Detections
Analytics

openSUSE 16: sequoia-sq / sequoia-sq-bash-completion / etc (openSUSE-RU-2026:21658-1)

medium Nessus Plugin ID 341180

Synopsis

The remote openSUSE host is missing a security update.

Description

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- RU-2026:21658-1 advisory.

 Changes in sequoia-sq:

 - Legal review Change main license to LGPL-2.0-or-later from GPL-2.0-only
 * LICENSE.txt confirms it
 * Correct Legal-Review-Notice usage

 - Update dependencies due to security issues (CVE-2026-25541 bsc#1274437)

 - Switch crypto backend from nettle to openssl (bsc#1257934)

 - Update to version 1.4.0:
 * Release v1.4.0.
 * Update crossbeam-epoch.
 * Enable optimizations when building rust-crypto crates.
 * tool: canonicalize Ord and PartialOrd impls for Association
 * tool: silence clippy error for potentially mutable Map key types
 * tool: fix formatting to avoid leaking comments into doc strings
 * clippy: allow two types with interior mutability for BTreeSet keys
 * lib: avoid potentially panicking integer cast
 * clippy: add default lint configuration
 * Update NEWS.
 * lib: Improve control char escaping
 * tool: Fix output file's permissions.
 * Gracefully deal with 404 HTTP result codes
 * tool: Don't panic if write fails
 * tool: Restrict file permissions on sensitive output
 * Improve temporary file handling.
 * Forward allow-* crypto features.
 * Relax rusqlite dependency.
 * tool: Add more cipher suites.
 * tool: Add sq key generate --{encryption,signing}-algorithm.
 * Update Cargo.lock.
 * Relax subplot dependency.
 * Relax roff dependency.
 * Relax toml_edit dependency.
 * Upgrade sequoia-wot.
 * Relax indicatif dependency.
 * Relax gethostname dependency.
 * Relax dirs dependency.
 * Relax clap_lex dependency.
 * Update Cargo.lock.
 * meta: Bump MSRV to 1.85.
 * Update signing policy.

 - Update vendored dependencies due to security and build issues

 - Update to version 1.3.1:
 * Release 1.3.1.
 * Fix formatting.
 * Improve documentation of `sq config`.
 * Emit hints to mark an imported key as authenticated or introducer.
 * Hedge against importing keys into the cert store.
 * Improve displaying of preferred user IDs.
 * Fix typo.
 * Display backtraces attached to errors.
 * tests: Avoid DSA key in tests as DSA will be rejected in the future.
 * tests: Update PKI test vectors to not expire.
 * Enable backtraces and tracing when running tests.
 * Make importing Autocrypt certs more robust.
 * Release 1.3.0.
 * Make sq config get print to stdout.
 * Fix early abort in sq keyring filter
 * Fix test sq_verify_policy_as_of_relative_time
 * Fix error message.
 * Prefix matching for --...-self parameters fixed
 * Fix examples.
 * Port to sequoia-openpgp 2.
 * ci: Always build the pages, but only publish when merging to main.
 * Upgrade sequoia-man.
 * Split out the man page generation into a new crate.
 * Update openssl to address RUSTSEC-2025-0004.
 * Update hickory-proto to address RUSTSEC-2025-0006.
 * man: Fix NAME section for subcommands.

