OPENSUSE-SU-2026:21072-1

Advisory lineage Upstream: 7 Downstream: 0
Published: 26 Jun 2026, 09:25
Last modified:30 Jun 2026, 18:24

Vulnerability Summary

Overall Risk (default)
minimal
0/100
CVSS Score
No data
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

26 Jun 2026, 09:25
Published
Vulnerability first disclosed
30 Jun 2026, 18:24
Last Modified
Vulnerability information updated

Description

Security update for trivy This update for trivy fixes the following issues Update to version 0.71.2: - CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to DoS via infinite loops, panics or resource consumption (bsc#1267268). - CVE-2026-46680: github.com/containerd/containerd/v2/pkg/oci: containerd user ID handling bypass allows runAsNonRoot evasion (bsc#1268356). - CVE-2026-47262: github.com/containerd/containerd/v2/pkg/oci: Denial of Service (DoS) condition via a maliciously crafted image (bsc#1268440). - CVE-2026-50195: containerd: fails to validate the image references specified within a checkpoint image's configuration (bsc#1268399). - CVE-2026-53488: containerd: CRI plugin propagates labels from an image config to a container without validation (bsc#1268400). - CVE-2026-53489: containerd: CRI plugin restores container.log from a checkpoint image without validating a symlinked path (bsc#1268404). - CVE-2026-53492: containerd: improperly trusts Container Device Interface (CDI) annotations found within untrusted checkpoint image metadata during container restoration (bsc#1268403). Changes for trivy: * release: v0.71.2 [release/v0.71] (#10871) * fix(deps): bump alpine to 3.24.1 [backport: release/v0.71] (#10870) * chore(deps): bump the common group with 4 updates [backport: release/v0.71] (#10867) * fix(oci): validate artifact filename * fix: forward ospkg detector options through ospkg.NewScanner * fix(vex): load VEX documents from within the repository directory * fix: surface the original analysis error instead of context cancellation * ci: expect GitHub App bot as backport PR author

Affected Systems

  • opensuse•trivy&distro=openSUSE Leap 16.0

    < 0.71.2-160000.1.1

References (14)