SUSE alert openSUSE-SU-2025-20128-1 (shadowsocks-v2ray-plugin, v2ray-core)

From:
             
 
meissner@suse.com
To:
             
 
security-announce@lists.opensuse.org
Subject:
             
 
openSUSE-SU-2025-20128-1: important: Security update for shadowsocks-v2ray-plugin, v2ray-core
Date:
             
 
Mon, 01 Dec 2025 15:05:14 +0100
Message-ID:
             
 
<20251201140514.2A9D2FBA5@maintenance.suse.de>
Archive-link:
             
 
Article
openSUSE security update: security update for shadowsocks-v2ray-plugin, v2ray-core
-------------------------------------------------------------

Announcement ID: openSUSE-SU-2025-20128-1
Rating: important
References:

  * bsc#1235164
  * bsc#1243946
  * bsc#1243954
  * bsc#1251404



Cross-References:

  * CVE-2025-297850
  * CVE-2025-47911



CVSS scores:

  * CVE-2025-47911 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
  * CVE-2025-47911 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Affected Products:

         openSUSE Leap 16.0

-------------------------------------------------------------

An update that solves 2 vulnerabilities and has 4 bug fixes can now be installed.

Description:

This update for shadowsocks-v2ray-plugin, v2ray-core fixes the following issues:

Changes in shadowsocks-v2ray-plugin:

- Update version to 5.25.0
  * Update v2ray-core to v5.25.0
- Add update-vendor.patch, update v2ray-core to v5.33.0 (boo#1243954 and CVE-2025-297850)

Changes in v2ray-core:

- Fix CVE-2025-47911 and boo#1251404
  * Add fix-CVE-2025-47911.patch
  * Update golang.org/x/net to 0.45.0 in vendor

- Update version to 5.38.0
  * TLSMirror Connection Enrollment System
  * Add TLSMirror Sequence Watermarking
  * LSMirror developer preview protocol is now a part of mainline V2Ray
  * proxy dns with NOTIMP error
  * Add TLSMirror looks like TLS censorship resistant transport protocol
    as a developer preview transport
  * proxy dns with NOTIMP error
  * fix false success from SOCKS server when Dispatch() fails
  * HTTP inbound: Directly forward plain HTTP 1xx response header
  * add a option to override domain used to query https record
  * Fix bugs
  * Update vendor

- Update version to 5.33.0
  * bump github.com/quic-go/quic-go from 0.51.0 to 0.52.0(boo#1243946 and CVE-2025-297850)
  * Update other vendor source

- Update version to 5.31.0
  * Add Dns Proxy Response TTL Control
  * Fix call newError Base with a nil value error
  * Update vendor (boo#1235164)

- Update version to 5.29.3
  * Enable restricted mode load for http protocol client
  * Correctly implement QUIC sniffer when handling multiple initial packets
  * Fix unreleased cache buffer in QUIC sniffing
  * A temporary testing fix for the buffer corruption issue
  * QUIC Sniffer Restructure

- Update version to 5.22.0
  * Add packetEncoding for Hysteria
  * Add ECH Client Support
  * Add support for parsing some shadowsocks links
  * Add Mekya Transport
  * Fix bugs


Patch instructions:

   To install this openSUSE security update use the suse recommended installation methods
   like YaST online_update or "zypper patch".
   Alternatively you can run the command listed for your product:

- openSUSE Leap 16.0

   zypper in -t patch openSUSE-Leap-16.0-packagehub-38=1

Package List:

- openSUSE Leap 16.0:

  golang-github-teddysun-v2ray-plugin-5.15.1-bp160.1.11
  golang-github-v2fly-v2ray-core-5.18.0-bp160.1.13
  shadowsocks-v2ray-plugin-5.15.1-bp160.1.11
  v2ray-core-5.18.0-bp160.1.13

References:

  * https://www.suse.com/security/cve/CVE-2025-297850.html
  * https://www.suse.com/security/cve/CVE-2025-47911.html