openSUSE 16: sequoia-sq / sequoia-sq-bash-completion / etc (openSUSE-RU-2026:22132-1)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
#
# The package checks in this plugin were extracted from
# openSUSE Security Update openSUSE-RU-2026:22132-1. The text itself
# is copyright (C) SUSE.
##

include('compat.inc');

if (description)
{
  script_id(370421);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/10/22");

  script_cve_id(
    "CVE-2026-93599",
    "CVE-2026-93600",
    "CVE-2026-93601",
    "CVE-2026-93602"
  );

  script_name(english:"openSUSE 16: sequoia-sq / sequoia-sq-bash-completion / etc (openSUSE-RU-2026:22132-1)");

  script_set_attribute(attribute:"synopsis", value:
"The remote openSUSE host is missing one or more security updates.");
  script_set_attribute(attribute:"description", value:
"The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the
openSUSE-RU-2026:22132-1 advisory.

    Changes in sequoia-sq:

    - Use crypto-openssl also for tests

    Update to version 1.5.0:

      * tool: Release v1.5.0.
      * tool: Fix link to README.
      * tool: Set a version for the sqz dependency.
      * Enable optimizations when building rust-crypto crates.
      * Update NEWS.
      * lib: Release v0.1.0.
      * Update Cargo.lock.
      * meta: Update link to documentation.
      * lib: Update README.
      * lib: Rename the high-level library to sqz.
      * lib: Fix documentation.
      * lib: Mention network_search in the lookup functions documentation.
      * lib: Mention lookup and lookup_by in the certify documentation.
      * lib: Mention lookup_by sign documentation.
      * lib: Document that calls don't need to specify secret key material.
      * lib: Fix docs.rs URL
      * meta: Add rustfmt.toml that disables formatting
      * lib: fix type infer error
      * lib: Pass Paths through as is.
      * lib: Preprocess the network when listing all bindings.
      * lib: Upgrade sequoia-wot.
      * lib: After running cert list, save the signature verification cache.
      * lib: Parallelize cert list.
      * lib: Pass the policy when getting the trust root or a shadow CA.
      * implement dumping of pqc artifacts
      * lib: Use an iterator instead of a slice.
      * lib: Avoid monomorphization in signer.
      * lib: Fix documentation.
      * tool: Fix documentation.
      * lib: Drop unnecessary imports in example.
      * lib: Add required clap features.
      * lib: Gate network support behind a feature.
      * Don't conflate inline and cleartext signatures.
      * lib: Document the signer module.
      * lib: Add unit tests to the signer module.
      * lib: Fix get_primary_keys's return type.
      * lib: Convert get_signing_key, etc. to use the builder pattern.
      * lib: Move decrypt_key to its own module.
      * lib: Rename keys module to signer.
      * lib: Refactor get_keys and associated functions.
      * lib: Improve prompt's documentation.
      * lib: Add a default prompt to Sequoia, don't require a prompt.
      * lib: Loosen Sized constraint.
      * lib: Make Prompt and PromptFactory Send and Sync.
      * lib: Change SequoiaBuilder::builder to consume self.
      * lib: Use explicit lifetimes with Context and Check.
      * Use more precise lifetimes when referencing Sequoia and Sq.
      * Replace generic lifetime names with more precise identifiers.
      * tool: Fix password prompt.
      * lib: Add PromptFactory.
      * tool: Drop Sq::local_trust_root.
      * lib: Change Ca to wrap a Cert instead of an Arc<LazyCert>.
      * lib: Add functionality for looking up certificates by email address.
      * lib: Add cert::CertProblem::ParseError.
      * tool: Don't wrap Sequoia::lookup.
      * lib: Improve lookup's documentation.
      * lib: Rename lookup to lookup_all.
      * lib: Don't write lints to stderr.
      * lib: Change lookup to use its own error type.
      * lib: Fix how Binding::cert looks up a certificate.
      * lib: Add an option to lookup certificates by subkey.
      * lib: Rename lookup's keyflags parameter to key_capabilities.
      * lib: Drop lookup's unused or_by_primary parameter.
      * lib: Fix key flags matching bug in Sequoia::lookup.
      * tool: Improve displaying possibly revoked certificates.
      * lib: Change lookup to take a single key handle.
      * lib: Improve key generate's documentation.
      * lib: Add unit tests for key generate.
      * lib: Avoid monomorphization in key generate.
      * lib: Rename Artifact to Outcome.
      * lib: Use impl IntoIterator in setters.
      * lib: Drop duplicated code.
      * lib: Implement Clone for a few data structures.
      * lib: Mark UserIDLint as non-exhaustive.
      * lib: Implement Clone for UserIDLint.
      * lib: Implement IntoIterator for network::search::Query.