 - Update to version 1.2.0:
 * Release 1.2.0.
 * Update Cargo.lock.
 * Use authenticated identifiers in sq verify.
 * Improve quoting.
 * Improve sq download's output.
 * Add a parameter to the authenticate function to control the output.
 * Move helper function to common.
 * Add a mechanism to replace an argument in a hint with a placeholder.
 * Avoid crash parsing arguments to Strings.
 * Make sq cert lint less quiet when there are no issues.
 * Add sq key rotate.
 * Extend replay to optionally take a signer.
 * tests: Move utility function to the common module.
 * Move function to the common module.
 * Extend replay to allow the caller to limit what is replayed.
 * Improve output.
 * Allow the caller to specify an indentation level.
 * Disable tracing.
 * Fix test helper function.
 * Add sq pki vouch replay.
 * Move certification listing code to the common module.
 * Move code in common to the sole function that uses it.
 * Move the sq pki link list implement to its own module.
 * Extend sq pki vouch list to list certifications of a certificate.
 * Improve test.
 * Simplify specifying certificate designators in tests.
 * Require that certificate designators are authenticated.
 * Use an explicit type for the trust amount parameter.
 * Fix sq --cli-version.
 * Improve sq pki link list's help text.
 * Improve error messages.
 * Avoid unnecessary lookups.
 * Relax sq pki link list's certificate designators.
 * Fix examples.
 * Don't export non-exportable sigs and components when exporting keys.
 * Add missing NEWS entry.
 * Fix duplicating packets when dumping.
 * Prevent monomorphization of Sq::resolve_cert.
 * Prevent monomorphization of Sq::resolve_certs_filter.
 * Add new command sq pki vouch list.
 * Move the code for listing certification to common.
 * Release 1.1.0.
 * Relax subplot dependency.
 * Relax rusqlite dependency.
 * Update Cargo.lock.
 * Fix output.
 * Add a lint for uncertified user IDs.
 * Show certificates without user IDs with --gossip.
 * Improve sq cert list's documentation.
 * Improve help text lints.
 * Fix long help generation for cert designators.
 * Update NEWS file.
 * Add option --unusable to sq cert list, etc.
 * Show hints about unusable bindings when --gossip is provided.
 * Change how we refer to unusable bindings in sq cert list.
 * Change sq cert list to not show warnings if --quiet is given.
 * Distinguish unauthenticated and invalid bindings in sq cert list.
 * Improve linting for sq cert list.
 * Don't list revoke user IDs.
 * Fix listing certificates by fingerprint or key ID.
 * Remove duplicate code.
 * Rework sq cert list's human readable output.
 * Improve UserIDDesignator::argument_value.
 * Fix UserIDDesignator::argument_value.
 * Add some helper functions.
 * tests: Add tests for sq cert list.
 * Fix sq cert list --gossip.
 * Fix output.
 * Release 1.0.0.
 * Fix NEWS.
 * Align `sq download` with `sq verify`.
 * Fix displaying preferred user IDs.
 * Write to temporary file first, then persist it under the final name.
 * Avoid using absolute paths in name of scratch files.
 * Automatically import certificates from GnuPG's certificate store.
 * Escape user IDs.
 * Escape preferred keyserver and policy URI.
 * Escape notation name and data.
 * Escape literal data file name and data prefix.
 * Escape all regular expressions.
 * Escape all reason for revocation messages.
 * Improve output sanitization.
 * Use the visual idiom for cert,userid pairs authenticating downloads.
 * Use the visual idiom for cert, userid pairs when decrypting.
 * Use the visual idiom for cert, userid pairs when importing revs.
 * Use the visual idiom for cert, userid pairs when certifying.
 * Improve argument and value formatting in hints.
 * Improve help output.
 * Revert Refine sq pki {authenticate,lookup}'s user ID designators.
 * Fix commands embedded in the documentation.
 * Make verifying detached signatures more efficient.
 * Require sequoia-openpgp 1.22.
 * Fix hint.
 * Refine sq key userid revoke's user ID designators.
 * Refine sq pki vouch {add,authorize}'s user ID designators.
 * Refine sq pki {authenticate,lookup}'s user ID designators.
 * Refine sq pki link retract's user ID designators.
