OPENSUSE-SU-2026:20798-1 Security update for trivy

This update for trivy fixes the following issues: Update to version 0.68.2: Security fixes: - CVE-2024-3817: hashicorp/go-getter: argument injection when fetching remote default git branches bsc1227010. - CVE-2024-45337: golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.13.61 security and extras update

Red Hat OpenShift Container Platform release 4.13.61 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.13. Red Hat Product Security has rated this update as having a security impact of Low...

CVE-2024-33531

cdbattags lua-resty-jwt 0.2.3 allows attackers to bypass all JWT-parsing signature checks by crafting a JWT with an enc header with the value A256GCM...

Important: grafana security update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fixes: golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing CVE-2025-30204 For more details about the security issues, including the impact, a CVSS...

Important: docker

Issue Overview: The net/http package accepted data in the chunked transfer encoding containing an invalid chunk-size line terminated by a bare LF. When used in conjunction with a server or proxy which incorrectly interprets a bare LF in a chunk extension as part of the extension, this could permi...

Security update for etcd

This update for etcd fixes the following issues: Update to version 3.5.21: CVE-2025-30204: Fixed a bug that could allow excessive memory allocation during header parsing in jwt-go. bsc1240515 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST...

AZL-59229 CVE-2025-30204 affecting package prometheus for versions less than 2.37.9-3

golang-jwt is a Go implementation of JSON Web Tokens. Starting in version 3.2.0 and prior to versions 5.2.2 and 4.5.2, the function parse.ParseUnverified splits via a call to strings.Split its argument which is untrusted data on periods. As a result, in the face of a malicious request whose...

AZL-77520 CVE-2025-30204 affecting package kubevirt for versions less than 0.59.0-38

golang-jwt is a Go implementation of JSON Web Tokens. Starting in version 3.2.0 and prior to versions 5.2.2 and 4.5.2, the function parse.ParseUnverified splits via a call to strings.Split its argument which is untrusted data on periods. As a result, in the face of a malicious request whose...

AZL-57135 CVE-2025-27144 affecting package gh for versions less than 2.62.0-7

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE...

CVE-2024-33531

cdbattags lua-resty-jwt 0.2.3 allows attackers to bypass all JWT-parsing signature checks by crafting a JWT with an enc header with the value A256GCM...

CVE-2024-33531

cdbattags lua-resty-jwt 0.2.3 allows attackers to bypass all JWT-parsing signature checks by crafting a JWT with an enc header with the value A256GCM...

OESA-2021-1269 hadoop security update

Apache Hadoop is a framework that allows for the distributed processing of large data sets across clusters of computers using simple programming models. It is designed to scale up from single servers to thousands of machines, each offering local computation and storage. Security Fixes: Connect2id...

Denial Of Service (DoS)

nimbus-jose-jwt is vulnerable to denial of service. Uncaught exceptions while parsing a JWT allow an attacker to submit a malicious JWT which could result in an application crash, potentially disclosing confidential information or a potential authentication bypass...