      * lib: Change network search to return an Outcome on success.
      * lib: Change function to take an IntoIterator instead of a Vec.
      * lib: Avoid monomorphization in the network search functionality.
      * lib: Implement Clone for a few data structures.
      * lib: Make Response and SourceInfo clonable.
      * lib: Change cert list to always emit a Report.
      * lib: Change cert list to return an Outcome on success.
      * lib: Change cert list's getters to use iterators.
      * lib: Implement Clone for additional structs and enums.
      * lib: Change the decrypt functions to return an Outcome on success.
      * lib: Avoid monomorphization in the decrypt functionality.
      * lib: Change decrypt's getters to use iterators.
      * lib: Implement Clone for additional structs and enums.
      * lib: Change KeyStoreUnreachable to use a more precise error type.
      * lib: Add some additional unit tests for the verify functionality.
      * lib: Change the verify functions to return an Outcome on success.
      * lib: Change verify to avoid monomorphization.
      * lib: Improve key import's documentation.
      * lib: Make a parse error an operational error.
      * lib: Implement Clone for additional structs and enums.
      * lib: Respect SEQUOIA_HOME by default.
      * lib: Add import_cert to import a single certificate.
      * lib: Improve cert list's documentation.
      * lib: Make a parse error an operational error.
      * lib: Fix import to emit errors.
      * lib: Fix cert::import::Builder::import to return an Outcome.
      * lib: Change cert import's getters and setters to use iterators.
      * lib: Implement Clone for a few data structures.
      * lib: Fix Sequoia::trust_roots's cache.
      * lib: Improve certify's documentation.
      * lib: Rework certify's error handling.
      * lib: Add SystemError to pki::certify::{Error,Output}.
      * lib: Adjust certify::Error::CertificationError.
      * lib: Refactor how certify populates Outcome.
      * lib: Use impl IntoIterator in setters.
      * lib: Improve encrypt's documentation.
      * lib: Add some unit tests for the encrypt functionality.
      * lib: Align encrypt's signing error with sign's signing error.
      * lib: Drop encrypt::output::EncryptionFailed.
      * lib: Change encrypt to return an Outcome on success.
      * lib: Rename Encrypted to Report.
      * lib: Change the encrypt functionality to emit errors.
      * lib: Change encrypt to use its own error type.
      * lib: Implement Clone for prompt::Error.
      * lib: Use impl IntoIterator in setters.
      * lib: Avoid monomorphization in the encrypt functionality.
      * lib: Improve sign's documentation.
      * lib: Add some unit tests for the signing functionality.
      * lib: Drop sign::output::SigningFailed.
      * lib: Add missing `non_exhaustive`.
      * lib: Change the sign functions to return an Outcome on success.
      * lib: Fix comment.
      * lib: Rename Signed to Report.
      * lib: Change the sign functionality to emit errors.
      * lib: Change sign to use its own error type.
      * lib: Implement Clone for CertError, CertProblem and its variants.
      * lib: Avoid monomorphization in the sign functionality.
      * lib: Use impl IntoIterator in setters.
      * lib: Mark struct as non-exhaustive.
      * lib: Move types::Query et al. to cert::list.
      * lib: Make cert_list's queries parameter optional.
      * lib: Change list to take self, not &self.
      * tool: When merging keyrings, preserve the order of the certificates.
      * lib: Don't fail to generate a key if the shadow CAs are not usable.
      * lib: Avoid an unnecessary box.
      * lib: Drop the Sized bound in the impl of Prompt for &P.
      * lib: Implement Clone for pki::certify's error types.
      * lib: Change the cert import functions to return more information.
      * lib: Consider a missing autocrypt header to be an import error.
      * tool: Don't fail if the input to sq key import is empty.
      * Update h2.
      * lib: Improve cert::import::Output::ImportingFailed.
      * lib: Tighten key import's error reporting.
      * lib: Tighten cert import's error reporting.
      * lib: Change the key import functions to return more information.
      * lib: Change error type for a merged certificate.
      * lib: Adjust the semantics of key import's return type.
      * lib: Rework key::import::Builder::import_key.
      * lib: Rework key import's error handling.
      * lib: Move Error::StateDisabled to SystemError, drop Error.
      * lib: Add a function to import Certs.
      * lib: Add a separate error for emails with autocrypt headers.
      * lib: Rename import_certs to import_keyring.
      * lib: Improve cert import's documentation.
