Detections
Analytics
openSUSE 16: crane / crane-bash-completion / crane-fish-completion / etc (openSUSE-SU-2026:22227-1)
high Nessus Plugin ID 376248
Synopsis
The remote openSUSE host is missing one or more security updates.Description
The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22227-1 advisory.Changes in go-containerregistry:
- update vendor.tar to address:
* bsc#1288488, CVE-2026-116591: github.com/klauspost/compress/zstd:
crafted ~27 KB two-block zstd frame makes DecodeAll and the streaming decoder panic
- update to 0.22.1:
* Reject non-canonical IP literals in all SSRF guards
* daemon: fix stale docker/docker reference in WithClient docs
* build(deps): bump the go-deps group across 2 directories with 4 updates
* authn: do not overwrite AuthConfig.Auth when username and password are empty
* build(deps): bump the actions group across 1 directory with 8 updates
* Support pulling images by sha512 digest
* Allow empty label and annotation values in crane mutate
* fix(build): Use dependencies.gitSource in cloudbuild_v2.yaml
* validate: support index attestation manifests and empty configs
* name: improve error when parsing a reference with a URL scheme
* fix(build): install binaries to /ko-app and add to PATH
* fix(release): honor declared Go toolchain
* remote: apply checkRedirectSSRF to writer-side HTTP clients
* flatten: preserve config and layer media types when flattening
* fix(mutate): make Time layer updates lazy
* build(deps): bump the go-deps group across 2 directories with 3 updates
* remote: copy manifest annotations to referrers fallback tag descriptors
- update to 0.22.0:
* mutate: let Time and Canonical take tarball.LayerOption
* build: add multi-architecture Cloud Build configurations for crane, gcrane, and krane
* remote: resolve push-check credentials against the repository
* Allow single-character repository paths
* fix: add missing substitutions and workspace cleanup to new build files
* remote: retry failed Puller and Pusher initialization
* build(deps): bump the actions group across 1 directory with 8 updates
* build(deps): bump the go-deps group across 1 directory with 3 updates
* go.mod: bump Go version + add toolchain directive to replace .go-version file
* fix: Fix new build options and provenance
* fix(build): unify new build flow into cloudbuild_v2.yaml
- update to 0.21.8 (bsc#1283692, CVE-2026-63209):
* The artifacts attached to this release are missing SLSA provenance, see #2390.
* build(deps): bump the go-deps group across 1 directory with 3 updates
* build(deps): bump golang.org/x/crypto from 0.45.0 to 0.52.0 in /cmd/krane
* build(deps): bump golang.org/x/crypto from 0.50.0 to 0.52.0 in /pkg/authn/k8schain
* build(deps): bump golang.org/x/net from 0.49.0 to 0.55.0 in /pkg/authn/kubernetes
* build(deps): bump the go-deps group across 3 directories with 7 updates
* build(deps): bump the actions group across 1 directory with 5 updates
* Reject unsafe Windows archive paths in Extract
* feat(goreleaser): add loong64 build support for crane/gcrane/krane
* Document tag and digest reference semantics
* remote: release pull limiter slot when body is read to EOF
* tarball: bounds-check layer index in uncompressed LayerByDiffID
* authn: read Podman auth from XDG config
* transport: per-host bearer token exchange on cross-host redirect
* mutate: bounds-check layer index when building rebase addendums
* fix(daemon): copy ExposedPorts from source config in computeImageConfig
* feat(remote): add WithReferrersTagFallback option
* mutate: apply opaque-directory whiteouts (.wh..wh..opq) in Extract
* tarball: use correct file extension for zstd/uncompressed
* build(deps): bump github.com/moby/moby/client from 0.5.0 to 0.5.1 in the go-deps group across 1 directory
* actions: update actions to be pinned by hash
* Bump go version to 1.26.5
- update to 0.21.7:
* tarball: return error instead of panicking on missing rootfs.diff_ids
* gcrane: honor --platform flag in copy
* mutate: verify layer digests in Extract and Time
* tarball: close layer readers during Write
* build(deps): bump the actions group across 1 directory with 2 updates
* build(deps): bump github.com/docker/cli from 29.4.3+incompatible to 29.5.2+incompatible in the go-deps group across 1 directory
* BUGFIX: Fail with error when read exceeds maximum
* build(deps): bump the actions group across 1 directory with 2 updates