 * Refine sq pki link {add,authorize}'s user ID designators.
 * Add sq pki path --userid-by-email.
 * Gracefully handle unencrypted Autocrypt messages.
 * Align output emitted when importing certificates.
 * Don't unconditionally show provenance messages.
 * Fix importing unencrypted Autocrypt messages.
 * Improve error handling opening the cert store.
 * Do not hide errors from keyrings in verify.
 * Refactor packet and keyring files in /cli to new example framework.
 * Refactor files in /cli/network to new example framework.
 * Refactor files in /cli/pki to new example framework.
 * Refactor files in /cli to new example framework.
 * Remove the unstable CLI warning.
 * Don't make impossible recommendations.
 * Remove useless code.
 * Disable the --name and --add-name arguments.
 * Rename --userid-or-add to --add-userid, etc.
 * Extend and adjust the set of user ID designators.
 * Refactor the user ID designators.
 * Update all dependencies.
 * Fix test.
 * Trim unused features on sequoia-cert-store.
 * Update sequoia-net and reqwest.
 * Add argument `sq network search --iterations`.
 * Add argument `sq network search --use-dane`.
 * Add argument `sq network search --use-wkd`.
 * Better handle user ID's matched by --all.
 * Make --all conflict with other user ID designators.
 * Fix test for sq pki link retract.
 * Make `sq cert list` display certificates without user IDs.
 * Prepare for userid-less certificates in common::pki::authenticate.
 * Split OutputFormat::add_paths into two functions.
 * Fix listing certificates without authenticated bindings.
 * Apply the input lints to all certs.
 * Only show hints about an empty cert store if it is indeed empty.
 * Change `sq config inspect policy` to explain the policy.
 * Fix warnings about elided lifetimes that have a name.
 * Add tests for sq key approvals update.
 * tests: Improve sq key approvals update help functions.
 * Add tests for sq key approvals list.
 * Add tests for sq key userid revoke.
 * Add tests for sq pki lookup.
 * Add tests for sq pki authenticate.
 * Add tests for sq pki vouch {add,authorize}.
 * tests: Rename Sq::pki_vouch_authorize_p.
 * tests: Simplify Sq::try_pki_vouch_add and Sq::pki_vouch_authorize_p.
 * Add tests for sq pki link retract.
 * Add tests for sq pki link authorize.
 * Add tests for sq pki link add.
 * Simplify comments.
 * Lint CLI help texts.
 * Align CLI help texts with our UI guidelines.
 * Make long help texts configurable for cert designators.
 * Deduplicate and rework the signature notation argument handling.
 * Require explicit opt-out for encrypting without signing.
 * Use cert designators for `sq cert list`.
 * Add examples for `sq cert list`
 * Refactor files in /cli/cert to new example framework
 * Modify examples
 * Refactor files under .../cli/key to use example framework
 * Fix generation of user ID-less keys.
 * Upgrade hickory-proto to avoid vulnerable idna 0.4.0.
 * Gracefully handle missing ui section in config file.
 * Add `sq encrypt --profile` in preparation for RFC9580.
 * Add `sq key generate --profile` in preparation for RFC9580.
 * Parse key.generate.cipher-suite case sensitively.
 * Mention the configuration key in the augmented help texts.
 * Make `sq network dane generate` require cert designators or `--all`.
 * Make `sq pki link list` fail if a designated cert has no link.
 * Refactor user ID matching when resolving certificates.
 * Generalize the filter for `Sq::resolve_certs_filter.
 * Align `sq sign --detached-file` with `sq verify --detached-file`.
 * Make the default third-party certification expiration configurable.
 * Introduce a specialization for third-party certifications.
 * Make ExpirationArg configurable.
 * Manually implement clap::Args for ExpirationArg.
 * Add tests for sq pki link list.
 * Add tests for sq key list.
 * Listing an empty certificate store should not be an error.
 * Fix hint.
 * Hide --without-password from the sq key generate examples.
 * Make it possible to hide parts of an example.
 * Change the default third-party certification expiration to 10y.
 * Implement `sq pki vouch {add,authorize} --certifier-self`.
 * Improve the `--self-signer` help texts and add to the template.
 * Add a pattern argument to `sq pki link list`.