      * lib: Change when cert import returns an error.
      * lib: Rework cert import's error handling.
      * lib: Move constructors for high-level methods to a single impl block.
      * lib: Change verify to not require a stream.
      * lib: Change sign to not require a stream.
      * lib: Change pki certify to not require a stream.
      * lib: Change network search to not require a stream.
      * lib: Change encrypt to not require a stream.
      * lib: Change decrypt to not require a stream.
      * lib: Change cert import to not require a stream.
      * lib: Make pki certify's output parameter optional.
      * lib: Change pki::certify to return the certifications.
      * lib: Change the encrypt method to take a Writer.
      * lib: Change the sign methods to take a Writer.
      * lib: Change the decrypt methods to take an OptionalWriter.
      * lib: Change the verify methods to take an OptionalWriter.
      * lib: Generalize and dry out the destination output handling.
      * lib: Make network search's output parameter optional.
      * Update spin.
      * Update sequoia-openpgp.
      * Update crossbeam-epoch.
      * Forward allow-* crypto features.
      * Relax rusqlite dependency.
      * lib: Make key generate's output parameter more ergonomic.
      * lib: Dry out the Stream trait declarations.
      * tool: Add more cipher suites.
      * tool: Use the right sig as the template for a new direct key sig
      * tool: Add sq key generate --{encryption,signing}-algorithm.
      * lib: Provide more control over the algorithms used in key generation.
      * tool: Add type annotation.
      * Update openssl.
      * Update anyhow.
      * lib: Add a method to Binding to return the certificate.
      * lib: Add more conversion functions for FileStdinOrKeyHandle.
      * lib: Make Sequoia::cert_store_ private.
      * lib: Don't export Sequoia::hint or Sequoia::info.
      * lib: Make the transitional module private.
      * lib: Improve documentation for the lookup module.
      * lib: Make the lookup module public.
      * lib: Add some top-level documentation.
      * lib: Add some unit tests for the verify functionality.
      * lib: Change verify and decrypt to always emit a report.
      * lib: Dry out code.
      * lib: Tweak example.
      * lib: Implement Clone for most of verify's structs and enums.
      * lib: Improve documentation.
      * lib: Finish convertng verify to emit structured output.
      * lib: Change verify to also emit errors.
      * lib: Add a forwarder to verify::Stream for &mut T.
      * lib: Change verify to use its own error type.
      * tool: Don't use transitional function from library.
      * lib: Document network search.
      * lib: Add some unit tests to network::search.
      * lib: Always emit a report.
      * lib: Propagate errors.
      * lib: Check that the query is valid.
      * lib: Separate network search's presentation from its implementation.
      * lib: When configuring key servers, pass in the URI.
      * lib: Add functions for getting more shadow CAs.
      * lib: Implement Debug and Clone for Ca.
      * lib: Inline serialize_keyring.
      * lib: Inline import_or_emit.
      * lib: Inline Response::progress_bar.
      * lib: Inline Response::import_or_emit.
      * lib: Inline Response::collect.
      * lib: Change network::search to use its own Error type.
      * lib: Make the Source data structure public.
      * lib: Rename Method to Source.
      * lib: Implement Debug for Query.
      * lib: Add a source annotation to SystemError::CertStoreError.
      * lib: Move the op macro to the errors module.
      * lib: Change Sequoia::cert_store to return a SystemError.
      * lib: Move search's parameters to the builder.
      * lib: Change network search et al. to take `Query`s.
      * lib: Make network::search::Query and a few methods public.
      * lib: Dry out the network search code.
      * lib: Change network search functions to be methods.
      * lib: Make clap attribute feature gated
      * lib: Export version number from library
      * typo: cerItified
      * Move the implementation of sq network search et al. to the library.
      * Move http_client and related constants to the library.
      * Move ResourceRecordType to the library.
      * Move cert_exportable to the library.
      * lib: Don't export the password_cache field.
      * lib: Improve interface for setting session keys.
      * lib: Improve interface for setting secret keys.
      * lib: Improve interface for setting designated signers.
      * lib: Improve and fix documentation for decrypt.
      * lib: Add unit tests for decrypt.
      * lib: Implement From<openpgp::crypto::SessionKey> for SessionKey.
      * lib: Extract the correct error type from the decryption helper.
