|
|
Log in / Subscribe / Register

SUSE alert openSUSE-SU-2026:20892-1 (yq)



From:
              null@suse.de


To:
              security-announce@lists.opensuse.org


Subject:
              openSUSE-SU-2026:20892-1: important: Security update for yq


Date:
              Wed, 03 Jun 2026 17:51:23 +0200


Message-ID:
              <20260603155123.D2272FCE4@maintenance.suse.de>


Archive-link:
              Article


openSUSE security update: security update for yq
-------------------------------------------------------------

Announcement ID: openSUSE-SU-2026:20892-1
Rating: important
References:

  * bsc#1241719
  * bsc#1251339
  * bsc#1251540
  * bsc#1266248
  * bsc#1267053
  * bsc#1267199



Cross-References:

  * CVE-2024-45338
  * CVE-2025-22872
  * CVE-2025-47911
  * CVE-2025-58190
  * CVE-2026-25680
  * CVE-2026-25681
  * CVE-2026-27136
  * CVE-2026-33814
  * CVE-2026-39821
  * CVE-2026-42502
  * CVE-2026-42506



CVSS scores:

  * CVE-2024-45338 ( SUSE ): 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
  * CVE-2024-45338 ( SUSE ): 8.2 CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
  * CVE-2025-22872 ( SUSE ): 6.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
  * CVE-2025-22872 ( SUSE ): 6.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L
  * CVE-2025-47911 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
  * CVE-2025-47911 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
  * CVE-2025-58190 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
  * CVE-2025-58190 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
  * CVE-2026-25680 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  * CVE-2026-25680 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
  * CVE-2026-25681 ( SUSE ): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
  * CVE-2026-25681 ( SUSE ): 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N
  * CVE-2026-27136 ( SUSE ): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
  * CVE-2026-27136 ( SUSE ): 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N
  * CVE-2026-33814 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  * CVE-2026-39821 ( SUSE ): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
  * CVE-2026-39821 ( SUSE ): 9.1 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
  * CVE-2026-42502 ( SUSE ): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
  * CVE-2026-42502 ( SUSE ): 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N
  * CVE-2026-42506 ( SUSE ): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
  * CVE-2026-42506 ( SUSE ): 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N

Affected Products:

         openSUSE Leap 16.0

-------------------------------------------------------------

An update that solves 11 vulnerabilities and has 6 bug fixes can now be installed.

Description:

This update for yq fixes the following issues:

Changes in yq:

- Fix multiple CVEs:
  * CVE-2026-27136 (GO-2026-5030)
    CVE-2026-25681 (GO-2026-5029)
    CVE-2026-25680 (GO-2026-5028)
    CVE-2026-42502 (GO-2026-5027)
    CVE-2026-42506 (GO-2026-5025) (bsc#1267053)
    CVE-2026-39821 (GO-2026-5026) (bsc#1267199)

- update to v4.53.2
  * Add system(command; args) operator (disabled by default).
  * TOML encoder: prefer readable table sections over inline tables.
  * Fix TOML encoder to quote keys containing special characters.
  * Add string slicing support.
  * Fix findInArray misuse on MappingNodes in equality and contains.
  * Fix panic on negative slice indices that underflow after adjustment.
  * Fix stack overflow from circular alias in traverse.
  * Fix panic and OOM in repeatString for large repeat counts.

- update to v4.52.5
  * Fix: reset TOML decoder state between files.
  * Fix: preserve original filename when using --front-matter.

- Integrate vulnchecker support into %check stage (optional: set `%%_with_vulncheck 1`).
- Fix CVE-2026-33814 (bsc#1266248):
  * update golang.org/x/net to v0.53.0.

- update to 4.52.4:
  * Dropping windows/arm - no longer supported in cross-compile
  * Fixing comments in TOML arrays
  * Bumped dependencies

- update to 4.52.2:
  * Fixed bad instructions file breaking go-install (#2587)
    Thanks @theyoprst
  * Fixed TOML table scope after comments (#2588) Thanks @tomers
  * Multiply uses a readonly context
  * Fixed merge globbing wildcards in keys
  * Fixing TOML subarray parsing issue

- update to 4.52.1:
  * TOML encoder support - you can now roundtrip! #1364
  * Parent now supports negative indices, and added a 'root'
    command for referencing the top level document
  * Fixed scalar encoding for HCL
  * Add --yaml-compact-seq-indent / -c flag for compact sequence
    indentation (#2583) Thanks @jfenal
  * Add symlink check to file rename util (#2576) Thanks @Elias-
    elastisys
  * Powershell fixed default command used for __completeNoDesc
    alias (#2568) Thanks @teejaded
  * Unwrap scalars in shell output mode. (#2548) Thanks
    @flintwinters
  * Added K8S KYAML output format support (#2560) Thanks @robbat2

- update to 4.50.1:
  * Added HCL Support - First cut - hopefully it works well!
  * Fixing handling of CRLF #2352

