices\n","modified":"2026-10-20T19:15:03.938845272Z","published":"2026-10-19T16:30:34Z","related":["CVE-2026-68766","CVE-2026-68767","CVE-2026-68768"],"upstream":["CVE-2026-68766","CVE-2026-68767","CVE-2026-68768"],"references":[{"type":"ADVISORY"},{"type":"REPORT","url":"https://bugzilla.suse.com/1248352"},{"type":"REPORT","url":"https://bugzilla.suse.com/1276254"},{"type":"REPORT","url":"https://bugzilla.suse.com/1276255"},{"type":"REPORT","url":"https://bugzilla.suse.com/1276256"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-68766"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-68767"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-68768"}],"affected":[{"package":{"name":"hashcat","ecosystem":"openSUSE:Leap 16.0","purl":"pkg:rpm/opensuse/hashcat&distro=openSUSE%20Leap%2016.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.2+git942-bp160.1.1"}]}],"ecosystem_specific":{"binaries":[{"hashcat":"7.1.2+git942-bp160.1.1","hashcat-devel":"7.1.2+git942-bp160.1.1","libhashcat7":"7.1.2+git942-bp160.1.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:22138-1.json"}}],"schema_version":"1.9.0"}