      * lib: Rename MissingSessionKey to InvalidSessionKey.
      * lib: Fix typo.
      * lib: Change decrypt to use its own error type.
      * lib: Change cert_list to also emit errors on the stream object.
      * lib: Change cert_store_or_else to return SystemError
      * lib: Implement Clone for SystemError.
      * lib: Change cert::list::Builder::list to take &self.
      * lib: Add SystemError::CertStoreDisabled
      * lib: Convert Sequoia::lookup et al. to use the builder pattern.
      * lib: Add documentation for cert_list.
      * lib: Implement Debug for cert_list's output data structures.
      * lib: Move output-related data structures to the output module.
      * lib: Add some unit tests for Sequoia::cert_list.
      * lib: Mark Query and QueryKind as non-exhaustive.
      * lib: Add some additional constructors for Query.
      * Split the Query type, and move the sq-specific part back to sq.
      * lib: Change cert_list to take an interator instead of a Vec.
      * lib: Change cert_list to always emit the report.
      * lib: Change list_cert to not error out if nothing matches.
      * lib: Change list to use its own error type.
      * lib: Rename list::Builder::execute to list.
      * lib: Change Sequoia::list to return a builder.
      * lib: Remove the non-stream variant of cert_list.
      * lib: Rename Sequoia::list to Sequoia::cert_list.
      * lib: Re-initialize the WoT data structures when they are out of date.
      * lib: Return an Arc<WotStore> instead of a &WotStore.
      * lib: Add Sequoia::shadow_ca_generated_on.
      * lib: Add utility function to get the generated on host shadow CA.
      * lib: Add methods to look up shadow CAs.
      * lib: Return more information from Sequoia::local_trust_root.
      * lib: Move Sequoia::local_trust_root to its own module.
      * lib: Move Sequoia::have_secret_key.
      * lib: Drop Sequoia::lookup_by_userid.  It's unused.
      * lib: Fix spelling.
      * lib: Set default revocable value to true.
      * lib: Improve control char escaping
      * lib: Change Builder setters to take `self` instead of `&mut self`.
      * lib: Make SystemError global.
      * lib: Add examples to the key generate documentation.
      * lib: Change Sequoia::key_generate to emit structured output.
      * lib: Use a wrapper type of the return type.
      * tool: Include comments in sq cert export
      * tool: canonicalize Ord and PartialOrd impls for Association
      * tool: silence clippy error for potentially mutable Map key types
      * tool: avoid allocating a temporary PathBuf just for a comparison
      * clippy: silence two false positive unnecessary_to_owned warnings
      * tool: avoid copying Url as String and convert to &str directly
      * tool: avoid function calls in `Result::expect` arguments
      * tool/log: allow for more efficient thread-local value initialization
      * tool: drop to_string() calls for format! args that implement Display
      * tool: fix formatting to avoid leaking comments into doc strings
      * clippy: allow two types with interior mutability for BTreeSet keys
      * lib: avoid allocating a temporary PathBuf just for a comparison
      * lib: drop to_string() calls for format! args that implement Display
      * lib: avoid potentially panicking integer cast
      * lib/log: allow for more efficient thread-local value initialization
      * clippy: add default lint configuration
      * meta: enable MSRV-aware dependency resolver by default
      * Update nettle-sys to fix building with LLVM / clang 22
      * meta: Make fabio a committer.
      * Convert key approvals update into builder pattern
      * Move key-approvals-update to lib
      * lib: Convert key approvals list into builder pattern
      * Move key-approvals-list to lib
      * lib: Change generate to use its own error type.
      * lib: Return the linted user ID.
      * CI: use new registry domain name
      * lib: Change Sequoia::pki_certify to emit structured output.
      * lib: Change key_generate to return the generated certificate.
      * lib: Implement Debug for CertificationDiff.
      * tool: Skip lint summary subsections when category is empty
      * tool: Fix output file's permissions.
      * Mark user IDs added by sq key userid add as authenticated
      * lib: Convert expire to be a method and use the builder pattern.
      * Move the implementation of sq key expire to the library.
      * lib: Extend get_subkeys to allow skipping the primary key.
      * lib: Extract utility function.
      * lib: Don't export transitional functions.
      * lib: Convert key::revoke to be a method and use the builder pattern.
      * tool: Rename function.
      * Move the implementation of sq key revoke to the library.
      * lib: Convert userid::revoke to be a method and use the builder pattern.
