Alerts This Week
Warning Icon 1 758
Alerts This Week
Warning Icon 1 758

SUSE Linux Enterprise Server important update: rekor fixes and threats

suse
Calendar Grey April 17, 2025
Dist Suse Esm H88
SUSE deploys a vital patch for Rekor tackling multiple issues, including potential data breaches and improvements in resource allocation.
* bsc#1227053 * bsc#1236519 * bsc#1237638 * bsc#1239191 * bsc#1239327

Summary

## This update for rekor fixes the following issues: * CVE-2023-45288: rekor: golang.org/x/net/http2: Fixed close connections when receiving too many headers (bsc#1236519) * CVE-2024-6104: rekor: hashicorp/go-retryablehttp: Fixed sensitive information disclosure inside log file (bsc#1227053) * CVE-2025-22868: rekor: golang.org/x/oauth2/jws: Fixed unexpected memory consumption during token parsing (bsc#1239191) * CVE-2025-22869: rekor: golang.org/x/crypto/ssh: Fixed denial of service in the Key Exchange (bsc#1239327) * CVE-2025-27144: rekor: gopkg.in/go-jose/go-jose.v2,github.com/go-jose/go- jose/v4,github.com/go-jose/go-jose/v3: Fixed denial of service in Go JOSE's parsing (bsc#1237638) * CVE-2025-30204: rekor: github.com/golang-jwt/jwt/v5: Fixed jwt-go allowing

Topics%20covered

Topics Covered

security advisory denial of service information disclosure SUSE memory consumption rekor

References

* bsc#1227053

* bsc#1236519

* bsc#1237638

* bsc#1239191

* bsc#1239327

* bsc#1240468

* jsc#SLE-23476

Cross-

* CVE-2023-45288

* CVE-2024-6104

* CVE-2025-22868

* CVE-2025-22869

* CVE-2025-27144

* CVE-2025-30204

CVSS scores:

* CVE-2023-45288 ( SUSE ): 6.9

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

* CVE-2023-45288 ( SUSE ): 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

* CVE-2024-6104 ( SUSE ): 6.0 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

* CVE-2024-6104 ( NVD ): 5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

* CVE-2025-22868 ( SUSE ): 8.7

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

* CVE-2025-22868 ( SUSE ): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

* CVE-2025-22869 ( SUSE ): 8.2

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2025:1332-1
Release Date: 2025-04-17T01:37:48Z
Rating: important

Topics%20covered

Topics Covered

security advisory denial of service information disclosure SUSE memory consumption rekor

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here