Threats Tagged 'cve-2026-56855'

A medium severity heap out-of-bounds read vulnerability (CVE-2026-2303) was found in the GSSAPI error handling of the go.mongodb.org mongo-driver dependency used by Apptainer. The vulnerability is addressed by removing this dependency in a security update for the alloy component. The update also adds support for building the SUID starter on SLES 15. A patch is available for affected versions.

Grafana OSS and Grafana Enterprise did not safely resolve symbolic links when extracting plugin archives. A crafted plugin archive can chain relative symbolic link entries to escape the plugin installation directory, writing arbitrary files and an executable backend binary outside that directory. The dropped executable runs with the privileges of the Grafana server process, resulting in remote code execution. Plugin archives are extracted before their signature is verified, so a valid plugin signature does not prevent the write. An operator can therefore be affected by installing a plugin that appears legitimate, as well as by installing a plugin from an arbitrary archive using grafana-cli, the GF_INSTALL_PLUGINS environment variable, or preinstall configuration. Grafana Enterprise is affected because it includes the same plugin extraction code as Grafana OSS.

Multiple security vulnerabilities affecting the buildah package in Red Hat Enterprise Linux 9 have been identified and fixed. These include denial of service issues in several Go packages (net/http, encoding/asn1, net/url, crypto/tls) and a cross-site scripting vulnerability in Go html/template. The update improves the security of container image building and handling by addressing these issues.

Multiple security issues were addressed in the trivy-0.75.0-1.1 package for openSUSE Tumbleweed, affecting the SUSE trivy product version 0.74.0-160000.3.1. These vulnerabilities impact the containerd container runtime across various Ubuntu package versions. The issues have been fixed in the updated trivy package version 0.75.0-1.1. There are no known exploits in the wild at this time.

A security update for the keybase-client addresses multiple vulnerabilities including authentication bypass and deadlocks in the crypto/ssh library. The update involves patching the affected crypto dependency and upgrading to Go 1.26 to incorporate the updated crypto library. These vulnerabilities are identified by CVE-2026-56854, CVE-2026-56855, and CVE-2026-78662. The issues could potentially allow bypassing authentication mechanisms and cause deadlocks, impacting the reliability and security of the client.

This security update for the hauler component addresses multiple vulnerabilities including authentication bypass and deadlocks in the golang.org/x/crypto/ssh library, as well as denial of service (DoS) issues in google.golang.org/grpc caused by missing ':authority' and 'Host' headers. The update advances hauler to version 2.1.0 and fixes several CVEs (CVE-2026-41888, CVE-2026-56854, CVE-2026-56855, CVE-2026-78662, CVE-2026-84303, CVE-2026-84304, CVE-2026-84445). The vulnerabilities are rated critical and a patch is available. No known exploits in the wild have been reported.

CVE-2026-56855 is a high-severity vulnerability in the golang.org/x/crypto/ssh package that allows a malicious peer to cause a deadlock in an SSH connection by sending crafted messages after the SSH channel is established. The issue arises because the package buffers unexpected messages instead of treating them as protocol errors, leading to blocking behavior. The vulnerability is addressed by explicitly handling all RFC 4254 channel messages and terminating connections upon receiving unexpected messages.

These are all security issues fixed in the kubevirt1.9-container-disk-1.9.0-3.1 package on the GA media of openSUSE Tumbleweed.

This security update for the Trivy tool addresses multiple vulnerabilities across several dependencies, including improper certificate validation, HTTP method override bypass, denial of service via oversized inputs, information disclosure through crafted tarball hardlinks, authentication bypass and deadlocks in SSH libraries, authorization bypass due to header case mismatches, heap memory exhaustion, and denial of service from missing headers in gRPC servers. These issues collectively pose risks ranging from low to potentially higher impact depending on context. The update fixes these issues to improve overall security.

The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback paths, extending the fix for CVE-2026-46595. Permissions returned by the PasswordCallback, KeyboardInteractiveCallback, NoClientAuthCallback, and GSSAPIWithMICConfig.AllowLogin callbacks were not validated against the client's remote address, so a source-address restriction set by those callbacks was silently ignored. The check is now applied to the Permissions returned by any authentication callback.