      * Move the implementation of sq key userid revoke to the library.
      * lib: Convert subkey::revoke to be a method and use the builder pattern.
      * Move the implementation of sq key subkey revoke to the library.
      * Move revocation support trait and function to the library.
      * lib: Convert userid::add to be a method and use the builder pattern.
      * Move the implementation of sq key userid add to the library.
      * lib: Convert subkey::add to be a method and use the builder pattern.
      * Move the implementation of sq key subkey add to the library.
      * lib: Move PasswordPolicy.
      * lib: Fix documentation.
      * Move the sq key generate implementation to the library.
      * lib: Add CheckNewPassword::optional.
      * tool: Fix typo.
      * lib: Mark key::import::Builder::import_key as public.
      * Move the certify_generated function to the library.
      * Move the user ID linting functionality to the library.
      * lib: Rework the certification diff functionality.
      * lib: Add Expiration::from_operation_duration.
      * lib: Fix comment.
      * lib: Implement From<usize> for TrustAmount.
      * lib: Implement PartialEq and Eq for TrustAmount.
      * lib: Convert certify to be a method and use the builder pattern.
      * lib: Make some functions const.
      * lib: Improve error message when unable to verify a message.
      * tool: Fix spelling.
      * Gracefully deal with 404 HTTP result codes
      * Treat certificates passed by fingerprint as authenticated
      * Ignore revoked user IDs when updating approvals
      * When displaying a certificate, sort the subkeys.
      * tool: Don't panic if write fails
      * Update keccak.
      * Fix small documentation issues
      * meta: Add Malte to the list of authors.
      * tool: Restrict file permissions on sensitive output
      * Update bytes.
      * keystore: Upgrade capnp.
      * Fix small typo
      * CI: switch docker-image-push job to use dind
      * Relax dirs dependency.
      * tool: Avoid unnecessarily validating a certificate.
      * tool: Don't panic on not existing cert
      * lib: Correctly handle listing missing certificates.
      * lib: Display key expiration time of 0 as 'never'
      * lib: Display signature expiration time of 0 as 'never'
      * tool: Fix sq verify's documentation.
      * Improve temporary file handling.
      * Update reqwest.
      * Update sequoia-openpgp and sequoia-policy-config.
      * meta: Update MSRV to 1.85.
      * meta: Update signing policy.
      * Move certification-related fucntionality to the library.
      * lib: Change Sequoia::key_import to emit structured output.
      * lib: Add functions to best-effort clone errors.
      * lib: Fix the implementation of AddAssign for ImportStats.
      * tool: When printing errors, specially handle more errors.
      * tools: If the key store is not available, return a clap error.
      * tool: Allow sq packet {armor,dearmor} to emit secret key material.
      * Move key import to the library.
      * lib: Don't export the verification helper.
      * lib: Don't export the decryption helper.
      * tool: Drop the packet dumper.  Use the version from the library.
      * lib: Reenable decryption in the packet dumper.
      * lib: Resynchronize the packet dumper implementations.
      * tool: Update indicatif from 0.17 to 0.18
      * lib: Fix sq inspect to escape control characters in user IDs.
      * lib: Change Sequoia::import to emit structured output.
      * lib: Emit a message when a message is malformed.
      * lib: Implement decrypt::Stream for &mut decrypt::Stream.
      * lib: Improve decrypt's tracing output.
      * lib: Fix wording.
      * lib: The decrypt stream doesn't need to impl the verify stream.
      * Move certificate importing to the library.
      * Move import statistics to the library.
      * Move provenance management to the library.
      * Move `MyAsRef` to the library.
      * meta: Add Malte as a committer.
      * lib: Fix comment.
      * Move signing to the library, change it to emit structured output.
      * tool: Add FileOrStdout::create_safe_overwrite.
      * Move the sign Mode type to the library.
      * Move PartFileWriter to the library.
      * lib: Change Sequoia::encrypt to emit structured output.
      * lib: Implement From<&EncryptPurpose> for KeyFlags.
      * lib: Don't sign with revoked certificates.
      * lib: Change Sequoia::get_keys et al. to use structured errors.
      * Move Sq::get_signer, etc. to the library.
      * Move encryption to the library.
      * tool: Modify Prompt to count the passwords.
      * Move the method Sq::have_secret_key to the library.
      * Move the CompressionMode type to the library.
      * Move the EncryptPurpose type to the library.
      * lib: When inspecting a key, indicate if an algorithm is not supported.
      * lib: When inspect a key, also show the elliptical curve, if any.
      * tool: When dumping a key, indicate if an algorithm is not supported.
      * tool: When dumping a key, also show the elliptical curve, if any.
      * lib: Change Sequoia::decrypt et al. to emit structured output.
      * lib: Extend the prompting framework to allow checking the response.
      * lib: Rename imports.
      * lib: Improve the semantics of designated signers.
      * lib: Make decrypt and decrypt_unwrap methods on Sequoia.
      * Move decryption to the library.
      * lib: Copy emit_cert to the library.
      * lib: Implement Debug for PreferredUserID.
      * lib: Change Sequoia::verify to emit structured output.
      * lib: Improve the semantics of designated signers.
      * lib: Rename VHelper to VerificationHelper.
      * lib: Fix and improve some comments.
      * lib: Export our own Result type.
      * lib: Use a getter; don't expose the bare field.
      * lib: Rename sq to sequoia.
      * Move signature verification to the library.
      * lib: Implement Prompt for Box<dyn Prompt> and &Prompt.
      * lib: Silence new rustc warning about implicit lifetimes.
      * lib: Silence new rustc warning about unnecessary parentheses.
      * Move Sequoia::decrypt_key to the library.
      * lib: Add user prompting to the library.
      * lib: Add helper function, Sequoia::self_userid.
      * Move the password cache to the library.
      * Move the TrustThreshold type to the library.
      * Move the inspect implementation to the library.
      * lib: Partially copy the packet dumper to the library.
      * Move the SessionKey type to the library.
      * Move the best User ID functionality to the library.
      * Move the certificate look up functionality to the library.
      * Move the FileOrStdin and FileStdinOrKeyHandle types to the library.
      * Copy the StdinWarning type to the library.
      * Move the PreferredUserID type to the library.
      * lib: Fix spelling.
      * lib: Rework how Sequoia::list handles output.
      * lib: Add a builder for calling Sequoia::list.
      * Move certificate listing and authentication to the library.
      * Copy some supporting types and functions to the library.
      * lib: Move the policy into Config.
      * lib: Reorganize Config and ConfigFile.
      * lib: Don't implement PartialEq and Eq for Config.
      * Move Convert to the library.
      * Move ca_creation_time to the library.
      * Move Safe to the library.
      * Move TrustAmount to the library.
      * Move Query and QueryKind to the library.
      * Fix spelling.
      * lib: Improve Config's and ConfigFile's documentation.
      * lib: Add function to read the default configuration file.
      * lib: Remove unused function ConfigFile::verify.
      * lib: Rework ConfigFile.
      * lib: Fix ConfigFile::default_config.
      * lib: Don't take ownership when a reference will do.
      * lib: Move help augmentations to sq.
      * lib: Track the source of a configuration value.
      * lib: Add getters for the configuration key and values.
      * lib: Add getters for the various configuration settings.
      * lib: Allow setting pki.vouch.certifier-self to the empty string.
      * tool: Fix the configuration key for key servers in the help text.
      * tool: Fix the configuration key for the key generation profile.
      * lib: Check that the default config file is the default config.
      * lib: Model the verbosity more precisely.
      * Fix the help text for the --verbose and --quiet flags.
      * lib: Fix the version reported in the template.
      * lib: Rename constants to include a default prefix.
      * lib: Don't hard code the default for network search dane usage.
      * lib: Don't hard code the default for network search wkd usage.
      * lib: Don't hard code the default for network search iterations.
      * Move the configuration management to the library crate.
      * Move the Expiration type to the library crate.
      * Move the Profile wrapper type to the library crate.
      * Move the CipherSuite wrapper type to the library crate.
      * Move the Time type to the library crate.
      * Move the SECONDS_IN_DAY and SECONDS_IN_YEAR consts to the library.
      * lib: Rename Time to Clock to avoid a name collision.
      * tool: Explicitly goodlist PreferredAEADCiphersuites for keeping.
      * lib: Move the key store into struct Sequoia.
      * tool: Use re-exports from the sequoia crate.
      * lib: Move the cert store into struct Sequoia.
      * lib: Move time into struct Sequoia.
      * lib: Move the policy to struct Sequoia.
      * tool: Move the policy into struct Sq ...

