rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.10.50 until 0.10.80, CipherCtxRef::cipher_update_inplace in openssl/src/cipher_ctx.rs incorrectly sized output buffers when used with AES key-wrap-with-padding ciphers EVP_aes_{128,192,256}_wrap_pad. For a non-multiple-of-8 input, OpenSSL writes up to 7 bytes past the end of the caller's buffer or Vec, producing attacker-controllable heap corruption when the plaintext length is attacker-influenced. This issue is fixed in version 0.10.80.

The remote SUSE Linux SLES16 / SLES_SAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:22841-1 advisory.

    - CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length     in rust-       openssl crate (bsc#1270542).
    - CVE-2026-41678: openssl: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270705).
    - CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check in     rust-openssl crate       (bsc#1270747).
    - CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can     leak adjacent       memory in rust-openssl crate (bsc#1270839).
    - CVE-2026-42327: openssl: arbitrary code execution via specially crafted certificate in rust-openssl     crate       (bsc#1270492).
    - CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-     openssl crate       (bsc#1270932).
    - CVE-2026-45784: openssl: out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD     ciphers in rust-       openssl crate (bsc#1270952).

    Changes for aws-nitro-enclaves-cli:

    - Update to version 1.4.5.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21406-1 advisory.

    - CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length     in rust-       openssl crate (bsc#1270542).
    - CVE-2026-41678: openssl: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270705).
    - CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check in     rust-openssl crate       (bsc#1270747).
    - CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can     leak adjacent       memory in rust-openssl crate (bsc#1270839).
    - CVE-2026-42327: openssl: arbitrary code execution via specially crafted certificate in rust-openssl     crate       (bsc#1270492).
    - CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-     openssl crate       (bsc#1270932).
    - CVE-2026-45784: openssl: out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD     ciphers in rust-       openssl crate (bsc#1270952).

    Changes for aws-nitro-enclaves-cli:

    - Update to version 1.4.5.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21386-1 advisory.

    Update to version 5.10.0.git73.b97f772.

    Security issues fixed:

    - CVE-2026-41676: openssl: `Deriver:derive` and `PkeyCtxRef:derive` can overflow short buffers on OpenSSL     1.1.1       (bsc#1270175).
    - CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length       (bsc#1270555).
    - CVE-2026-41678: openssl: incorrect bounds assertion in `aes::unwrap_key()` can lead to OOB write     (bsc#1270651).
    - CVE-2026-41681: openssl: `MdCtxRef::digest_final()` writes past caller buffer with no length check     (bsc#1270787).
    - CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can     leak adjacent       memory to network peers (bsc#1270817).
    - CVE-2026-42327: openssl: undefined behavior in `X509Ref::ocsp_responders` when processing certificates     with non-UTF-8       OCSP URLs (bsc#1270483).
    - CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding     (bsc#1270886).
    - CVE-2026-45784: openssl: out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD     ciphers       (bsc#1270949).
    - CVE-2026-25541: bytes: integer overflow in `BytesMut:reserve` can lead to undefined behavior and crashes       (bsc#1271348).

    Other updates and bugfixes:

    - Version 5.10.0.git73.b97f772:
      * build(deps): bump anyhow from 1.0.99 to 1.0.103         https://github.com/coreos/afterburn/pull/1284
      * build(deps): bump libflate from 2.1.0 to 2.2.2         https://github.com/coreos/afterburn/pull/1283
      * build(deps): bump openssl from 0.10.79 to 0.10.80         https://github.com/coreos/afterburn/pull/1277
    - Version 5.10.0.git70.9cc2a7b:
      * build(deps): bump openssl from 0.10.78 to 0.10.79
      * providers/hetzner: Add the HETZNER_PUBLIC_IPV6 attribute
      * providers/hetzner: Add support for network configuration
      * build(deps): bump rustls-webpki from 0.103.10 to 0.103.13
      * build(deps): bump openssl from 0.10.73 to 0.10.78
      * docs: Add AGENTS.md and CLAUDE.md for AI coding assistants
      * build(deps): bump rand from 0.9.2 to 0.9.4
      * opencode: add skills for provider scaffolding and release automation
      * ibmcloud-classic: Add missing network_id to fixture
      * kubevirt: Support static gateway and DNS with DHCP
      * build(deps): bump rustls-webpki from 0.103.6 to 0.103.10
      * fix(proxmoxve): Define DNS entries for every interface
      * Makefile: download `90-afterburn-authorized-keys-file.conf` for rpm building
      * Sync repo templates 
      * build(deps): bump bytes from 1.10.1 to 1.11.1
      * util/dhcp: Fix clippy lints
      * build(deps): bump actions/checkout from 4 to 6
      * build(deps): bump actions/upload-artifact from 4 to 5
      * kubevirt: modprobe for virtio_blk; remove dracut preload
      * kubevirt: Add NoCloud network configuration support
      * kubevirt: Support config drive network data
      * kubevirt: Refactor the provider to follow the proxmoxve structure
      * dracut: Add virtio_blk module preload to afterburn-network-kargs service
      * docs: Add release notes
      * cargo: Afterburn release 5.10.0
    - Version 5.10.0:
      * docs/release-notes: update for release 5.10.0
      * cargo: update dependencies
      * microsoft/azure: Add XML attribute alias for serde-xml-rs Fedora compat
      * docs/release-notes: Add entry for Azure SharedConfig XML parsing fix
      * microsoft/azure: Fix SharedConfig parsing of XML attributes
      * microsoft/azure: Mock goalstate.SharedConfig output in tests
      * providers/azure: switch SSH key retrieval from certs endpoint to IMDS
      * build(deps): bump the build group with 8 updates
      * build(deps): bump slab from 0.4.10 to 0.4.11
      * build(deps): bump actions/checkout from 4 to 5
      * upcloud: implement UpCloud provider
      * build(deps): bump the build group with 4 updates

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3152-1 advisory.

    This update for aws-nitro-enclaves-cli fixes the following issues

    - CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length       (bsc#1270542).
    - CVE-2026-41678: openssl: OOB write due to incorrect bounds assertion in `aes::unwrap_key()`     (bsc#1270705).
    - CVE-2026-41681: openssl: stack corruption due to `MdCtxRef::digest_final()` writing past caller buffer     with no length       check (bsc#1270747).
    - CVE-2026-41898: openssl: information leak to network peers due to unchecked callback-returned length in     PSK and       cookie generate trampolines (bsc#1270839).
    - CVE-2026-42327: openssl: undefined behavior in `X509Ref::ocsp_responders` when processing certificates     with non-UTF-8       OCSP URLs (bsc#1270492).
    - CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding     (bsc#1270932).
    - CVE-2026-45784: openssl: out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD     ciphers due to       incorrectly sized output buffers (bsc#1270952).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - rust-openssl provides OpenSSL bindings for the Rust programming language. From 0.10.50 until 0.10.80,     CipherCtxRef::cipher_update_inplace in openssl/src/cipher_ctx.rs incorrectly sized output buffers when     used with AES key-wrap-with-padding ciphers EVP_aes_{128,192,256}_wrap_pad. For a non-multiple-of-8 input,     OpenSSL writes up to 7 bytes past the end of the caller's buffer or Vec, producing attacker-controllable     heap corruption when the plaintext length is attacker-influenced. This issue is fixed in version 0.10.80.
    (CVE-2026-45784)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3040-1 advisory.

    - CVE-2026-41676: openssl: `Deriver:derive` and `PkeyCtxRef:derive` can overflow short buffers on OpenSSL     1.1.1       (bsc#1270208).
    - CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length       (bsc#1270620).
    - CVE-2026-41678: openssl: out-of-bounds write due to incorrect bounds assertion in `aes::unwrap_key()`     (bsc#1270706).
    - CVE-2026-41681: openssl: `MdCtxRef::digest_final()` writes past caller buffer with no length check     (bsc#1270772).
    - CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can     leak adjacent       memory to the network (bsc#1270801).
    - CVE-2026-42327: openssl: undefined behavior in `X509Ref::ocsp_responders` for certificates with non-     UTF-8 OCSP URLs       (bsc#1270515).
    - CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding due to     incorrectly sized       output buffers (bsc#1270936).
    - CVE-2026-45784: openssl: out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD     ciphers due to       incorrectly sized output buffer (bsc#1270994).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3026-1 advisory.

    This update for python-cryptography fixes the following issues

    - CVE-2026-41676: openssl: `Deriver:derive` and `PkeyCtxRef:derive` can overflow short buffers on OpenSSL     1.1.1       (bsc#1270208).
    - CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length     in rust-       openssl crate (bsc#1270620).
    - CVE-2026-41678: openssl: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270706).
    - CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check in     rust-openssl crate       (bsc#1270772).
    - CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can     leak adjacent       memory in rust-openssl crate (bsc#1270801).
    - CVE-2026-42327: openssl: arbitrary code execution via specially crafted certificate in rust-openssl     crate       (bsc#1270515).
    - CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-     openssl crate       (bsc#1270936).
    - CVE-2026-45784: openssl: out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD     ciphers in rust-       openssl crate (bsc#1270994).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3022-1 advisory.

    Update to version 0.15.0~17.

    - CVE-2023-26964: hyper,h2: high resource consumption due to stream stacking when H2 component processes       `HTTP2 RST_STREAM` frames (bsc#1210346).
    - CVE-2024-32650: rust-rustls: infinite loop in `rustls::conn::ConnectionCommon:complete_io()` when     processing client       input network input (bsc#1223238).
    - CVE-2025-3416: openssl: use-after-free in `Md::fetch` and `Cipher::fetch` (bsc#1242611).
    - CVE-2026-25727: time: stack exhaustion in the RFC 2822 date parser when processing certain user provided     input       (bsc#1257923).
    - CVE-2026-41676: openssl: short buffer overflow via `Deriver:derive` and `PkeyCtxRef:derive` when using     OpenSSL 1.1.1       (bsc#1270206).
    - CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length       (bsc#1270559).
    - CVE-2026-41678: openssl: OOB write due to incorrect bounds assertion in `aes::unwrap_key()`     (bsc#1270693).
    - CVE-2026-41681: openssl: stack corruption due to `MdCtxRef::digest_final()` writing past caller buffer     with no length       check (bsc#1270736).
    - CVE-2026-41898: openssl: information leak to network peers due to unchecked callback-returned length in     PSK and       cookie generate trampolines (bsc#1270869).
    - CVE-2026-42327: openssl: undefined behavior in `X509Ref::ocsp_responders` when processing certificates     with non-UTF-8       OCSP URLs (bsc#1270512).
    - CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding     (bsc#1270938).
    - CVE-2026-45784: openssl: out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD     ciphers       (bsc#1270948).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES16 / SLES_SAP16 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:22583-1 advisory.

    Update to version 0.2.9+49.

    Security issues fixed:

    - CVE-2026-41676: openssl: `Deriver:derive` and `PkeyCtxRef:derive` can overflow short buffers on OpenSSL     1.1.1       (bsc#1270174).
    - CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length       (bsc#1270614).
    - CVE-2026-41678: openssl: out-of-bounds write due to incorrect bounds assertion in `aes::unwrap_key()`     (bsc#1270699).
    - CVE-2026-41681: openssl: `MdCtxRef::digest_final()` writes past caller buffer with no length check     (bsc#1270792).
    - CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can     leak adjacent       memory to the network (bsc#1270842).
    - CVE-2026-42327: openssl: undefined behavior in `X509Ref::ocsp_responders` for certificates with non-     UTF-8 OCSP URLs       (bsc#1270523).
    - CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding due to     incorrectly sized       output buffers (bsc#1270903).
    - CVE-2026-45784: openssl: out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD     ciphers due to       incorrectly sized output buffer (bsc#1270999).

    Other updates and bugfixes:

    - Update openssl to 0.10.81.
    - Make tss-esai-sys depend on bindgen 72.1 to support llvm > 21.
    - Build with Clang <= 21 (bsc#1260596).
    - Version 0.2.9+49:
      * build(deps): bump uuid from 1.23.3 to 1.23.4
      * build(deps): bump syn from 2.0.117 to 2.0.118
      * build(deps): bump openssl from 0.10.80 to 0.10.81
      * build(deps): bump rand from 0.9.4 to 0.10.1
      * Added new regression test into packit-ci.yaml
      * build(deps): bump actions/checkout from 6 to 7
      * build(deps): bump uuid from 1.23.1 to 1.23.3
      * build(deps): bump log from 0.4.29 to 0.4.32
      * build(deps): bump http from 1.4.0 to 1.4.2
      * build(deps): bump codecov/codecov-action from 6 to 7
      * build(deps): bump retry-policies from 0.5.1 to 0.5.2
      * fix: Remove unused base64::Engine import in context_info tests
      * build(deps): bump reqwest-middleware from 0.5.1 to 0.5.2
      * build(deps): bump serde_json from 1.0.149 to 1.0.150
      * build(deps): bump openssl from 0.10.79 to 0.10.80
      * agent: Hash agent ID before TPM2_Certify qualifying data
      * cargo: Bump tss-esapi, picky-asn1-x509, and picky-asn1-der
      * build(deps): bump openssl from 0.10.78 to 0.10.79
      * build(deps): bump once_cell from 1.21.3 to 1.21.4
      * build(deps): bump tempfile from 3.23.0 to 3.27.0
      * push-model: cache UEFI event log bytes at startup
      * build(deps): bump quote from 1.0.40 to 1.0.45
      * build(deps): bump chrono from 0.4.42 to 0.4.44
      * build(deps): bump openssl from 0.10.73 to 0.10.78
      * build(deps): bump serde_json from 1.0.143 to 1.0.149
      * build(deps): bump syn from 2.0.106 to 2.0.117
      * build(deps): bump libc from 0.2.175 to 0.2.184
      * build(deps): bump rand from 0.9.2 to 0.9.4
    - Version 0.2.9+21:
      * tests: use Express-style named params in Mockoon endpoints
      * build(deps): bump pest_derive from 2.8.1 to 2.8.6
      * build(deps): bump trybuild from 1.0.110 to 1.0.115
      * build(deps): bump log from 0.4.28 to 0.4.29
      * build(deps): bump uuid from 1.19.0 to 1.20.0
      * build(deps): bump codecov/codecov-action from 5 to 6
      * build(deps): bump tracing-subscriber from 0.3.20 to 0.3.23
      * build(deps): bump cfg-if from 1.0.3 to 1.0.4
      * build(deps): bump tokio from 1.49.0 to 1.50.0
      * build(deps): bump actix-web from 4.12.1 to 4.13.0
      * build(deps): bump anyhow from 1.0.99 to 1.0.102
      * build(deps): bump clap from 4.5.57 to 4.5.60
      * build(deps): bump tracing from 0.1.36 to 0.1.44

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21292-1 advisory.

    This update for agama fixes the following issues

    - CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length     in rust-       openssl crate (bsc#1270602).
    - CVE-2026-41678: openssl: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270678).
    - CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check in     rust-openssl crate       (bsc#1270784).
    - CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can     leak adjacent       memory in rust-openssl crate (bsc#1270850).
    - CVE-2026-42327: openssl: arbitrary code execution via specially crafted certificate in rust-openssl     crate       (bsc#1270526).
    - CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-     openssl crate       (bsc#1270891).
    - CVE-2026-45784: openssl: out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD     ciphers in rust-       openssl crate (bsc#1270992).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21294-1 advisory.

    This update for python-cryptography fixes the following issues

    - CVE-2026-41676: openssl: `Deriver:derive` and `PkeyCtxRef:derive` can overflow short buffers on OpenSSL     1.1.1       (bsc#1270208).
    - CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length       (bsc#1270620).
    - CVE-2026-41678: openssl: out-of-bounds write due to incorrect bounds assertion in `aes::unwrap_key()`     (bsc#1270706).
    - CVE-2026-41681: openssl: `MdCtxRef::digest_final()` writes past caller buffer with no length check     (bsc#1270772).
    - CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can     leak adjacent       memory to the network (bsc#1270801).
    - CVE-2026-42327: openssl: undefined behavior in `X509Ref::ocsp_responders` for certificates with non-     UTF-8 OCSP URLs       (bsc#1270515).
    - CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding due to     incorrectly sized       output buffers (bsc#1270936).
    - CVE-2026-45784: openssl: out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD     ciphers due to       incorrectly sized output buffer (bsc#1270994).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21285-1 advisory.

    This update for python-maturin fixes the following issues

    - CVE-2026-41676: openssl: `Deriver:derive` and `PkeyCtxRef:derive` can overflow short buffers on OpenSSL     1.1.1       (bsc#1270208).
    - CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length       (bsc#1270620).
    - CVE-2026-41678: openssl: out-of-bounds write due to incorrect bounds assertion in `aes::unwrap_key()`     (bsc#1270706).
    - CVE-2026-41681: openssl: `MdCtxRef::digest_final()` writes past caller buffer with no length check     (bsc#1270772).
    - CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can     leak adjacent       memory to the network (bsc#1270801).
    - CVE-2026-42327: openssl: undefined behavior in `X509Ref::ocsp_responders` for certificates with non-     UTF-8 OCSP URLs       (bsc#1270515).
    - CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding due to     incorrectly sized       output buffers (bsc#1270936).
    - CVE-2026-45784: openssl: out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD     ciphers due to       incorrectly sized output buffer (bsc#1270994).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21274-1 advisory.

