SUSE-SU-2026:4628-1: terraform-provider-aws&distro=SUSE Linux Enterprise Module for Public Cloud 15 SP4 SUSE Linux Enterprise

Vulnerability summary

SUSE-SU-2026:4628-1 is a vulnerability in terraform-provider-aws&distro=SUSE Linux Enterprise Module for Public Cloud 15 SP4 SUSE Linux Enterprise with no CVSS score yet.

Timeline

1. 12-10-2026
   PublishedVulnerability first disclosed.
2. 13-10-2026
   Last modifiedVulnerability information updated.

Description

Security update for terraform-provider-aws, terraform-provider-azurerm, terraform-provider-external, terraform-provider-google, terraform-provider-helm, terraform-provider-kubernetes, terraform-provider-local, terraform-provider-null, terraform-provider-random, terraform-provider-tls This update for terraform-provider-aws, terraform-provider-azurerm, terraform-provider-external, terraform-provider-google, terraform-provider-helm, terraform-provider-kubernetes, terraform-provider-local, terraform-provider-null, terraform-provider-random, terraform-provider-tls fixes the following issues: Security issues fixed: - CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can lead to DoS via infinite loops, panics or resource consumption (bsc#1267271 bsc#1267273 bsc#1267276). - CVE-2026-56854,CVE-2026-56855,CVE-2026-78662: golang.org/x/crypto/ssh: authentication bypass and deadlocks in the crypto/ssh library (bsc#1278462 bsc#1278477 bsc#1278505). - CVE-2026-71556: github.com/go-git/go-git/v5: Arbitrary file read/write via symbolic link resolution (bsc#1276980). - CVE-2026-71557: github.com/go-git/go-git/v5: Malicious reference names may modify files outside the reference storage (bsc#1276990). - CVE-2026-84303: github.com/grpc/grpc-go: xDS RBAC HTTP filter implementation issue allows for bypass of authorization policies via mixed-case or canonical-case header matches (bsc#1278269 bsc#1279243 bsc#1279245 bsc#1279252 bsc#1279263 bsc#1279386). - CVE-2026-84304: github.com/grpc/grpc-go: heap memory exhaustion via HTTP/2 DATA frame fragmentation (bsc#1278272 bsc#1279072 bsc#1279080 bsc#1279137). - CVE-2026-84445: google.golang.org/grpc: DoS via crash due to missing ':authority' and 'Host' headers in gRPC-Go xDS servers (bsc#1278742 bsc#1278743 bsc#1278751 bsc#1278763). - gRPC-Go: several issues affecting the xDS RBAC authorization engine and the HTTP/2 transport server implementation (bsc#1278267). Non security issue fixed: - terraform-provider-{aws,external,google,random,tls}: aarch64 build installs provider binary under linux_amd64 instead of linux_arm64, breaking terraform init (bsc#1280175).

No weakness data has been published for this record.