  Please note that the description has been truncated due to length. Please refer to vendor advisory for the full
description.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://bugzilla.suse.com/1282203");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-93599");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-93600");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-93601");
  script_set_attribute(attribute:"see_also", value:"https://www.suse.com/security/cve/CVE-2026-93602");
  script_set_attribute(attribute:"solution", value:
"Update the affected sequoia-sq, sequoia-sq-bash-completion, sequoia-sq-fish-completion and / or sequoia-sq-zsh-
completion packages.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:H/Au:N/C:N/I:C/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:U");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-93602");
  script_set_attribute(attribute:"cvss4_score_source", value:"CVE-2026-93599");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/09/18");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/10/19");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/10/22");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:sequoia-sq");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:sequoia-sq-bash-completion");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:sequoia-sq-fish-completion");
  script_set_attribute(attribute:"cpe", value:"p-cpe:/a:novell:opensuse:sequoia-sq-zsh-completion");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:novell:opensuse:16.0");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"SuSE Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled", "Host/cpu", "Host/SuSE/release", "Host/SuSE/rpm-list");

  exit(0);
}


include('rpm.inc');

if (!get_kb_item('Host/local_checks_enabled')) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);
var os_release = get_kb_item('Host/SuSE/release');
if (isnull(os_release) || os_release =~ "^(SLED|SLES)") audit(AUDIT_OS_NOT, 'openSUSE');
var _os_ver = pregmatch(pattern: "^SUSE([\d.]+)", string:os_release);
if (isnull(_os_ver)) audit(AUDIT_UNKNOWN_APP_VER, 'openSUSE');
_os_ver = _os_ver[1];
if (os_release !~ "^(SUSE16\.0)$") audit(AUDIT_OS_RELEASE_NOT, 'openSUSE', '16.0', os_release);
if (!get_kb_item("Host/SuSE/rpm-list")) audit(AUDIT_PACKAGE_LIST_MISSING);

var cpu = get_kb_item('Host/cpu');
if (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);
if ('x86_64' >!< cpu && cpu !~ "^i[3-6]86$" && 's390' >!< cpu && 'aarch64' >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, 'openSUSE ' + _os_ver, cpu);

var pkgs = [
    {'reference':'sequoia-sq-1.5.0-bp160.1.1', 'cpu':'aarch64', 'release':'SUSE16.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'sequoia-sq-1.5.0-bp160.1.1', 'cpu':'x86_64', 'release':'SUSE16.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'sequoia-sq-bash-completion-1.5.0-bp160.1.1', 'release':'SUSE16.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'sequoia-sq-fish-completion-1.5.0-bp160.1.1', 'release':'SUSE16.0', 'rpm_spec_vers_cmp':TRUE},
    {'reference':'sequoia-sq-zsh-completion-1.5.0-bp160.1.1', 'release':'SUSE16.0', 'rpm_spec_vers_cmp':TRUE}
];

var flag = 0;
foreach package_array ( pkgs ) {
  var reference = NULL;
  var _release = NULL;
  var _cpu = NULL;
  var rpm_spec_vers_cmp = NULL;
  if (!empty_or_null(package_array['reference'])) reference = package_array['reference'];
  if (!empty_or_null(package_array['release'])) _release = package_array['release'];
  if (!empty_or_null(package_array['cpu'])) cpu = package_array['cpu'];
  if (!empty_or_null(package_array['rpm_spec_vers_cmp'])) rpm_spec_vers_cmp = package_array['rpm_spec_vers_cmp'];
  if (reference && _release) {
    if (rpm_check(release:_release, cpu:_cpu, reference:reference, rpm_spec_vers_cmp:rpm_spec_vers_cmp)) flag++;
  }
}

if (flag)
{
  security_report_v4(
      port       : 0,
      severity   : SECURITY_WARNING,
      extra      : rpm_report_get()
  );
  exit(0);
}
else
{
  var tested = pkg_tests_get();
  if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);
  else audit(AUDIT_PACKAGE_NOT_INSTALLED, 'sequoia-sq / sequoia-sq-bash-completion / etc');
}