* fix(name): anchor loopback registry detection
* Reject symlinks in OCI layout blobs
* fix(crane): avoid creating export tar on pull failure
* feat(kubernetes): allow ignoring pull secrets
* fix(name): preserve localhost registry references
* pkg/registry: export ErrNotFound
* pkg/registry: export RedirectError
* build(deps): bump the go-deps group across 1 directory with 2 updates
* build(deps): bump the actions group across 1 directory with 2 updates
* fix: prevent SSRF in google.List() pagination
* internal/gzip: fix goroutine leak in ReadCloserLevel
* fix(transport): apply refreshed bearer token after cross-host redirect
* build(deps): bump the go-deps group across 3 directories with 4 updates
* fix(tarball): normalize paths when matching files
* transport: do not re-attach bearer token after cross-host redirect
* Bump CI go version to 1.26.4
- update to 0.21.6:
* fix: update dependencies to use new azure sdk components
* transport: restore resp.Body in retryError so CheckError can parse it
* pkg/registry: return 202 Accepted for PATCH chunk uploads
* Follow OCI distribution spec for artifactType and annotations
* actions: attach Codecov token to coverage tests on main
* remote: use DeleteScope (with delete action) for manifest deletion
* remote: limit concurrent layer pulls
* pkg/registry: reject corrupt disk blobs
* mutate: close layer readers during export
* crane/flatten: preserve image media type when flattening
* build(deps): bump goreleaser/goreleaser-action from 7.0.0 to 7.2.1 in the actions group across 1 directory
* build(deps): bump go.opentelemetry.io/otel from 1.36.0 to 1.41.0
* build(deps): bump the go-deps group across 3 directories with 6 updates
* Replace go-homedir with os.UserHomeDir
* pkg/name: only treat .localhost as non-HTTPS, not .local
* transport: block unspecified IPs (0.0.0.0, ::) in validateRealmURL
* test(mutate): add Extract round-trip test for filesystem object preservation
* experiments: remove deprecated support for estargz
* build(deps): bump aws-actions/configure-aws-credentials from 6.1.0 to 6.1.1 in the actions group
* fix: limit HTTP response body reads to prevent OOM
* build(deps): bump the go-deps group across 3 directories with 6 updates
* transport: block redirects from token server to private/link- local addresses (SSRF fix)
* pkg/v1/mutate: preserve relative symlinks that stay within rootfs in Extract
* validate: skip non-layer layers
* remote: validate foreign layer URLs to prevent SSRF (fixes #2259)
* remote: block SSRF via private-IP Location headers in blob uploads
* fix(mutate): preserve config blob and layers for non-Docker OCI artifacts
* fix: preserve per-occurrence layer identity in mutate.Image.Layers()
* transport: retry HTTP 429 (Too Many Requests)
* transport: allow bearer realm at same host:port as registry
* Update go version to 1.26.3
- update to 0.21.5:
* Bump docker/cli v29.4.0, moby/api v1.54.1, moby/client v0.4.0
* update to Go 1.26.2
* Bump aws-actions/configure-aws-credentials from 6.0.0 to 6.1.0 in the actions group across 1 directory
* build(deps): bump golang.org/x/tools from 0.43.0 to 0.44.0 in the go-deps group across 1 directory
* **Full Changelog**: https://github.com/google/go- containerregistry/compare/v0.21.4...v0.21.5
- update to 0.21.4:
* go.mod: do not make a viral minimum go version
* Avoid pruning absolute links from extracted and flattened images
* Bump the go-deps group across 3 directories with 5 updates
* fix: update to go1.25.8, and use separate .go-version file
* Bump CI go version to 1.26.1
* Bump codecov/codecov-action from 5.5.2 to 5.5.3 in the actions group
* fork distribution client v3 auth-challenge as an internal package (squashed)
* transport: validate Bearer realm URL to prevent SSRF
* revert path traversal and symlink escape from #2227
* Fix pkg/v1/google/auth tests for arm64
* goreleaser: Update goreleaser config and GH action
- update to 0.21.3:
* Adds local file support to the `crane index` subcommand
* migrate to github.com/moby/moby modules
* Bump the go-deps group across 4 directories with 7 updates
* Bump goreleaser/goreleaser-action from 6.4.0 to 7.0.0 in the actions group
* mutate: reject path traversal and symlink escape in Extract
* tarball: detect symlink cycles in extractFileFromTar
* bump golang to 1.25.7
- update to 0.21.2:
