🛡️ SUSE-SU-2025:3785-1 — afterburn (CVE-2022-24713 +3 more)

Security update for afterburn

This update for afterburn fixes the following issues:

Update to version 5.9.0.git21.a73f509.

Security issues fixed:

• CVE-2022-24713: regex: no proper complexity limitation when parsing untrusted regular expressions with large

repetitions on empty sub-expressions can lead to excessive resource consumption and denial of service (bsc#1196972).

• CVE-2024-12224: idna: acceptance of Punycode labels that do not produce any non-ASCII output may lead to incorrect

hostname comparisons and incorrect URL parsing (bsc#1243850).

• CVE-2025-5791: users: root user being appended to group listings whenever listing does not have exactly 1024 groups

can lead to privilege escalation when information is used for access control (bsc#1244199).

• CVE-2025-3416: openssl: passing of Some(...) value as properties argument to Md::fetch or Cipher::fetch can

lead to use-after-free (bsc#1242665).

Other issues fixed:

• Fixed in version 5.9.0.git21.a73f509:
• cargo: update dependencies
• microsoft/azure: Add XML attribute alias for serde-xml-rs Fedora compat
• microsoft/azure: Fix SharedConfig parsing of XML attributes
• microsoft/azure: Mock goalstate.SharedConfig output in tests
• providers/azure: switch SSH key retrieval from certs endpoint to IMDS as azure stopped providing keys in the old one (bsc#1250471).
• upcloud: implement UpCloud provider
• Update several build dependencies
• Fixed in version 5.9.0:
• cargo: update dependencies
• dracut: Return 255 in module-setup
• oraclecloud: add release note and move base URL to constant
• oraclecloud: implement oraclecloud provider
• Update several build dependencies
• Fixed in version 5.8.2:
• cargo: update dependencies
• packit: add initial support
• Fixed in version 5.7.0.git103.bae893c:
• proxmoxve: Add more context to log messages.
• proxmoxve: Remove unneeded fields
• proxmoxve: Add tests for static network configuration from cloud-init.
• proxmoxve: Add support for static network configuration from cloud-init.
• providers/openstack: ignore ec2 metadata if not present
• proxmox: use noop provider if no configdrive
• Update several build dependencies
• Fixed in version 5.7.0:
• cargo: update dependencies
• dhcp: replace dbus_proxy with proxy, and zbus traits
• providers/hetzner: private ipv4 addresses in attributes
• openstack: Document the two platforms
• microsoft/azure: allow empty certificate chain in PKCS12 file
• proxmoxve: implement proxmoxve provider
• providers/hetzner: fix duplicate attribute prefix
• lint: silence deadcode warnings
• lint: address latest lint's from msrv update
• cargo: update msrv to 1.75
• providers: Add 'akamai' provider
• providers/vmware: add missing public functions for non-amd64
• providers/vmware: Process guestinfo.metadata netplan configuration
• kubevirt: Run afterburn-hostname service
• providers: add support for scaleway
• Move away from deprecated users to uzers
• providers/hetzner: add support for Hetzner Cloud
• cargo: update MSRV to 1.71
• cargo: specify required features for nix dependency
• openstack: Add attribute OPENSTACK_INSTANCE_UUID
• cargo: allow openssl 0.10.46
• build-sys: Use new tier = 2 for cargo-vendor-filterer
• cargo: fix minimum version of openssl crate
• microsoft/crypto/mod: replace deprecated function parse with parse2
• cli: switch to clap derive
• cli: add descriptive value names for option arguments in --help
• cli: have clap require exactly one of --cmdline/--provider
• providers/*: move endpoint mocking into retry::Client
• retry/client: move URL parsing into helper function
• providers/microsoft: import crate::retry
• providers/microsoft: use stored client for all fetches
• providers/packet: use stored client for boot checkin
• initrd: remember to write trailing newline to network kargs file
• util: drop obsolete 'OEM' terminology
• Inline variables into format strings
• Update several build dependencies
• Fixed in version 5.4.1:
• cargo: add configuration for cargo-vendor-filterer
• util: support DHCP option lookup from NetworkManager
• util: factor out retries of DHCP option lookup
• util: refactor DHCP option query helper into an enum
• util: move dns_lease_key_lookup() to a separate module
• cargo: update MSRV to 1.66
• cargo: update all packages to fix build error
• cargo: continue to support openssh-keys 0.5
• cargo: drop serde_derive crate in favor of serde derive feature
• cargo: use consistent declaration syntax for slog dependency
• cargo: drop unused dependencies
• cargo: continue to support base64 0.13
• cargo: continue to support mailparse 0.13.8
• cargo: continue to support clap 3.1
• cargo: stop enabling LTO in release builds
• providers/ibmcloud: avoid error if an ssh key not found in metadata
• systemd: add explicit ordering, after multi-user.target
• network: fix clippy 1.63.0