openSUSE 16: sdbootutil / sdbootutil-bash-completion / etc (openSUSE-SU-2026:21933-1)

critical Nessus Plugin ID 350771

Synopsis

The remote openSUSE host is missing one or more security updates.

Description

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21933-1 advisory.

Security issues fixed:

- CVE-2026-41676: `Deriver:derive` and `PkeyCtxRef:derive` can overflow short buffers on OpenSSL 1.1.1 (bsc#1270192).
- CVE-2026-41677: out-of-bounds read in PEM password callback when returning an oversized length in rust- openssl crate (bsc#1270616).
- CVE-2026-41678: incorrect bounds assertion in aes key wrap in rust-openssl crate (bsc#1270670).
- CVE-2026-41681: MdCtxRef::digest_final() writes past caller buffer with no length check in rust-openssl crate (bsc#1270742).
- CVE-2026-41898: unchecked callback-returned length in PSK and cookie generate trampolines can leak adjacent memory in rust-openssl crate (bsc#1270863).
- CVE-2026-42327: arbitrary code execution via specially crafted certificate in rust-openssl crate (bsc#1270471).
- CVE-2026-44662: heap buffer overflow when encrypting with AES key-wrap-with-padding in rust-openssl crate (bsc#1270922).
- CVE-2026-45784: out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers in rust- openssl crate (bsc#1270995).

Non security issues fixed:

- sdbootutil-update-predictions.service fails with Failed to start Update TPM predictions (bsc#1273384).
- systemd ordering cycle and other service problems with snapshot 20260722 (bsc#1272525).
- Unable to unlock multiple encrypted partitions with FIDO2 Key, Systemdboot+LUKS (bsc#1234010).

Changes for sdbootutil:

- Update to version 1+git20260908.c641fc2:
* Update the shim when required
* Warn when recovery PIN is different from recovery key
* Improves extra boot entries support
* Better report when the default snapshot diverges
* Explain how to do re-enrolling if recovery PIN fails
* Explain why update-prediction fails and how to solve it
* Hide comparison output
* Add bootctl default entry in the prediction
- Update to version 1+git20260903.f91f636:
* Include FIDO2 unlocked devices for ordering (bsc#1234010)
* Test in parallel for speed up
* Add --repair parameter to cleanup
* Fix shellcheck complain
* Report entries with missing files
* Avoid duplicate entries in non-snapper systems
* Add initial tests for sdbootutil
* Report the error if bootctl clean fails
- Update to version 1+git20260901.41540d5:
* No warn if a component is not in the event log
* Add status command
* Select the new sdbootutil if available
* Skip blank lines in measure-pcr-generator.sh
* Do not change crypttab for unrelated entries
* Report the bad PCR when update-prediction fail
* Do not write the recovery PIN in the journal
* Improves non snapshot system support
* Update help message for --measure-pcr
* Report when PCR 7 is dropped because shim update
* Add --strict parameter for --pcr policy
* Report dropped PCRs via a warn
* Adjust the limits for PolicyOR issues
* Avoid update predictions if the service is up
* Keep the exit status of sdbootutil call
- Update to version 1+git20260827.786f9a8:
* Do not accept empty passwords
* jeos-firstboot-enroll: report errors also in the journal
* Restore old crypttab via the exit trap
* Update CLAUDE data
* Detect half created openssl keys
* check_enrolled report when something was written in the LUKS2 header
* Improve a bit the disk-encryption-tool keyslot detection
* Avoid leak of env var secrets
* Wipe the d-e-t key in the enroll service and jeos module
* Remove the correct keyslot left by d-e-t
* Differentiate tpm2 and tpm2+pin for unattended unlock
* Use is_same_device in detect_tracked_device and drop greps
* Refactor check to avoid shellcheck complain
* Parse the entry file in a sigle place
* Validate the entry with the new kernel name
* Refactor enrollment interface and deprecate the old one
* New kernels will have different hash
* Warn If no crypttab entry found
* Extend is_same_device
* jeos-firstboot-enroll: validate the passwords
* sdbootutil-enroll: report when no encryption method is provided
* Write recovery pin after enrollment in jeos module
* Write recovery pin after enrollment
* Improve error detection in sdbootutil-enroll
* Increase keyctl timeout
* Merge require_unlock and set_unlock_method
* Be sure that the terminal check works with snapper
* Renerate initrd when new measure-pcr keys are created
* Separate ask-* parameters
* Fix reading credential and keyctl password
* Get the device password for each enrolling mechanism
* Drop elements from crypttab if the enrollment fails
* Validate the enrollment for each method
* Add warning when enrolling FIDO2 token
- Update to version 1+git20260825.c7a5a97:
* Refactor free space calculation
* Do not use /proc/cmdline in half configured systems
* Warning when the recovery PIN is not validated
* Show default and booted snapshots with marks
* Improve detection of snapshot systems
* Fix when searching for a boot entry
* Fix boot order and boot order entry
* Create the entries directory in the ESP
* Fix get_final_pcr parser
* Keep btrfs error and show it when fails
* Fix set -e early exit instances
* Fix measure-pcr-validator when there is no terminal
* Don't include measure-pcr-validator in initrd if TPM2 is not used
* Update predictions even if crypttab did not change
* Improve PCR 15 signing
* Detect NAME=VALUE passed as parameters and complain
* When asking a password, require a terminal
* Filter some warnings from pcrlock
* Detect directories that are not part of the snapshot
* Write bash completion errors to /dev/null
* Detect when t-u apply is done and avoid data corruption
* Detect pcr-oracle leftovers
* Show in title that it's the initial version for transactional systems
* Manually generate PCR7 measurements
* Regenerate pcrlock.json when it is missing
- Update to version 1+git20260813.357956d:
* Do not update the predictions without a TPM2 enrollment (bsc#1273384)
- Update to version 1+git20260812.305d9f2:
* Do not supplement if GRUB2-EFI is installed (bsc#1272525)
- Update to version 1+git20260714.d9bb736:
* tukit: do not fail if service is not found
- Update to version 1+git20260713.d869cf8:
* Ignore errors in the snapper plugin
- Update to version 1+git20260709.7dfd021:
* Remove the background process in the plugin
* Fix missing initrd condition (bsc#1270420)
* After reboot the shutdown service is not active
* Disable the shutdown service after main service
* Update uhmac dependencies (rust-openssl) bsc#1270192, CVE-2026-41676 bsc#1270995, CVE-2026-45784 bsc#1270922, CVE-2026-44662 bsc#1270863, CVE-2026-41898 bsc#1270742, CVE-2026-41681 bsc#1270670, CVE-2026-41678 bsc#1270616, CVE-2026-41677 bsc#1270471, CVE-2026-42327
* Add systemd transient service to update predictions
* Install extra EFI binaries
- Update to version 1+git20260625.7fa275e:
* Remove duplicate code and parametrize timers
* Check boot entry before kernel installation
* Re-install an old kernel if initrd cannot be reused
* Skip installation for already installed kernel
* Add configurable devicetree entry support
* Set explicit kernel and initrd paths
* Remove the full tmpdir in the service
* Fix /run/sdbootutil permissions
* Execute predictions in the background
* Add --disable-predictions parameter
* Fix comparison operator
* Add print-loader-path command

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected packages.

Plugin Details

Severity: Critical

ID: 350771

File Name: openSUSE-2026-21933-1.nasl

Version: 1.1

Type: Local

Agent: unix

Family: SuSE Local Security Checks

Published: 9/26/2026

Updated: 9/26/2026

Supported Sensors: Nessus Agent, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.9

Percentile: 96.92

CVSS v2

Risk Factor: High

Base Score: 9.4

Temporal Score: 7

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:N/A:C

CVSS Score Source: CVE-2026-41677

CVSS v3

Risk Factor: Critical

Base Score: 9.1

Temporal Score: 7.9

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Critical

Base Score: 9.3

Threat Score: 8.1

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CVSS Score Source: CVE-2026-41681

Vulnerability Information

CPE: cpe:/o:novell:opensuse:16.0, p-cpe:/a:novell:opensuse:sdbootutil-bash-completion, p-cpe:/a:novell:opensuse:sdbootutil-dracut-measure-pcr, p-cpe:/a:novell:opensuse:sdbootutil-enroll, p-cpe:/a:novell:opensuse:sdbootutil-jeos-firstboot-enroll, p-cpe:/a:novell:opensuse:sdbootutil-kernel-install, p-cpe:/a:novell:opensuse:sdbootutil-snapper, p-cpe:/a:novell:opensuse:sdbootutil-tukit, p-cpe:/a:novell:opensuse:sdbootutil

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 9/23/2026

Vulnerability Publication Date: 4/22/2026

Reference Information

CVE: CVE-2026-41676, CVE-2026-41677, CVE-2026-41678, CVE-2026-41681, CVE-2026-41898, CVE-2026-42327, CVE-2026-44662, CVE-2026-45784

Detections

Analytics