{"id":"openSUSE-SU-2026:22227-1","summary":"Security update for go-containerregistry","details":"This update for go-containerregistry fixes the following issues:\n\nChanges in go-containerregistry:\n\n- update vendor.tar to address:\n  * bsc#1288488, CVE-2026-116591: github.com/klauspost/compress/zstd:\n    crafted ~27 KB two-block zstd frame makes DecodeAll and the\n    streaming decoder panic\n\n- update to 0.22.1:\n  * Reject non-canonical IP literals in all SSRF guards\n  * daemon: fix stale docker/docker reference in WithClient docs\n  * build(deps): bump the go-deps group across 2 directories with\n    4 updates\n  * authn: do not overwrite AuthConfig.Auth when username and\n    password are empty\n  * build(deps): bump the actions group across 1 directory with 8\n    updates\n  * Support pulling images by sha512 digest\n  * Allow empty label and annotation values in crane mutate\n  * fix(build): Use dependencies.gitSource in cloudbuild_v2.yaml\n  * validate: support index attestation manifests and empty\n    configs\n  * name: improve error when parsing a reference with a URL\n    scheme\n  * fix(build): install binaries to /ko-app and add to PATH\n  * fix(release): honor declared Go toolchain\n  * remote: apply checkRedirectSSRF to writer-side HTTP clients\n  * flatten: preserve config and layer media types when\n    flattening\n  * fix(mutate): make Time layer updates lazy\n  * build(deps): bump the go-deps group across 2 directories with\n    3 updates\n  * remote: copy manifest annotations to referrers fallback tag\n    descriptors\n\n- update to 0.22.0:\n  * mutate: let Time and Canonical take tarball.LayerOption\n  * build: add multi-architecture Cloud Build configurations for\n    crane, gcrane, and krane\n  * remote: resolve push-check credentials against the repository\n  * Allow single-character repository paths\n  * fix: add missing substitutions and workspace cleanup to new\n    build files\n  * remote: retry failed Puller and Pusher initialization\n  * build(deps): bump the actions group across 1 directory with 8\n    updates\n  * build(deps): bump the go-deps group across 1 directory with 3\n    updates\n  * go.mod: bump Go version + add toolchain directive to replace\n    .go-version file\n  * fix: Fix new build options and provenance\n  * fix(build): unify new build flow into cloudbuild_v2.yaml\n\n- update to 0.21.8 (bsc#1283692, CVE-2026-63209):\n  * The artifacts attached to this release are missing SLSA\n    provenance, see #2390.\n  * build(deps): bump the go-deps group across 1 directory with 3\n    updates\n  * build(deps): bump golang.org/x/crypto from 0.45.0 to 0.52.0\n    in /cmd/krane\n  * build(deps): bump golang.org/x/crypto from 0.50.0 to 0.52.0\n    in /pkg/authn/k8schain\n  * build(deps): bump golang.org/x/net from 0.49.0 to 0.55.0 in\n    /pkg/authn/kubernetes\n  * build(deps): bump the go-deps group across 3 directories with\n    7 updates\n  * build(deps): bump the actions group across 1 directory with 5\n    updates\n  * Reject unsafe Windows archive paths in Extract\n  * feat(goreleaser): add loong64 build support for\n    crane/gcrane/krane\n  * Document tag and digest reference semantics\n  * remote: release pull limiter slot when body is read to EOF\n  * tarball: bounds-check layer index in uncompressed\n    LayerByDiffID\n  * authn: read Podman auth from XDG config\n  * transport: per-host bearer token exchange on cross-host\n    redirect\n  * mutate: bounds-check layer index when building rebase\n    addendums\n  * fix(daemon): copy ExposedPorts from source config in\n    computeImageConfig\n  * feat(remote): add WithReferrersTagFallback option\n  * mutate: apply opaque-directory whiteouts (.wh..wh..opq) in\n    Extract\n  * tarball: use correct file extension for zstd/uncompressed\n  * build(deps): bump github.com/moby/moby/client from 0.5.0 to\n    0.5.1 in the go-deps group across 1 directory\n  * actions: update actions to be pinned by hash\n  * Bump go version to 1.26.5\n\n- update to 0.21.7:\n  * tarball: return error instead of panicking on missing\n    rootfs.diff_ids\n  * gcrane: honor --platform flag in copy\n  * mutate: verify layer digests in Extract and Time\n  * tarball: close layer readers during Write\n  * build(deps): bump the actions group across 1 directory with 2\n    updates\n  * build(deps): bump github.com/docker/cli from\n    29.4.3+incompatible to 29.5.2+incompatible in the go-deps\n    group across 1 directory\n  * BUGFIX: Fail with error when read exceeds maximum\n  * build(deps): bump the actions group across 1 directory with 2\n    updates\n  * fix(name): anchor loopback registry detection\n  * Reject symlinks in OCI layout blobs\n  * fix(crane): avoid creating export tar on pull failure\n  * feat(kubernetes): allow ignoring pull secrets\n  * fix(name): preserve localhost registry references\n  * pkg/registry: export ErrNotFound\n  * pkg/registry: export RedirectError\n  * build(deps): bump the go-deps group across 1 directory with 2\n    updates\n  * build(deps): bump the actions group across 1 directory with 2\n    updates\n  * fix: prevent SSRF in google.List() pagination\n  * internal/gzip: fix goroutine leak in ReadCloserLevel\n  * fix(transport): apply refreshed bearer token after cross-host\n    redirect\n  * build(deps): bump the go-deps group across 3 directories with\n    4 updates\n  * fix(tarball): normalize paths when matching files\n  * transport: do not re-attach bearer token after cross-host\n    redirect\n  * Bump CI go version to 1.26.4\n- update to 0.21.6:\n  * fix: update dependencies to use new azure sdk components\n  * transport: restore resp.Body in retryError so CheckError can\n    parse it\n  * pkg/registry: return 202 Accepted for PATCH chunk uploads\n  * Follow OCI distribution spec for artifactType and annotations\n  * actions: attach Codecov token to coverage tests on main\n  * remote: use DeleteScope (with \"delete\" action) for manifest\n    deletion\n  * remote: limit concurrent layer pulls\n  * pkg/registry: reject corrupt disk blobs\n  * mutate: close layer readers during export\n  * crane/flatten: preserve image media type when flattening\n  * build(deps): bump goreleaser/goreleaser-action from 7.0.0 to\n    7.2.1 in the actions group across 1 directory\n  * build(deps): bump go.opentelemetry.io/otel from 1.36.0 to\n    1.41.0\n  * build(deps): bump the go-deps group across 3 directories with\n    6 updates\n  * Replace go-homedir with os.UserHomeDir\n  * pkg/name: only treat .localhost as non-HTTPS, not .local\n  * transport: block unspecified IPs (0.0.0.0, ::) in\n    validateRealmURL\n  * test(mutate): add Extract round-trip test for filesystem\n    object preservation\n  * experiments: remove deprecated support for estargz\n  * build(deps): bump aws-actions/configure-aws-credentials from\n    6.1.0 to 6.1.1 in the actions group\n  * fix: limit HTTP response body reads to prevent OOM\n  * build(deps): bump the go-deps group across 3 directories with\n    6 updates\n  * transport: block redirects from token server to private/link-\n    local addresses (SSRF fix)\n  * pkg/v1/mutate: preserve relative symlinks that stay within\n    rootfs in Extract\n  * validate: skip non-layer layers\n  * remote: validate foreign layer URLs to prevent SSRF (fixes\n    #2259)\n  * remote: block SSRF via private-IP Location headers in blob\n    uploads\n  * fix(mutate): preserve config blob and layers for non-Docker\n    OCI artifacts\n  * fix: preserve per-occurrence layer identity in\n    mutate.Image.Layers()\n  * transport: retry HTTP 429 (Too Many Requests)\n  * transport: allow bearer realm at same host:port as registry\n  * Update go version to 1.26.3\n- update to 0.21.5:\n  * Bump docker/cli v29.4.0, moby/api v1.54.1, moby/client v0.4.0\n  * update to Go 1.26.2\n  * Bump aws-actions/configure-aws-credentials from 6.0.0 to\n    6.1.0 in the actions group across 1 directory\n  * build(deps): bump golang.org/x/tools from 0.43.0 to 0.44.0 in\n    the go-deps group across 1 directory\n  * **Full Changelog**: https://github.com/google/go-\n    containerregistry/compare/v0.21.4...v0.21.5\n- update to 0.21.4:\n  * go.mod: do not make a viral minimum go version\n  * Avoid pruning absolute links from extracted and flattened\n    images\n  * Bump the go-deps group across 3 directories with 5 updates\n  * fix: update to go1.25.8, and use separate .go-version file\n  * Bump CI go version to 1.26.1\n  * Bump codecov/codecov-action from 5.5.2 to 5.5.3 in the\n    actions group\n  * fork distribution client v3 auth-challenge as an internal\n    package (squashed)\n  * transport: validate Bearer realm URL to prevent SSRF\n  * revert path traversal and symlink escape from #2227\n  * Fix pkg/v1/google/auth tests for arm64\n  * goreleaser: Update goreleaser config and GH action\n\n- update to 0.21.3:\n  * Adds local file support to the `crane index` subcommand\n  * migrate to github.com/moby/moby modules\n  * Bump the go-deps group across 4 directories with 7 updates\n  * Bump goreleaser/goreleaser-action from 6.4.0 to 7.0.0 in the\n    actions group\n  * mutate: reject path traversal and symlink escape in Extract\n  * tarball: detect symlink cycles in extractFileFromTar\n  * bump golang to 1.25.7\n- update to 0.21.2:\n  * Better handle redirects to https in ping\n  * **Full Changelog**: https://github.com/google/go-\n    containerregistry/compare/v0.21.1...v0.21.2\n\n- update to 0.21.1:\n  * Add WithFileBufferedOpener for file-backed daemon image\n    buffering\n  * crane: fix case in auth response json\n- update to 0.21.0:\n  * fix(mutate): don't skip dir replacements via whiteout in\n    export\n  * Improve performance of v1.NewHash\n  * Bump the actions group across 1 directory with 4 updates\n  * Bump the root-deps group across 1 directory with 7 updates\n  * Fix error messages in crane_test.go\n  * Bump go version across packages to 1.25.6\n  * Join go.mod dependency updates\n  * Bump the go-deps group across 3 directories with 3 updates\n  * Disable taint gosec lints\n  * Update go version used in goreleaser\n- update to 0.20.7:\n  * Fix ArgsEscaped lint directive\n  * transport: Fix broken links to distribution docs\n  * fix(remote): using customized retry predicate func if\n    provided\n  * Adding docker file\n  * crane: Add timestamp to flatten layer\n  * feat(remote): pass retryBackoff option to transport\n  * Expose clobber refusal error\n  * Build artifacts for riscv64\n  * Update dependencies and deprecate DockerVersion field\n\n- update to 0.20.7:\n  * Fix ArgsEscaped lint directive\n  * transport: Fix broken links to distribution docs\n  * fix(remote): using customized retry predicate func if\n    provided\n  * Adding docker file\n  * crane: Add timestamp to flatten layer\n  * feat(remote): pass retryBackoff option to transport\n  * Expose clobber refusal error\n  * Build artifacts for riscv64\n  * Update dependencies and deprecate DockerVersion field\n\n\n- update to 0.20.6:\n  * Ensure that tag name is not empty if name contains colon\n  * Bump some deps\n- update to 0.20.5:\n  * build(deps): bump docker/docker to v28.0.0+incompatible\n  * Migrate linter to v2\n  * bump go version + bump deps\n  * implement TextMarshaler/JSONMarshaler more consistently\n  * Update CodeQL permissions\n  * Update goreleaser permissions\n  * Update provenance action in release\n  * Update validator action\n\n- CVE-2025-22868: golang.org/x/oauth2/jws: Unexpected memory consumption\n  during token parsing in golang.org/x/oauth2 (bsc#1239277)\n\n- update to 0.20.3:\n  * remote/transport: Make bearer transport go-routine-safe\n  * Expose compare package\n  * fix: redact.URL uses (*URL).Redacted to omit basic-auth\n    password\n  * bump actions to latest\n  * don't pin chainguard-dev/actions\n  * Check for 406 status code when handling referrers API\n    endpoint response\n  * mutate: Create a defensive annotations copy\n  * Detect zstd in crane append\n  * bump deps using hack/bump-deps.sh\n- update to 0.20.2:\n  * deps: bump docker dep\n","modified":"2026-11-04T14:15:08.553856052Z","published":"2026-11-03T18:16:30Z","related":["CVE-2025-22868","CVE-2026-116591","CVE-2026-63209"],"upstream":["CVE-2025-22868","CVE-2026-116591","CVE-2026-63209"],"references":[{"type":"ADVISORY"},{"type":"REPORT","url":"https://bugzilla.suse.com/1239277"},{"type":"REPORT","url":"https://bugzilla.suse.com/1283692"},{"type":"REPORT","url":"https://bugzilla.suse.com/1288488"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2025-22868"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-116591"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-63209"}],"affected":[{"package":{"name":"go-containerregistry","ecosystem":"openSUSE:Leap 16.0","purl":"pkg:rpm/opensuse/go-containerregistry&distro=openSUSE%20Leap%2016.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.22.1-bp160.1.1"}]}],"ecosystem_specific":{"binaries":[{"gcrane":"0.22.1-bp160.1.1","crane":"0.22.1-bp160.1.1","crane-fish-completion":"0.22.1-bp160.1.1","gcrane-bash-completion":"0.22.1-bp160.1.1","gcrane-fish-completion":"0.22.1-bp160.1.1","go-containerregistry":"0.22.1-bp160.1.1","gcrane-zsh-completion":"0.22.1-bp160.1.1","crane-zsh-completion":"0.22.1-bp160.1.1","crane-bash-completion":"0.22.1-bp160.1.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:22227-1.json"}}],"schema_version":"1.9.2"}