SUSE-SU-2026:2493-1

Advisory lineage Upstream: 12 Downstream: 0
Published: 22 Jun 2026, 15:34
Last modified:24 Jun 2026, 09:00

Vulnerability Summary

Overall Risk (default)
minimal
0/100
CVSS Score
No data
EPSS Score
No data
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

22 Jun 2026, 15:34
Published
Vulnerability first disclosed
24 Jun 2026, 09:00
Last Modified
Vulnerability information updated

Description

Security update for containerized-data-importer This update for containerized-data-importer fixes the following issues: - Security: re-vendor Go dependencies to address CVEs tracked against containerized-data-importer (backport of upstream PR #4110, post-v1.65.0). Fixed by this update: * google.golang.org/grpc 1.65.0 -> 1.79.3: bsc#1260295 (CVE-2026-33186) * golang.org/x/net 0.33.0 -> 0.48.0: bsc#1238699 (CVE-2025-22870), bsc#1241838 (CVE-2025-22872), bsc#1251495 (CVE-2025-47911), bsc#1251689 (CVE-2025-58190) * golang.org/x/crypto 0.31.0 -> 0.46.0: CVE-2025-22869, CVE-2025-47913, CVE-2025-47914, CVE-2025-58181 (no separate CDI bug filed) * go.opentelemetry.io/otel 1.28.0 -> 1.41.0: CVE-2026-29181 (otel is pulled in transitively at 1.39.0 by the grpc bump; pinned to 1.41.0 so the update does not introduce it) - Record CVEs already fixed by the x/net release vendored in 1.64.0 (x/net 0.33.0), not previously noted in the changelog: bsc#1236523 (CVE-2023-45288), bsc#1230323 (CVE-2023-39325)

Affected Systems

  • suse•containerized-data-importer&distro=SUSE Linux Enterprise Module for Containers 15 SP7

    < 1.64.0-150700.9.11.1

References (20)