SUSE alert openSUSE-SU-2026:21151-1 (warewulf4)

From:
             
 
null@suse.de
To:
             
 
security-announce@lists.opensuse.org
Subject:
             
 
openSUSE-SU-2026:21151-1: important: Security update for warewulf4
Date:
             
 
Tue, 30 Jun 2026 09:48:38 +0200
Message-ID:
             
 
<20260630074838.1389CFF4B@maintenance.suse.de>
Archive-link:
             
 
Article
openSUSE security update: security update for warewulf4
-------------------------------------------------------------

Announcement ID: openSUSE-SU-2026:21151-1
Rating: important
References:

  * bsc#1254470
  * bsc#1258511
  * bsc#1262810
  * bsc#1265653
  * bsc#1266483



Cross-References:

  * CVE-2025-58058
  * CVE-2025-69725
  * CVE-2026-33814
  * CVE-2026-34986
  * CVE-2026-39821



CVSS scores:

  * CVE-2025-58058 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
  * CVE-2025-58058 ( SUSE ): 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
  * CVE-2025-69725 ( SUSE ): 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
  * CVE-2025-69725 ( SUSE ): 2.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:L/SI:N/SA:N
  * CVE-2026-33814 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  * CVE-2026-34986 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  * CVE-2026-34986 ( SUSE ): 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
  * CVE-2026-39821 ( SUSE ): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
  * CVE-2026-39821 ( SUSE ): 9.1 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Affected Products:

         openSUSE Leap 16.0

-------------------------------------------------------------

An update that solves 5 vulnerabilities and has 5 bug fixes can now be installed.

Description:

This update for warewulf4 fixes the following issues:

Changes in warewulf4:

- updated go-jose to fix CVE-2026-34986 (bsc#1262810)
- chi is fixed in the upstream project

- updating to v4.7.0 with following security fixes
 * fixed CVE-2026-39821 (bsc#1266483)
 * fixed CVE-2026-33814 (bsc#1265653)
- v4.7.0 with significant changes relative to the v4.6.x series which are:
  * New wwctl unset command
  * Refactored server routes (URLs)
  * New /files/ route for serving individual files and templates
  * Server TLS support
  * Removed support for fetching individual overlays and individual files from overlays
  * Fixed whitespace handling around template functions
  * Security fixes, including updated Go and library versions
- changes from v4.6.5:
  * new wwctl overlay info command
  * fixed wwctl image import --update option
  * cross-arch support for wwclient
  * improved IPv6 support
  * improved support for bonded interfaces
  * renamed debian.interfaces overlay to ifupdown
  * new systemd-networkd overlay
  * warewulf-dracut fixes, including "provision-to-disk" fixes
- remove slurm-overlay package

- fix CVE-2025-69725 (bsc#1258511) by updating chi

- updated to v4.6.5 with following changes:
  * new wwctl overlay info command
  * fixed wwctl image import --update option (bsc#1254470)
  * cross-arch support for wwclient
  * improved IPv6 support
  * improved support for bonded interfaces
  * renamed debian.interfaces overlay to ifupdown
  * new systemd-networkd overlay
  * warewulf-dracut fixes, including "provision-to-disk" fixes
- default to dnsmasq instead of dhcpd and tftp


Patch instructions:

   To install this openSUSE security update use the suse recommended installation methods
   like YaST online_update or "zypper patch".
   Alternatively you can run the command listed for your product:

- openSUSE Leap 16.0

   zypper in -t patch openSUSE-Leap-16.0-packagehub-346=1

Package List:

- openSUSE Leap 16.0:

  warewulf4-4.7.0-bp160.1.1
  warewulf4-dracut-4.7.0-bp160.1.1
  warewulf4-man-4.7.0-bp160.1.1
  warewulf4-overlay-4.7.0-bp160.1.1
  warewulf4-overlay-rke2-4.7.0-bp160.1.1
  warewulf4-reference-doc-4.7.0-bp160.1.1

References:

  * https://www.suse.com/security/cve/CVE-2025-58058.html
  * https://www.suse.com/security/cve/CVE-2025-69725.html
  * https://www.suse.com/security/cve/CVE-2026-33814.html
  * https://www.suse.com/security/cve/CVE-2026-34986.html
  * https://www.suse.com/security/cve/CVE-2026-39821.html