OPENSUSE-SU-2026:21933-1: sdbootutil&distro=openSUSE Leap 16.0 openSUSE

Vulnerability summary

OPENSUSE-SU-2026:21933-1 is a vulnerability in sdbootutil&distro=openSUSE Leap 16.0 openSUSE with no CVSS score yet.

Timeline

1. 23-09-2026
   PublishedVulnerability first disclosed.
2. 25-09-2026
   Last modifiedVulnerability information updated.

Description

Security update for sdbootutil This update for sdbootutil fixes the following issues: Security issues fixed: - CVE-2026-41676: `Deriver:derive` and `PkeyCtxRef:derive` can overflow short buffers on OpenSSL 1.1.1 (bsc#1270192). - CVE-2026-41677: out-of-bounds read in PEM password callback when returning an oversized length in rust-openssl crate (bsc#1270616). - CVE-2026-41678: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270670). - CVE-2026-41681: MdCtxRef::digest_final() writes past caller buffer with no length check in rust-openssl crate (bsc#1270742). - CVE-2026-41898: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory in rust-openssl crate (bsc#1270863). - CVE-2026-42327: arbitrary code execution via specially crafted certificate in rust-openssl crate (bsc#1270471). - CVE-2026-44662: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-openssl crate (bsc#1270922). - CVE-2026-45784: out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers in rust- openssl crate (bsc#1270995). Non security issues fixed: - sdbootutil-update-predictions.service fails with Failed to start Update TPM predictions (bsc#1273384). - systemd ordering cycle and other service problems with snapshot 20260722 (bsc#1272525). - Unable to unlock multiple encrypted partitions with FIDO2 Key, Systemdboot+LUKS (bsc#1234010). Changes for sdbootutil: - Update to version 1+git20260908.c641fc2: * Update the shim when required * Warn when recovery PIN is different from recovery key * Improves extra boot entries support * Better report when the default snapshot diverges * Explain how to do re-enrolling if recovery PIN fails * Explain why update-prediction fails and how to solve it * Hide comparison output * Add bootctl default entry in the prediction - Update to version 1+git20260903.f91f636: * Include FIDO2 unlocked devices for ordering (bsc#1234010) * Test in parallel for speed up * Add --repair parameter to cleanup * Fix shellcheck complain * Report entries with missing files * Avoid duplicate entries in non-snapper systems * Add initial tests for sdbootutil * Report the error if bootctl clean fails - Update to version 1+git20260901.41540d5: * No warn if a component is not in the event log * Add status command * Select the new sdbootutil if available * Skip blank lines in measure-pcr-generator.sh * Do not change crypttab for unrelated entries * Report the bad PCR when update-prediction fail * Do not write the recovery PIN in the journal * Improves non snapshot system support * Update help message for --measure-pcr * Report when PCR 7 is dropped because shim update * Add --strict parameter for --pcr policy * Report dropped PCRs via a warn * Adjust the limits for PolicyOR issues * Avoid update predictions if the service is up * Keep the exit status of sdbootutil call - Update to version 1+git20260827.786f9a8: * Do not accept empty passwords * jeos-firstboot-enroll: report errors also in the journal * Restore old crypttab via the exit trap * Update CLAUDE data * Detect half created openssl keys * check_enrolled report when something was written in the LUKS2 header * Improve a bit the disk-encryption-tool keyslot detection * Avoid leak of env var secrets * Wipe the d-e-t key in the enroll service and jeos module * Remove the correct keyslot left by d-e-t * Differentiate tpm2 and tpm2+pin for unattended unlock * Use is_same_device in detect_tracked_device and drop greps * Refactor check to avoid shellcheck complain * Parse the entry file in a sigle place * Validate the entry with the new kernel name * Refactor enrollment interface and deprecate the old one * New kernels will have different hash * Warn If no crypttab entry found * Extend is_same_device * jeos-firstboot-enroll: validate the passwords * sdbootutil-enroll: report when no encryption method is provided * Write recovery pin after enrollment in jeos module * Write recovery pin after enrollment * Improve error detection in sdbootutil-enroll * Increase keyctl timeout * Merge require_unlock and set_unlock_method * Be sure that the terminal check works with snapper * Renerate initrd when new measure-pcr keys are created * Separate ask-* parameters * Fix reading credential and keyctl password * Get the device password for each enrolling mechanism * Drop elements from crypttab if the enrollment fails * Validate the enrollment for each method * Add warning when enrolling FIDO2 token - Update to version 1+git20260825.c7a5a97: * Refactor free space calculation * Do not use /proc/cmdline in half configured systems * Warning when the recovery PIN is not validated * Show default and booted snapshots with marks * Improve detection of snapshot systems * Fix when searching for a boot entry * Fix boot order and boot order entry * Create the entries directory in the ESP * Fix get_final_pcr parser * Keep btrfs error and show it when fails * Fix set -e early exit instances * Fix measure-pcr-validator when there is no terminal * Don't include measure-pcr-validator in initrd if TPM2 is not used * Update predictions even if crypttab did not change * Improve PCR 15 signing * Detect NAME=VALUE passed as parameters and complain * When asking a password, require a terminal * Filter some warnings from pcrlock * Detect directories that are not part of the snapshot * Write bash completion errors to /dev/null * Detect when t-u apply is done and avoid data corruption * Detect pcr-oracle leftovers * Show in title that it's the initial version for transactional systems * Manually generate PCR7 measurements * Regenerate pcrlock.json when it is missing - Update to version 1+git20260813.357956d: * Do not update the predictions without a TPM2 enrollment (bsc#1273384) - Update to version 1+git20260812.305d9f2: * Do not supplement if GRUB2-EFI is installed (bsc#1272525) - Update to version 1+git20260714.d9bb736: * tukit: do not fail if service is not found - Update to version 1+git20260713.d869cf8: * Ignore errors in the snapper plugin - Update to version 1+git20260709.7dfd021: * Remove the background process in the plugin * Fix missing initrd condition (bsc#1270420) * After reboot the shutdown service is not active * Disable the shutdown service after main service * Update uhmac dependencies (rust-openssl) bsc#1270192, CVE-2026-41676 bsc#1270995, CVE-2026-45784 bsc#1270922, CVE-2026-44662 bsc#1270863, CVE-2026-41898 bsc#1270742, CVE-2026-41681 bsc#1270670, CVE-2026-41678 bsc#1270616, CVE-2026-41677 bsc#1270471, CVE-2026-42327 * Add systemd transient service to update predictions * Install extra EFI binaries - Update to version 1+git20260625.7fa275e: * Remove duplicate code and parametrize timers * Check boot entry before kernel installation * Re-install an old kernel if initrd cannot be reused * Skip installation for already installed kernel * Add configurable devicetree entry support * Set explicit kernel and initrd paths * Remove the full tmpdir in the service * Fix /run/sdbootutil permissions * Execute predictions in the background * Add --disable-predictions parameter * Fix comparison operator * Add print-loader-path command

No weakness data has been published for this record.