{"id":"openSUSE-SU-2026:22201-1","summary":"Security update for hauler","details":"This update for hauler fixes the following issues:\n\nChanges in hauler:\n\n- update vendor:\n  * CVE-2026-114437: github.com/go-chi/chi/v5: client IP spoofing in\n    `ClientIPFromXFF` via `X-Forwarded-For (bsc#1287881)\n\n- update to 2.1.2 (bsc#1285270, CVE-2026-78669):\n  * It fixes credential and presigned url leaks, local chart\n    handling, haul formats from `--filename`, and `hauler store\n    copy` with image-type files and cosign bundles. It adds\n    `hauler`, `hauler-dev`, and `hauler@` homebrew casks, and it\n    is the first release published through them. It also bumps go\n    to `1.27.2`.\n","modified":"2026-11-01T17:23:31.023551297Z","published":"2026-10-28T15:26:29Z","related":["CVE-2026-114437","CVE-2026-78669"],"upstream":["CVE-2026-114437","CVE-2026-78669"],"references":[{"type":"ADVISORY"},{"type":"REPORT","url":"https://bugzilla.suse.com/1285270"},{"type":"REPORT","url":"https://bugzilla.suse.com/1287881"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-114437"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-78669"}],"affected":[{"package":{"name":"hauler","ecosystem":"openSUSE:Leap 16.0","purl":"pkg:rpm/opensuse/hauler&distro=openSUSE%20Leap%2016.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.2-bp160.1.1"}]}],"ecosystem_specific":{"binaries":[{"hauler":"2.1.2-bp160.1.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:22201-1.json"}}],"schema_version":"1.9.2"}