    Update to version 0.2.9+49.

    Security issues fixed:

    - CVE-2026-41676: openssl: `Deriver:derive` and `PkeyCtxRef:derive` can overflow short buffers on OpenSSL     1.1.1       (bsc#1270174).
    - CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length       (bsc#1270614).
    - CVE-2026-41678: openssl: out-of-bounds write due to incorrect bounds assertion in `aes::unwrap_key()`     (bsc#1270699).
    - CVE-2026-41681: openssl: `MdCtxRef::digest_final()` writes past caller buffer with no length check     (bsc#1270792).
    - CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can     leak adjacent       memory to the network (bsc#1270842).
    - CVE-2026-42327: openssl: undefined behavior in `X509Ref::ocsp_responders` for certificates with non-     UTF-8 OCSP URLs       (bsc#1270523).
    - CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding due to     incorrectly sized       output buffers (bsc#1270903).
    - CVE-2026-45784: openssl: out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD     ciphers due to       incorrectly sized output buffer (bsc#1270999).

    Other updates and bugfixes:

    - Update openssl to 0.10.81.
    - Make tss-esai-sys depend on bindgen 72.1 to support llvm > 21.
    - Build with Clang <= 21 (bsc#1260596).
    - Version 0.2.9+49:
      * build(deps): bump uuid from 1.23.3 to 1.23.4
      * build(deps): bump syn from 2.0.117 to 2.0.118
      * build(deps): bump openssl from 0.10.80 to 0.10.81
      * build(deps): bump rand from 0.9.4 to 0.10.1
      * Added new regression test into packit-ci.yaml
      * build(deps): bump actions/checkout from 6 to 7
      * build(deps): bump uuid from 1.23.1 to 1.23.3
      * build(deps): bump log from 0.4.29 to 0.4.32
      * build(deps): bump http from 1.4.0 to 1.4.2
      * build(deps): bump codecov/codecov-action from 6 to 7
      * build(deps): bump retry-policies from 0.5.1 to 0.5.2
      * fix: Remove unused base64::Engine import in context_info tests
      * build(deps): bump reqwest-middleware from 0.5.1 to 0.5.2
      * build(deps): bump serde_json from 1.0.149 to 1.0.150
      * build(deps): bump openssl from 0.10.79 to 0.10.80
      * agent: Hash agent ID before TPM2_Certify qualifying data
      * cargo: Bump tss-esapi, picky-asn1-x509, and picky-asn1-der
      * build(deps): bump openssl from 0.10.78 to 0.10.79
      * build(deps): bump once_cell from 1.21.3 to 1.21.4
      * build(deps): bump tempfile from 3.23.0 to 3.27.0
      * push-model: cache UEFI event log bytes at startup
      * build(deps): bump quote from 1.0.40 to 1.0.45
      * build(deps): bump chrono from 0.4.42 to 0.4.44
      * build(deps): bump openssl from 0.10.73 to 0.10.78
      * build(deps): bump serde_json from 1.0.143 to 1.0.149
      * build(deps): bump syn from 2.0.106 to 2.0.117
      * build(deps): bump libc from 0.2.175 to 0.2.184
      * build(deps): bump rand from 0.9.2 to 0.9.4
    - Version 0.2.9+21:
      * tests: use Express-style named params in Mockoon endpoints
      * build(deps): bump pest_derive from 2.8.1 to 2.8.6
      * build(deps): bump trybuild from 1.0.110 to 1.0.115
      * build(deps): bump log from 0.4.28 to 0.4.29
      * build(deps): bump uuid from 1.19.0 to 1.20.0
      * build(deps): bump codecov/codecov-action from 5 to 6
      * build(deps): bump tracing-subscriber from 0.3.20 to 0.3.23
      * build(deps): bump cfg-if from 1.0.3 to 1.0.4
      * build(deps): bump tokio from 1.49.0 to 1.50.0
      * build(deps): bump actix-web from 4.12.1 to 4.13.0
      * build(deps): bump anyhow from 1.0.99 to 1.0.102
      * build(deps): bump clap from 4.5.57 to 4.5.60
      * build(deps): bump tracing from 0.1.36 to 0.1.44

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2832-1 advisory.

    This update for rustup fixes the following issues

    Security issues:

    - CVE-2024-12224: idna: idna accepts Punycode labels that do not produce any non-ASCII when decoded     (bsc#1243862).
    - CVE-2025-58160: tracing-subscriber: Tracing log pollution (bsc#1249008).
    - CVE-2026-41676: openssl: `Deriver:derive` and `PkeyCtxRef:derive` can overflow short buffers on OpenSSL     1.1.1       (bsc#1270186).
    - CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length     in rust-       openssl crate (bsc#1270619).
    - CVE-2026-41678: openssl: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270644).
    - CVE-2026-41681: openssl: MdCtxRef::digest_final() writes past caller buffer with no length check in     rust-openssl crate       (bsc#1270795).
    - CVE-2026-41898: openssl: unchecked callback-returned length in PSK and cookie generate trampolines can     leak adjacent       memory in rust-openssl crate (bsc#1270870).
    - CVE-2026-42327: openssl: arbitrary code execution via specially crafted certificate in rust-openssl     crate       (bsc#1270521).
    - CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-     openssl crate       (bsc#1270874).
    - CVE-2026-45784: openssl: out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD     ciphers in rust-       openssl crate (bsc#1270989).
    - rust-shlex: Multiple issues involving quote API ( RUSTSEC-2024-0006, GHSA-r7qv-8r2h-pg27) (bsc#1230032).

    Non security issue:

    - devel:languages:rust/rustup: Missing symlink for rust-analyzer (bsc#1203257).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
330288	SUSE SLES16: aws-nitro-enclaves-binaryblobs-upstream / aws-nitro-enclaves-cli / etc (SUSE-SU-2026:22841-1)	Nessus	SuSE Local Security Checks	critical
329720	openSUSE 16: aws-nitro-enclaves-binaryblobs-upstream / aws-nitro-enclaves-cli / etc (openSUSE-SU-2026:21406-1)	Nessus	SuSE Local Security Checks	critical
329301	openSUSE 16 Security Update : afterburn (openSUSE-SU-2026:21386-1)	Nessus	SuSE Local Security Checks	critical
328902	SUSE SLES15: aws-nitro-enclaves-binaryblobs-upstream / aws-nitro-enclaves-cli / etc (SUSE-SU-2026:3152-1)	Nessus	SuSE Local Security Checks	critical
327789	Linux Distros Unpatched Vulnerability : CVE-2026-45784	Nessus	Misc.	medium
327313	SUSE SLES15 Security Update : python-cryptography (SUSE-SU-2026:3040-1)	Nessus	SuSE Local Security Checks	critical
327307	SUSE SLED15 / SLES15 Security Update : python-cryptography (SUSE-SU-2026:3026-1)	Nessus	SuSE Local Security Checks	critical
327293	SUSE SLED15 / SLES15 Security Update : sccache (SUSE-SU-2026:3022-1)	Nessus	SuSE Local Security Checks	critical
326983	SUSE SLES16 Security Update : rust-keylime (SUSE-SU-2026:22583-1)	Nessus	SuSE Local Security Checks	critical
326686	openSUSE 16: agama / agama-autoinstall / agama-cli / agama-cli-bash-completion / etc (openSUSE-SU-2026:21292-1)	Nessus	SuSE Local Security Checks	critical
326672	openSUSE 16 Security Update : python-cryptography (openSUSE-SU-2026:21294-1)	Nessus	SuSE Local Security Checks	critical
326670	openSUSE 16 Security Update : python-maturin (openSUSE-SU-2026:21285-1)	Nessus	SuSE Local Security Checks	critical
326416	openSUSE 16 Security Update : rust-keylime (openSUSE-SU-2026:21274-1)	Nessus	SuSE Local Security Checks	critical
326333	SUSE SLES15 Security Update : rustup (SUSE-SU-2026:2831-1)	Nessus	SuSE Local Security Checks	critical
326320	SUSE SLED15 / SLES15 Security Update : rustup (SUSE-SU-2026:2832-1)	Nessus	SuSE Local Security Checks	critical

Detections

Analytics

CVE-2026-45784

medium

Tenable Plugins

critical

critical

critical

critical

medium

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical