SUSE alert openSUSE-SU-2026:21072-1 (trivy)

From:
             
 
null@suse.de
To:
             
 
security-announce@lists.opensuse.org
Subject:
             
 
openSUSE-SU-2026:21072-1: important: Security update for trivy
Date:
             
 
Tue, 30 Jun 2026 09:48:13 +0200
Message-ID:
             
 
<20260630074813.756C8FF4B@maintenance.suse.de>
Archive-link:
             
 
Article
openSUSE security update: security update for trivy
-------------------------------------------------------------

Announcement ID: openSUSE-SU-2026:21072-1
Rating: important
References:

  * bsc#1267268
  * bsc#1268356
  * bsc#1268399
  * bsc#1268400
  * bsc#1268403
  * bsc#1268404
  * bsc#1268440



Cross-References:

  * CVE-2026-44740
  * CVE-2026-46680
  * CVE-2026-47262
  * CVE-2026-50195
  * CVE-2026-53488
  * CVE-2026-53489
  * CVE-2026-53492



CVSS scores:

  * CVE-2026-44740 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  * CVE-2026-44740 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
  * CVE-2026-46680 ( SUSE ): 7 CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
  * CVE-2026-47262 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
  * CVE-2026-50195 ( SUSE ): 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
  * CVE-2026-53488 ( SUSE ): 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
  * CVE-2026-53489 ( SUSE ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
  * CVE-2026-53492 ( SUSE ): 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected Products:

         openSUSE Leap 16.0

-------------------------------------------------------------

An update that solves 7 vulnerabilities and has 7 bug fixes can now be installed.

Description:

This update for trivy fixes the following issues

Update to version 0.71.2:

- CVE-2026-44740: github.com/go-git/go-billy/v5: improper input handling in many components can
lead to DoS via infinite
  loops, panics or resource consumption (bsc#1267268).
- CVE-2026-46680: github.com/containerd/containerd/v2/pkg/oci: containerd user ID handling bypass
allows runAsNonRoot
  evasion (bsc#1268356).
- CVE-2026-47262: github.com/containerd/containerd/v2/pkg/oci: Denial of Service (DoS) condition
via a maliciously
  crafted image (bsc#1268440).
- CVE-2026-50195: containerd: fails to validate the image references specified within a checkpoint
image's
  configuration (bsc#1268399).
- CVE-2026-53488: containerd: CRI plugin propagates labels from an image config to a container
without validation
  (bsc#1268400).
- CVE-2026-53489: containerd: CRI plugin restores container.log from a checkpoint image without
validating a symlinked
  path (bsc#1268404).
- CVE-2026-53492: containerd: improperly trusts Container Device Interface (CDI) annotations found
within untrusted
  checkpoint image metadata during container restoration (bsc#1268403).

Changes for trivy:

 * release: v0.71.2 [release/v0.71] (#10871)
 * fix(deps): bump alpine to 3.24.1 [backport: release/v0.71] (#10870)
 * chore(deps): bump the common group with 4 updates [backport: release/v0.71] (#10867)
 * fix(oci): validate artifact filename
 * fix: forward ospkg detector options through ospkg.NewScanner
 * fix(vex): load VEX documents from within the repository
   directory
 * fix: surface the original analysis error instead of context
   cancellation
 * ci: expect GitHub App bot as backport PR author


Patch instructions:

   To install this openSUSE security update use the suse recommended installation methods
   like YaST online_update or "zypper patch".
   Alternatively you can run the command listed for your product:

- openSUSE Leap 16.0

   zypper in -t patch openSUSE-Leap-16.0-1094=1

Package List:

- openSUSE Leap 16.0:

  trivy-0.71.2-160000.1.1

References:

  * https://www.suse.com/security/cve/CVE-2026-44740.html
  * https://www.suse.com/security/cve/CVE-2026-46680.html
  * https://www.suse.com/security/cve/CVE-2026-47262.html
  * https://www.suse.com/security/cve/CVE-2026-50195.html
  * https://www.suse.com/security/cve/CVE-2026-53488.html
  * https://www.suse.com/security/cve/CVE-2026-53489.html
  * https://www.suse.com/security/cve/CVE-2026-53492.html