 * Add missing conflict for `sq key list`.
 * Change sq config inspect network to use stdout.
 * Change sq config inspect paths to use stdout.
 * Change sq cert import and sq key import to use stdout.
 * Improve sq network wkd publish's output.
 * Change sq network wkd publish to use stdout.
 * Convert a hint to a warning.
 * Change sq network keyserver publish to use stdout.
 * Change sq pki link add, etc. to use stdout.
 * Generalize make_qprintln to write to a different stream.
 * Change sq pki link list to use stdout.
 * Before printing a hint, flush stdout.
 * Change sq cert list, sq pki authenticate, etc. to use stdout.
 * Generalize the authentication output routines to use any stream.
 * Change sq key approvals list to use stdout.
 * Change sq key list to use stdout.
 * Add new macro wwrintln.
 * Generalize weprintln and iweprintln to write to any stream.
 * Rename wprintln to weprintln.
 * Clean up sq key list's output.
 * Implement `sq config inspect network`.
 * Implement `sq config inspect paths`.
 * Implement `sq config inspect policy`.
 * Make `sq key list` fail without key store, align error messages.
 * Align error messages when listing certs.
 * Import the secret key so that the example has something to list.
 * Change sq inspect to show the cert associated with a recipient.
 * policy: Update certificates.
 * Simplify code.
 * Remove unreachable code.
 * Fix resolving `--signer-self`.
 * Improve formatting of message.
 * Implement `sq sign --signer-self` and `sq encrypt --signer-self`.
 * Make the number of iterations configurable for `sq network search`.
 * Make use of DANE configurable when doing `sq network search`.
 * Make use of WKD configurable when doing `sq network search`.
 * Make the path to the backend servers configurable.
 * Fix displaying effective configuration.
 * Make hints configurable.
 * Generalize function.
 * Make verbosity configurable.
 * Introduce accessors for sq.quiet and sq.verbose.
 * Use platform-specific prompt in hints.
 * Indent hints so that they look different from shell prompts.
 * Improve the `--for-self` encryption hint.
 * Don't show hint if a recipient is listed in encrypt.for-self.
 * Don't explicitly create `Recipient`s.
 * Show the configuration file's location in sq config --help.
 * Fix message.
 * Display a hint if encrypting a message that one can not decrypt.
 * Implement `sq encrypt --for-self`.
 * When encrypting a message, list signers.
 * When encrypting a message, list recipients and passwords.
 * Use BufferedReader::copy to avoid an extra copy.
 * Rework encryption subkey selection.
 * Fix handling of `--home=default` and `--home=none`.
 * Drop superfluous mut.
 * Align user ID designators in `sq pki link retract`.
 * Add support for addressing shadow CAs by symbolic names.
 * Make `sq config get policy.path` reflect SEQUOIA_CONFIG_POLICY.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the affected sequoia-sq, sequoia-sq-bash-completion, sequoia-sq-fish-completion and / or sequoia-sq-zsh- completion packages.

See Also

https://bugzilla.suse.com/1257934

https://bugzilla.suse.com/1274437

https://www.suse.com/security/cve/CVE-2026-25541

Plugin Details

Severity: Medium

ID: 341180

File Name: openSUSE-RU-2026-21658-1.nasl

Version: 1.1

Type: Local

Agent: unix

Published: 8/28/2026

Updated: 8/28/2026

Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Continuous Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.72

CVSS v2

Risk Factor: High

Base Score: 7.8

Temporal Score: 6.1

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C

CVSS Score Source: CVE-2026-25541

CVSS v3

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 6.9

Threat Score: 5.5

Threat Vector: CVSS:4.0/E:P

Vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Vulnerability Information

CPE: cpe:/o:novell:opensuse:16.0, p-cpe:/a:novell:opensuse:sequoia-sq-bash-completion, p-cpe:/a:novell:opensuse:sequoia-sq-fish-completion, p-cpe:/a:novell:opensuse:sequoia-sq-zsh-completion, p-cpe:/a:novell:opensuse:sequoia-sq

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 8/25/2026

Vulnerability Publication Date: 2/3/2026

Reference Information

CVE: CVE-2026-25541