Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges×
Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Loading...
Explore Latest Linux Security advisories
We found -3 articles for you...
202
security advisorybug fixlowopenSUSE helm Low Credential Exfiltration Issue CVE-2026-48978 2026-21331-1
An update that solves one vulnerability and has one bug fix can now be installed.. openSUSE security update: security update for helm ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21331-1 Rating: low References: * bsc#1270127 Cross-References: * CVE-2026-48978 CVSS scores: * CVE-2026-48978 ( SUSE ): 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N * CVE-2026-48978 ( SUSE ): 2.1 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N Affected Products: openSUSE Leap 16.0 ------------------------------------------------------------- An update that solves one vulnerability and has one bug fix can now be installed. Description: This update for helm fixes the following issue - CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens (bsc#1270127). Changes for helm: - Update to version 3.21.2. Patch instructions: To install this openSUSE security update use the suse recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - openSUSE Leap 16.0 zypper in -t patch openSUSE-Leap-16.0-1235=1 Package List: - openSUSE Leap 16.0: helm-3.21.2-160000.2.1 helm-bash-completion-3.21.2-160000.2.1 helm-fish-completion-3.21.2-160000.2.1 helm-zsh-completion-3.21.2-160000.2.1 References: * https://www.suse.com/security/cve/CVE-2026-48978.html . Learn about the low-severity update for openSUSE helm addressing credential exfiltration vulnerabilities and a bug fix.. openSUSE update, helm security, credential hijacking, security patch. . Severity: Low. LinuxSecurity.com Team
Jul 15, 2026
•Low
OpenSUSE
100
security advisorysecurity issueSuSESUSE 2026-2823-1 helm Important Credential Exfiltration Risks
An update that solves two vulnerabilities can now be installed.. # Security update for helm Announcement ID: SUSE-SU-2026:2823-1 Release Date: 2026-07-09T18:14:15Z Rating: important References: * bsc#1266598 * bsc#1270127 Cross-References: * CVE-2026-39821 * CVE-2026-48978 CVSS scores: * CVE-2026-39821 ( SUSE ): 9.1 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N * CVE-2026-39821 ( SUSE ): 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N * CVE-2026-39821 ( NVD ): 9.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N * CVE-2026-39821 ( NVD ): 8.2 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N * CVE-2026-48978 ( SUSE ): 2.1 CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N * CVE-2026-48978 ( SUSE ): 3.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N Affected Products: * Containers Module 15-SP7 * SUSE Linux Enterprise Desktop 15 SP7 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 * SUSE Linux Enterprise Micro 5.5 * SUSE Linux Enterprise Real Time 15 SP7 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP4 LTSS * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server 15 SP5 LTSS * SUSE Linux Enterprise Server 15 SP6 * SUSE Linux Enterprise Server 15 SP6 LTSS * SUSE Linux Enterprise Server 15 SP7 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 * SUSE Linux Enterprise Server for SAP Applications 15 SP7 * SUSE Package Hub 15 15-SP7 An update that solves two vulnerabilities can now be installed. ##Description: This update for helm fixes the following issues * Update to version 3.21.2. * CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation bypass and privilege escalation (bsc#1266598). * CVE-2026-48978: oras.land/oras-go/v2/registry/remote/auth: malicious registry can hijack Bearer token realm to exfiltrate credentials and refresh tokens (bsc#1270127). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Enterprise Server 15 SP6 LTSS zypper in -t patch SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-2823=1 * SUSE Package Hub 15 15-SP7 zypper in -t patch SUSE-SLE-Module-Packagehub-Subpackages-15-SP7-2026-2823=1 * SUSE Linux Enterprise Server 15 SP5 LTSS zypper in -t patch SUSE-SLE-Product-SLES-15-SP5-LTSS-2026-2823=1 * SUSE Linux Enterprise Server 15 SP4 LTSS zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2026-2823=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2026-2823=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-LTSS-2026-2823=1 * Containers Module 15-SP7 zypper in -t patch SUSE-SLE-Module-Containers-15-SP7-2026-2823=1 * SUSE Linux Enterprise Micro 5.5 zypper in -t patch SUSE-SLE-Micro-5.5-2026-2823=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP6-2026-2823=1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2026-2823=1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2026-2823=1 * SUSE Linux Enterprise Server for SAP Applications 15SP5 zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP5-2026-2823=1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-ESPOS-2026-2823=1 ## Package List: * SUSE Linux Enterprise Server for SAP Applications 15 SP6 (noarch) * helm-zsh-completion-3.21.2-150000.1.80.1 * helm-bash-completion-3.21.2-150000.1.80.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP6 (ppc64le x86_64) * helm-3.21.2-150000.1.80.1 * helm-debuginfo-3.21.2-150000.1.80.1 * Containers Module 15-SP7 (noarch) * helm-zsh-completion-3.21.2-150000.1.80.1 * helm-bash-completion-3.21.2-150000.1.80.1 * Containers Module 15-SP7 (aarch64 ppc64le s390x x86_64) * helm-3.21.2-150000.1.80.1 * helm-debuginfo-3.21.2-150000.1.80.1 * SUSE Linux Enterprise Micro 5.5 (aarch64 ppc64le s390x x86_64) * helm-3.21.2-150000.1.80.1 * helm-debuginfo-3.21.2-150000.1.80.1 * SUSE Linux Enterprise Micro 5.5 (noarch) * helm-bash-completion-3.21.2-150000.1.80.1 * SUSE Linux Enterprise Server 15 SP5 LTSS (noarch) * helm-zsh-completion-3.21.2-150000.1.80.1 * helm-bash-completion-3.21.2-150000.1.80.1 * SUSE Linux Enterprise Server 15 SP5 LTSS (aarch64 ppc64le s390x x86_64) * helm-3.21.2-150000.1.80.1 * helm-debuginfo-3.21.2-150000.1.80.1 * SUSE Linux Enterprise Server 15 SP6 LTSS (aarch64 ppc64le s390x x86_64) * helm-3.21.2-150000.1.80.1 * helm-debuginfo-3.21.2-150000.1.80.1 * SUSE Linux Enterprise Server 15 SP6 LTSS (noarch) * helm-zsh-completion-3.21.2-150000.1.80.1 * helm-bash-completion-3.21.2-150000.1.80.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 (noarch) * helm-zsh-completion-3.21.2-150000.1.80.1 * helm-bash-completion-3.21.2-150000.1.80.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 (aarch64 x86_64) * helm-3.21.2-150000.1.80.1 * helm-debuginfo-3.21.2-150000.1.80.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5(aarch64 x86_64) * helm-3.21.2-150000.1.80.1 * helm-debuginfo-3.21.2-150000.1.80.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 (noarch) * helm-zsh-completion-3.21.2-150000.1.80.1 * helm-bash-completion-3.21.2-150000.1.80.1 * SUSE Linux Enterprise Server 15 SP4 LTSS (noarch) * helm-zsh-completion-3.21.2-150000.1.80.1 * helm-bash-completion-3.21.2-150000.1.80.1 * SUSE Linux Enterprise Server 15 SP4 LTSS (aarch64 ppc64le s390x x86_64) * helm-3.21.2-150000.1.80.1 * helm-debuginfo-3.21.2-150000.1.80.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (aarch64 x86_64) * helm-3.21.2-150000.1.80.1 * helm-debuginfo-3.21.2-150000.1.80.1 * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (noarch) * helm-zsh-completion-3.21.2-150000.1.80.1 * helm-bash-completion-3.21.2-150000.1.80.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 (ppc64le x86_64) * helm-3.21.2-150000.1.80.1 * helm-debuginfo-3.21.2-150000.1.80.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 (noarch) * helm-zsh-completion-3.21.2-150000.1.80.1 * helm-bash-completion-3.21.2-150000.1.80.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (noarch) * helm-zsh-completion-3.21.2-150000.1.80.1 * helm-bash-completion-3.21.2-150000.1.80.1 * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (aarch64 x86_64) * helm-3.21.2-150000.1.80.1 * helm-debuginfo-3.21.2-150000.1.80.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 (ppc64le x86_64) * helm-3.21.2-150000.1.80.1 * helm-debuginfo-3.21.2-150000.1.80.1 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 (noarch) * helm-zsh-completion-3.21.2-150000.1.80.1 * helm-bash-completion-3.21.2-150000.1.80.1 * SUSE Package Hub 15 15-SP7 (noarch) * helm-fish-completion-3.21.2-150000.1.80.1 ## References: * https://www.suse.com/security/cve/CVE-2026-39821.html *https://www.suse.com/security/cve/CVE-2026-48978.html * https://bugzilla.suse.com/show_bug.cgi?id=1266598 * https://bugzilla.suse.com/show_bug.cgi?id=1270127 . Update for helm fixes two vulnerabilities including one affecting credential management and privilege escalation.. SUSE helm patch, credential management, security update SUSE, privilege escalation, vulnerability fix. . Severity: Important. LinuxSecurity.com Team
Jul 10, 2026
•Important
SuSE
203
security advisorysecurity updatehigh severityMageia: 2025-0028 critical: git-lfs credential exfiltration