* Better handle redirects to https in ping
* **Full Changelog**: https://github.com/google/go- containerregistry/compare/v0.21.1...v0.21.2
- update to 0.21.1:
* Add WithFileBufferedOpener for file-backed daemon image buffering
* crane: fix case in auth response json
- update to 0.21.0:
* fix(mutate): don't skip dir replacements via whiteout in export
* Improve performance of v1.NewHash
* Bump the actions group across 1 directory with 4 updates
* Bump the root-deps group across 1 directory with 7 updates
* Fix error messages in crane_test.go
* Bump go version across packages to 1.25.6
* Join go.mod dependency updates
* Bump the go-deps group across 3 directories with 3 updates
* Disable taint gosec lints
* Update go version used in goreleaser
- update to 0.20.7:
* Fix ArgsEscaped lint directive
* transport: Fix broken links to distribution docs
* fix(remote): using customized retry predicate func if provided
* Adding docker file
* crane: Add timestamp to flatten layer
* feat(remote): pass retryBackoff option to transport
* Expose clobber refusal error
* Build artifacts for riscv64
* Update dependencies and deprecate DockerVersion field
- update to 0.20.7:
* Fix ArgsEscaped lint directive
* transport: Fix broken links to distribution docs
* fix(remote): using customized retry predicate func if provided
* Adding docker file
* crane: Add timestamp to flatten layer
* feat(remote): pass retryBackoff option to transport
* Expose clobber refusal error
* Build artifacts for riscv64
* Update dependencies and deprecate DockerVersion field
- update to 0.20.6:
* Ensure that tag name is not empty if name contains colon
* Bump some deps
- update to 0.20.5:
* build(deps): bump docker/docker to v28.0.0+incompatible
* Migrate linter to v2
* bump go version + bump deps
* implement TextMarshaler/JSONMarshaler more consistently
* Update CodeQL permissions
* Update goreleaser permissions
* Update provenance action in release
* Update validator action
- CVE-2025-22868: golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2 (bsc#1239277)
- update to 0.20.3:
* remote/transport: Make bearer transport go-routine-safe
* Expose compare package
* fix: redact.URL uses (*URL).Redacted to omit basic-auth password
* bump actions to latest
* don't pin chainguard-dev/actions
* Check for 406 status code when handling referrers API endpoint response
* mutate: Create a defensive annotations copy
* Detect zstd in crane append
* bump deps using hack/bump-deps.sh
- update to 0.20.2:
* deps: bump docker dep
Tenable has extracted the preceding description block directly from the SUSE security advisory.
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Update the affected packages.See Also
https://bugzilla.suse.com/1239277
https://bugzilla.suse.com/1283692
https://bugzilla.suse.com/1288488
https://www.suse.com/security/cve/CVE-2025-22868
Plugin Details
Severity: High
ID: 376248
File Name: openSUSE-2026-22227-1.nasl
Version: 1.1
Type: Local
Agent: unix
Family: SuSE Local Security Checks
Published: 11/5/2026
Updated: 11/5/2026
Supported Sensors: Frictionless Assessment AWS, Frictionless Assessment Azure, Frictionless Assessment Agent, Nessus Agent, Continuous Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security, Nessus
Risk Information
VPR
Risk Factor: Low
Score: 3
Percentile: 23.73
CVSS v2
Risk Factor: High
Base Score: 7.8
Temporal Score: 5.8
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C
CVSS Score Source: CVE-2026-63209
CVSS v3
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
CVSS v4
Risk Factor: High
Base Score: 8.7
Threat Score: 6.6
Threat Vector: CVSS:4.0/E:U
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS Score Source: CVE-2026-116591
Vulnerability Information
CPE: cpe:/o:novell:opensuse:16.0, p-cpe:/a:novell:opensuse:crane-bash-completion, p-cpe:/a:novell:opensuse:crane-fish-completion, p-cpe:/a:novell:opensuse:crane-zsh-completion, p-cpe:/a:novell:opensuse:crane, p-cpe:/a:novell:opensuse:gcrane-bash-completion, p-cpe:/a:novell:opensuse:gcrane-fish-completion, p-cpe:/a:novell:opensuse:gcrane-zsh-completion, p-cpe:/a:novell:opensuse:gcrane, p-cpe:/a:novell:opensuse:go-containerregistry
Required KB Items: Host/local_checks_enabled, Host/cpu, Host/SuSE/release, Host/SuSE/rpm-list
Exploit Ease: No known exploits are available
Patch Publication Date: 11/3/2026
Vulnerability Publication Date: 2/26/2025