SUSE alert openSUSE-SU-2026:20025-1 (hawk2)
| From: | meissner@suse.com | |
| To: | security-announce@lists.opensuse.org | |
| Subject: | openSUSE-SU-2026:20025-1: important: Security update for hawk2 | |
| Date: | Thu, 15 Jan 2026 17:52:34 +0100 | |
| Message-ID: | <20260115165234.62B76FBA0@maintenance.suse.de> | |
| Archive-link: | Article |
openSUSE security update: security update for hawk2 ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:20025-1 Rating: important References: * bsc#1230275 * bsc#1247899 * bsc#1248100 * bsc#1251939 Cross-References: * CVE-2025-55193 * CVE-2025-61919 CVSS scores: * CVE-2025-55193 ( SUSE ): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N * CVE-2025-55193 ( SUSE ): 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N * CVE-2025-61919 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H * CVE-2025-61919 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N Affected Products: openSUSE Leap 16.0 ------------------------------------------------------------- An update that solves 2 vulnerabilities and has 4 bug fixes can now be installed. Description: This update for hawk2 fixes the following issues: - Bump ruby gem rack to 3.1.18 (bsc#1251939). - Bump ruby gem uri to 1.0.4. - Fix the mtime in manifest.json (bsc#1230275). - Make builds determinitstic (bsc#1230275). - Bump rails version from 8.0.2 to 8.0.2.1 (bsc#1248100). - Require openssl explicitly (bsc#1247899). Patch instructions: To install this openSUSE security update use the suse recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 16.0 zypper in -t patch openSUSE-Leap-16.0-134=1 Package List: - openSUSE Leap 16.0: hawk2-2.7.0+git.1742310530.bfcd0e2c-160000.3.1 References: * https://www.suse.com/security/cve/CVE-2025-55193.html * https://www.suse.com/security/cve/CVE-2025-61919.html