Git LFS permits exfiltration of credentials via crafted HTTP URLs. (CVE-2024-53263) References: - https://bugs.mageia.org/show_bug.cgi?id=33931 . MGASA-2025-0028 - Updated git-lfs packages fix security vulnerability Publication date: 30 Jan 2025 URL: https://advisories.mageia.org/MGASA-2025-0028.html Type: security Affected Mageia releases: 9 CVE: CVE-2024-53263 Git LFS permits exfiltration of credentials via crafted HTTP URLs. (CVE-2024-53263) References: - https://bugs.mageia.org/show_bug.cgi?id=33931 - - https://lists.debian.org/debian-security-announce/2025/msg00011.html - https://www.cve.org/CVERecord?id=CVE-2024-53263 SRPMS: - 9/core/git-lfs-3.2.0-1.1.mga9 . Latest Mageia git-lfs updates address severe security vulnerability that could lead to credential compromise through specially designed HTTP links.. git-lfs security, Mageia advisory, credential theft, Linux updates. . Severity: Critical. LinuxSecurity.com Team
Jan 30, 2025
•Critical
Mageia
89
security advisorysecurity updateFedoraFedora 40 Update: Critical Fix for git-lfs Credential Theft Issue in 2025
Update to latest version Fix CVE-2024-53263. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2025-50deb0acd5 2025-01-24 01:31:27.317862+00:00 -------------------------------------------------------------------------------- Name : git-lfs Product : Fedora 40 Version : 3.6.1 Release : 1.fc40 URL : https://git-lfs.com/ Summary : Git extension for versioning large files Description : Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. -------------------------------------------------------------------------------- Update Information: Update to latest version Fix CVE-2024-53263 -------------------------------------------------------------------------------- ChangeLog: * Wed Jan 15 2025 Elliott Sales de Andrade - 3.6.1-1 - Update to latest version (#2338023) -------------------------------------------------------------------------------- References: [ 1 ] Bug #2338002 - CVE-2024-53263 git-lfs: Git LFS permits exfiltration of credentials via crafted HTTP URLs https://bugzilla.redhat.com/show_bug.cgi?id=2338002 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2025-50deb0acd5' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list
Jan 24, 2025
•Critical
Fedora
89
security advisorysecurity issueFedoraFedora 41: git-lfs 2025-1de066b8af critical: credential exfiltration
Update to latest version Fix CVE-2024-53263. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2025-1de066b8af 2025-01-24 01:24:33.421855+00:00 -------------------------------------------------------------------------------- Name : git-lfs Product : Fedora 41 Version : 3.6.1 Release : 1.fc41 URL : https://git-lfs.com/ Summary : Git extension for versioning large files Description : Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. -------------------------------------------------------------------------------- Update Information: Update to latest version Fix CVE-2024-53263 -------------------------------------------------------------------------------- ChangeLog: * Wed Jan 15 2025 Elliott Sales de Andrade - 3.6.1-1 - Update to latest version (#2338023) -------------------------------------------------------------------------------- References: [ 1 ] Bug #2338002 - CVE-2024-53263 git-lfs: Git LFS permits exfiltration of credentials via crafted HTTP URLs https://bugzilla.redhat.com/show_bug.cgi?id=2338002 -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2025-1de066b8af' at the command line. For more information, refer to the dnf documentation available at http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- -- _______________________________________________ package-announce mailing list
Jan 24, 2025
•Critical
Fedora
203
security advisorysoftware updateCVE referenceMageia 9 MGASA-2025-0016: Critical Git Credential Issues Addressed
Git does not sanitize URLs when asking for credentials interactively. (CVE-2024-50349) Newline confusion in credential helpers can lead to credential exfiltration in git. (CVE-2024-52006) . MGASA-2025-0016 - Updated git packages fix security vulnerabilities Publication date: 20 Jan 2025 URL: https://advisories.mageia.org/MGASA-2025-0016.html Type: security Affected Mageia releases: 9 CVE: CVE-2024-50349, CVE-2024-52006 Git does not sanitize URLs when asking for credentials interactively. (CVE-2024-50349) Newline confusion in credential helpers can lead to credential exfiltration in git. (CVE-2024-52006) References: - https://bugs.mageia.org/show_bug.cgi?id=33921 - https://www.openwall.com/lists/oss-security/2025/01/14/4 - https://www.cve.org/CVERecord?id=CVE-2024-50349 - https://www.cve.org/CVERecord?id=CVE-2024-52006 SRPMS: - 9/core/git-2.41.3-1.mga9 . MGASA-2025-0017 introduces protection patches for vulnerabilities found in ssh, bolstering authorization integrity as of Jan 22, 2025. credential exfiltration, git updates, Mageia advisory, security updates, software vulnerabilities. . Severity: Critical. LinuxSecurity.com Team
Jan 20, 2025
•Critical
Mageia
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!