SUSE-SU-2026:2120-1

Details

Description of the patch:

This update for docker-stable fixes the following issues

CVE-2026-33747: github.com/moby/buildkit: malicious frontends can craft API messages that cause files to be written outside of the BuildKit state directory (bsc#1260967).
CVE-2026-33748: github.com/moby/buildkit: insufficient validation of Git URL fragment subdir components may allow access to files outside the checked-out Git repository (bsc#1261078).

Affected Packages

docker-stable

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP4-LTSSSUSE Linux Enterprise High Performance Computing 15 SP5-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP5-LTSSSUSE Linux Enterprise Module for Containers 15 SP7

Fixed in:

24.0.9_ce-150000.1.42.1

docker-stable-bash-completion

SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP4-LTSSSUSE Linux Enterprise High Performance Computing 15 SP5-ESPOSSUSE Linux Enterprise High Performance Computing 15 SP5-LTSSSUSE Linux Enterprise Module for Containers 15 SP7

Fixed in:

24.0.9_ce-150000.1.42.1

docker-stable-zsh-completion

SUSE Linux Enterprise Module for Containers 15 SP7SUSE Linux Enterprise Server 15 SP6-LTSSSUSE Linux Enterprise Server for SAP Applications 15 SP6

Fixed in:

24.0.9_ce-150000.1.42.1

References

ADVISORY

https://bugzilla.suse.com/1260967

ADVISORY

https://bugzilla.suse.com/1261078

ADVISORY