- update to 4.49.2:
  * Fixing escape character bugs :sweat: #2517
  * Fixing snap release pipeline #2518 Thanks @aalexjo

- update to 4.49.1:
  * Added `--security` flags to disable env and file ops #2515
  * Fixing TOML ArrayTable parsing issues #1758
  * Fixing parsing of escaped characters #2506

- update to 4.48.2:
  * Strip whitespace when decoding base64 #2507
  * Upgraded to go-yaml v4! (thanks @ccoVeille, @ingydotnet)
  * Add linux/loong64 to release target (thanks @znley)
  * Added --shell-key-separator flag for customizable shell
    output format #2497 (thanks @rsleedbx)

- update to 4.48.1:
  * Added 'parents' operator, to return a list of all the
    hierarchical parents of a node
  * Added 'first(exp)' operator, to return the first entry
    matching an expression in an array
  * Fixed xml namespace prefixes #1730 (thanks @baodrate)
  * Fixed out of range panic in yaml decoder #2460 (thanks
    @n471d)
  * Fixes CVE-2025-58190 (GO-2026-4441) (bsc#1251540)
          CVE-2025-47911 (GO-2026-4440) (bsc#1251339) by
    updating golang.org/x/net to v0.46.0.

- update to 4.47.2:
  * Conversion from TOML to JSON no longer omits empty tables
    #2459 (thanks @louislouislouislouis)

- update to 4.47.1:
  * Fixed merge anchor behaviour (`<<`); #2404, #2110, #2386,
    #2178 Huge thanks to @stevenwdv!

- Fix zsh completion location

- update to 4.46.1:
  * Added INI support
  * Fixed 'add' operator when piped in with no data #2378, #2383,
    #2384
  * Fixed delete after slice problem (bad node path) #2387 Thanks
    @antoinedeschenes
  * Fixed yq small build Thanks @imzue
  * Switched to YAML org supported go-yaml!

- update to 4.45.4:
  * Fixing wrong map() behaviour on empty map #2359

- update to 4.45.3:
  * Fixing regression (#2353, #2359, #2325) introduced with in
    4.45.2 with #2325 fix

- update to 4.45.2:
  * Added windows arm builds (Thanks @albertocavalcante,
    @ShukantPal)
  * Added s390x platform support (Thanks @ashokpariya0)
  * Additionally push docker images to ghcr.io (Thanks @reegnz)
  * Fixing add when there is no node match #2325
  * sort_by works on maps
  * Fixed CVE-2025-22872 (GO-2025-3595) (bsc#1241719) by
     updating golang.org/x/net to 0.39.0.

- update to 4.45.1:
  * Create parent directories when --split-exp is used, Thanks
    @rudo-thomas

- Updated to 4.44.6:
  * Fixed deleting items in array bug #2027, #2172; Thanks @jandubois
  * Docker image for armv7 / raspberry pi3, Thanks @brianegge
  * Fixed no-colors regression #2218
  * Fixed various panic scenarios #2211
  * Bumped dependencies

- Changes from 4.44.5 (4.44.4 was skipped)
  * Format comments with a gray foreground (Thanks @gabe565)
  * Fixed handling of nulls with sort_by expressions #2164
  * Force no color output when NO_COLOR env presents (Thanks @narqo)
  * Fixed array subtraction update bug #2159
  * Fixed index out of range error
  * Can traverse straight from parent operator (parent.blah)
  * Bumped dependencies

- Bumped x/net to 0.33.0 to fix CVE-2024-45338


Patch instructions:

   To install this openSUSE security update use the suse recommended installation methods
   like YaST online_update or "zypper patch".
   Alternatively you can run the command listed for your product:

- openSUSE Leap 16.0

   zypper in -t patch openSUSE-Leap-16.0-packagehub-294=1

Package List:

- openSUSE Leap 16.0:

  yq-4.53.2-bp160.1.1
  yq-bash-completion-4.53.2-bp160.1.1
  yq-fish-completion-4.53.2-bp160.1.1
  yq-zsh-completion-4.53.2-bp160.1.1

References:

  * https://www.suse.com/security/cve/CVE-2024-45338.html
  * https://www.suse.com/security/cve/CVE-2025-22872.html
  * https://www.suse.com/security/cve/CVE-2025-47911.html
  * https://www.suse.com/security/cve/CVE-2025-58190.html
  * https://www.suse.com/security/cve/CVE-2026-25680.html
  * https://www.suse.com/security/cve/CVE-2026-25681.html
  * https://www.suse.com/security/cve/CVE-2026-27136.html
  * https://www.suse.com/security/cve/CVE-2026-33814.html
  * https://www.suse.com/security/cve/CVE-2026-39821.html
  * https://www.suse.com/security/cve/CVE-2026-42502.html
  * https://www.suse.com/security/cve/CVE-2026-42506.html
to post comments


Copyright © 2026, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds