[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-OPENSUSE-SU-2026:21079-1":6},{"stargazers_count":4,"fetched_at":5},7,"2026-08-01T00:21:03.480Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":11,"aliases":12,"duplicate_of":9,"upstream":13,"downstream":56,"duplicates":57,"related":58,"reserved_at":9,"published_at":80,"modified_at":81,"state":9,"summary":82,"references_raw":84,"kevs":208,"epss":9,"epss_history":209,"metrics":210,"affected":211},"OPENSUSE-SU-2026:21079-1","Security update for amazon-ssm-agent\n\nThis update for amazon-ssm-agent fixes the following issues\n\nUpdate to version 3.3.4624.0:\n\n- CVE-2025-22869: golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh\n  (bsc#1239342).\n- CVE-2025-22870: golang.org/x/net/proxy: proxy bypass using IPv6 zone IDs (bsc#1238702).\n- CVE-2025-47913: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type in\n  response to a key listing or signing request (bsc#1253611).\n- CVE-2026-1229: the CombinedMult function in the ecc/p384 package produces an incorrect value for specific inputs\n  (bsc#1265474).\n- CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for .pack and .idx files\n  can lead to the consumption of corrupted files (bsc#1258095).\n- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation\n  bypass and privilege esca (bsc#1266781).\n- CVE-2026-41506: github.com/go-git/go-git/v5: HTTP authentication credential leak when following redirects during\n  smart-HTTP clone and fetch operations (bsc#1264952).\n- CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to DoS via infinite\n  loops, panics or resource consumption (bsc#1267332).\n- CVE-2026-39827: Invoking memory leak when rejecting channels can lead to DoS in golang.org/x/crypto/ssh (bsc#1266200).\n- CVE-2026-39828: Invoking bypass of certificate restrictions in golang.org/x/crypto/ssh (bsc#1266200).\n- CVE-2026-39829: Invoking pathological RSA/DSA parameters may cause DoS in golang.org/x/crypto/ssh (bsc#1266200).\n- CVE-2026-39830: Invoking client can cause server deadlock on unexpected responses in golang.org/x/crypto/ssh\n  (bsc#1266200).\n- CVE-2026-39831: Invoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh\n  (bsc#1266200).\n- CVE-2026-39832: Invoking agent constraints dropped when forwarding keys in golang.org/x/crypto/ssh/agent\n  (bsc#1266200).\n- CVE-2026-39833: Invoking key constraints not enforced in golang.org/x/crypto/ssh/agent (bsc#1266200).\n- CVE-2026-39834: Invoking infinite loop on large channel writes in golang.org/x/crypto/ssh (bsc#1266200).\n- CVE-2026-39835: Invoking server panic during CheckHostKey/Authenticate in golang.org/x/crypto/ssh (bsc#1266200).\n- CVE-2026-42508: Invoking auth bypass via unenforced @revoked status in golang.org/x/crypto/ssh/knownhosts\n  (bsc#1266200).\n- CVE-2026-46595: Invoking VerifiedPublicKeyCallback permissions skip enforcement in golang.org/x/crypto/ssh\n  (bsc#1266200).\n- CVE-2026-46597: Invoking byte arithmetic causes underflow and panic in golang.org/x/crypto/ssh (bsc#1266200).\n- CVE-2026-46598: Invoking pathological inputs can lead to client panic in golang.org/x/crypto/ssh/agent (bsc#1266200).\n\nChanges:\n\n * Bump golang.org/x/crypto from v0.51.0 to v0.52.0\n * Bump golang.org/x/net from v0.54.0 to v0.55.0\n * Enforce directory boundary in BuildSafePath\n * Fix visibility issue with Bottlerocket OS in document output\n * Update go-git from v5.17.1 to v5.19.1 (bsc#1264952, CVE-2026-41506), this\n   also updates go-billy from v5.8.0 to v5.9.0 (bsc#1267332, CVE-2026-44740)\n * Bump golang.org/x/net from v0.48.0 to v0.53.0 (bsc#1266781, CVE-2026-39821)\n * Quit if sysprep failed and log its current state\n * Remove attached legacy cloudwatch plugin packages\n * Upgrade Go version to 1.25.10\n * Use BuildSafePath wherever it is applicable\n * Add OOM killer protection to systemd service files\n * Apply more sanitation to file and registry inventory gatherers\n * Bump go-git to v5.17.1\n * Deprecate legacy cloudwatch plugin\n * Preserve network error details in credential refresher SSM API failures\n * Upgrade Go version to 1.25.9\n * Add SSM Distributor support for Bottlerocket OS\n * Implement flush credentials command in ssm-cli\n * Log ec2messages access denied as debug instead of error to reduce log noise\n * Make credential refresher refresh cache quickly in case of credential flush\n * Make Greengrass component registration resilient with retry\n * Add EnforceWorkspaceRootOwnership configuration to support disable\n   hardening of agent workspace\n * Add reboot comment to Windows shutdown command for SSM Agent traceability\n * Update privilege access check to verify ownership and permissions\n   of document state files\n * Add read-only version check prior to install and uninstall\n   in case of occupied package manager locks\n * Add ANSI processing for CloudWatch and S3 log\n * Upgrade go-git to v5.17.0 and cloudflare/circl to v1.6.3\n   to fix CVE-2026-1229\n- Switch to systemd-tmpfiles to store runtime data (jsc#PED-14843)\n * Disable Go 1.25 container-aware GOMAXPROCS to prevent holding\n   cgroup file descriptors open\n * Upgrade Go version to 1.25.8\n * Document CommandWorkerBufferLimit config\n * Include package update in Dockerfile\n * Reduce CloudWatch event message length threshold\n * Upgrade Go version to 1.25.7\n * Update github.com/go-git/go-git/v5 to 5.16.5 (bsc#1258095, CVE-2026-25934)\n * Update greengrass version\n * Update Golang version to 1.24.12\n * Updating golang.org/x/crypto from v0.37.0 to v0.47.0, golang.org/x/net\n   from v0.39.0 to v0.48.0 and golang.org/x/sys from v0.32.0 to v0.40.0\n   (bsc#1253611, CVE-2025-47913)\n * Categorize integration tests by adding new tags to split fast and slow ones\n * Fix bug where IP field being empty string and causing UII API failure\n * Allow Patch execution to persist across reboots not registered to SSM Agent\n * Fix ENV_VAR interpolation to work correctly with parameter store value\n * Implement immediate retries for failed reply messages to MGS for RunCommand documents\n * Improve ssm-cli get-diagnostics command log output\n * Support DomainJoin endpoint for EU sovereign cloud\n * Support dualstack S3 endpoint for distributor packages\n * Upgrade Go version to 1.24.11\n * Add initial IPv6 support with UseDualStackEndpoint configuration option\n * Fix CPU utilization issue for instances with thousands of network interfaces\n * Add IMDS retry count to account for EC2 droplet refresh\n * Fix duplicate uid error logging in MDS module\n * Update aws:Domainjoin plugin logging from Log4Net to NLog\n * Upgrade Go version to 1.24.7\n * Update github.com/go-git/go-git/v5 to 5.15.0\n * Update golang.org/x/crypto to v0.37.0 (bsc#1238702, CVE-2025-22870)\n * Update golang.org/x/net to v0.39.0\n * Update golang.org/x/sys to v0.32.0\n * Add EU sovereign cloud S3 endpoint for DownloadContent plugin\n * Add configurable credential rotation max backoff interval\n * Migrate from twinj/uuid to google/uuid library\n * Allow newer agent versions to be installed when deploying on Greengrass\n * Harden function to remove non-admin run command documents in execution path\n * Fix macOS credential refresher test issue due to missing Debugf from serialport skip file\n * Enhance testability of custom certificate usage in debug SSM Agent builds\n * Decouple serial port from startup and add credential refresher serialport logging\n * Add GlobalEnhancedTelemetryEnabled config to README\n * Add cloudwatch logs endpoint configuration to optional config for agent\n * Update Greengrass component version\n * Add file privilege check before processing document state file\n * Storing AWS document interpolation ENV_VAR types as environment variables\n * Throw explicit error when running local cli as non-priviledged user\n * Harden telemetry dynamic config folder permissions\n * Add configuration option for HandshakeTimeout\n * Improve unit tests\n * Add setup for emitting telemetry logs and metrics\n * Add initial selection of error logs to emit to telemetry\n * Simplify checkstyle and import organization in build scripts\n * Update golang.org/x/net from v0.37.0 to v0.38.0\n * Agent hibernation reason is logged to EC2 system logs\n * Add metrics for the EC2Detector and IMDS EC2 status findings\n * Change Linux DomainJoin plugin parameter KeepHostName to accept\n   both boolean and string\n * Upgrade GoLang to version 1.23.8\n * Update golang.org/x/crypto from v0.32.0 to v0.36.0 (bsc#1239342, CVE-2025-22869)\n",null,[],[],[],[14,16,18,20,22,24,26,28,30,32,34,36,38,40,42,44,46,48,50,52,54],{"_key":15},"CVE-2025-22869",{"_key":17},"CVE-2025-22870",{"_key":19},"CVE-2025-47913",{"_key":21},"CVE-2026-1229",{"_key":23},"CVE-2026-25934",{"_key":25},"CVE-2026-39821",{"_key":27},"CVE-2026-39827",{"_key":29},"CVE-2026-39828",{"_key":31},"CVE-2026-39829",{"_key":33},"CVE-2026-39830",{"_key":35},"CVE-2026-39831",{"_key":37},"CVE-2026-39832",{"_key":39},"CVE-2026-39833",{"_key":41},"CVE-2026-39834",{"_key":43},"CVE-2026-39835",{"_key":45},"CVE-2026-41506",{"_key":47},"CVE-2026-42508",{"_key":49},"CVE-2026-44740",{"_key":51},"CVE-2026-46595",{"_key":53},"CVE-2026-46597",{"_key":55},"CVE-2026-46598",[],[],[59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79],{"_key":15},{"_key":17},{"_key":19},{"_key":21},{"_key":23},{"_key":25},{"_key":27},{"_key":29},{"_key":31},{"_key":33},{"_key":35},{"_key":37},{"_key":39},{"_key":41},{"_key":43},{"_key":45},{"_key":47},{"_key":49},{"_key":51},{"_key":53},{"_key":55},"2026-06-17T16:32:56Z","2026-06-30T18:24:39.265293198Z",{"cisa_kev":83,"cisa_ransomware":83,"cisa_vendor":9,"epss_severity":9,"epss_score":9,"severity":9,"severity_score":9,"severity_version":9,"severity_source":9,"severity_vector":9,"severity_status":9},false,[85,91,95,99,103,107,111,115,119,123,128,132,136,140,144,148,152,156,160,164,168,172,176,180,184,188,192,196,200,204],{"url":86,"sources":87,"tags":89},"https://bugzilla.suse.com/1238702",[88],"osv_opensuse",[90],"REPORT",{"url":92,"sources":93,"tags":94},"https://bugzilla.suse.com/1239342",[88],[90],{"url":96,"sources":97,"tags":98},"https://bugzilla.suse.com/1253611",[88],[90],{"url":100,"sources":101,"tags":102},"https://bugzilla.suse.com/1258095",[88],[90],{"url":104,"sources":105,"tags":106},"https://bugzilla.suse.com/1264952",[88],[90],{"url":108,"sources":109,"tags":110},"https://bugzilla.suse.com/1265474",[88],[90],{"url":112,"sources":113,"tags":114},"https://bugzilla.suse.com/1266200",[88],[90],{"url":116,"sources":117,"tags":118},"https://bugzilla.suse.com/1266781",[88],[90],{"url":120,"sources":121,"tags":122},"https://bugzilla.suse.com/1267332",[88],[90],{"url":124,"sources":125,"tags":126},"https://www.suse.com/security/cve/CVE-2025-22869",[88],[127],"WEB",{"url":129,"sources":130,"tags":131},"https://www.suse.com/security/cve/CVE-2025-22870",[88],[127],{"url":133,"sources":134,"tags":135},"https://www.suse.com/security/cve/CVE-2025-47913",[88],[127],{"url":137,"sources":138,"tags":139},"https://www.suse.com/security/cve/CVE-2026-1229",[88],[127],{"url":141,"sources":142,"tags":143},"https://www.suse.com/security/cve/CVE-2026-25934",[88],[127],{"url":145,"sources":146,"tags":147},"https://www.suse.com/security/cve/CVE-2026-39821",[88],[127],{"url":149,"sources":150,"tags":151},"https://www.suse.com/security/cve/CVE-2026-39827",[88],[127],{"url":153,"sources":154,"tags":155},"https://www.suse.com/security/cve/CVE-2026-39828",[88],[127],{"url":157,"sources":158,"tags":159},"https://www.suse.com/security/cve/CVE-2026-39829",[88],[127],{"url":161,"sources":162,"tags":163},"https://www.suse.com/security/cve/CVE-2026-39830",[88],[127],{"url":165,"sources":166,"tags":167},"https://www.suse.com/security/cve/CVE-2026-39831",[88],[127],{"url":169,"sources":170,"tags":171},"https://www.suse.com/security/cve/CVE-2026-39832",[88],[127],{"url":173,"sources":174,"tags":175},"https://www.suse.com/security/cve/CVE-2026-39833",[88],[127],{"url":177,"sources":178,"tags":179},"https://www.suse.com/security/cve/CVE-2026-39834",[88],[127],{"url":181,"sources":182,"tags":183},"https://www.suse.com/security/cve/CVE-2026-39835",[88],[127],{"url":185,"sources":186,"tags":187},"https://www.suse.com/security/cve/CVE-2026-41506",[88],[127],{"url":189,"sources":190,"tags":191},"https://www.suse.com/security/cve/CVE-2026-42508",[88],[127],{"url":193,"sources":194,"tags":195},"https://www.suse.com/security/cve/CVE-2026-44740",[88],[127],{"url":197,"sources":198,"tags":199},"https://www.suse.com/security/cve/CVE-2026-46595",[88],[127],{"url":201,"sources":202,"tags":203},"https://www.suse.com/security/cve/CVE-2026-46597",[88],[127],{"url":205,"sources":206,"tags":207},"https://www.suse.com/security/cve/CVE-2026-46598",[88],[127],[],[],[],[212],{"ecosystem":213,"name":214,"vendor":215,"product":216,"cpe_part":9,"purl_type":217,"purl_namespace":215,"purl_name":216,"source":9,"versions":218},"openSUSE","amazon-ssm-agent","opensuse","amazon-ssm-agent&distro=openSUSE Leap 16.0","rpm",[219],{"version":220,"is_range":221,"range_type":222,"version_start":9,"version_start_type":9,"version_end":223,"version_end_type":224,"fixed_in":9},"lt3_3_4624_0_160000_1_1",true,"ecosystem","3.3.4624.0-160000.1.1","excluding"]