An update that solves two vulnerabilities can now be installed.. # Security update for libsodium Announcement ID: SUSE-SU-2026:20448-1 Release Date: 2026-02-17T08:34:13Z Rating: moderate References: * bsc#1255764 * bsc#1256070 Cross-References: * CVE-2025-15444 * CVE-2025-69277 CVSS scores: * CVE-2025-15444 ( SUSE ): 6.8 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N * CVE-2025-15444 ( NVD ): 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H * CVE-2025-69277 ( SUSE ): 4.8 CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N * CVE-2025-69277 ( SUSE ): 4.4 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N * CVE-2025-69277 ( NVD ): 4.5 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N Affected Products: * SUSE Linux Micro 6.0 An update that solves two vulnerabilities can now be installed. ## Description: This update for libsodium fixes the following issues: * CVE-2025-15444: Fixed cryptographic bypass via improper elliptic curve point validation (bsc#1256070). * CVE-2025-69277: Fixed incorrect validation of elliptic curve points in crypto_core_ed25519_is_valid_point function (bsc#1255764). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * SUSE Linux Micro 6.0 zypper in -t patch SUSE-SLE-Micro-6.0-585=1 ## Package List: * SUSE Linux Micro 6.0 (aarch64 s390x x86_64) * libsodium-debugsource-1.0.18-5.1 * libsodium23-1.0.18-5.1 * libsodium23-debuginfo-1.0.18-5.1 ## References: * https://www.suse.com/security/cve/CVE-2025-15444.html * https://www.suse.com/security/cve/CVE-2025-69277.html * https://bugzilla.suse.com/show_bug.cgi?id=1255764 * https://bugzilla.suse.com/show_bug.cgi?id=1256070 . An update for libsodium fixes cryptographic bypass and validation issues in SUSE Micro 6.0 systems. Apply patches now.. libsodium security update, SUSE securitypatch, encrypt fix, cryptographic validation issue. . LinuxSecurity.com Team
It was discovered that the crypto_core_ed25519_is_valid_point() function of the Sodium cryptography library mishandled checks for valid elliptic curve points. For Debian 11 bullseye, this problem has been fixed in version 1.0.18-1+deb11u1.. Debian LTS Advisory DLA-4435-1
* Bump to 1.8.3 * Security fix for CVE-2017-8932 * add support for 28+bit OIDs in asn1. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2017-8f018a3d39 2017-07-27 14:26:19.254995 --------------------------------------------------------------------------------Name : golang Product : Fedora 26 Version : 1.8.3 Release : 2.fc26 URL : https://go.dev/ Summary : The Go Programming Language Description : The Go Programming Language. --------------------------------------------------------------------------------Update Information: * Bump to 1.8.3 * Security fix for CVE-2017-8932 * add support for 28+bit OIDs in asn1 --------------------------------------------------------------------------------References: [ 1 ] Bug #1455189 - CVE-2017-8932 golang: Elliptic curves carry propagation issue in x86-64 P-256 https://bugzilla.redhat.com/show_bug.cgi?id=1455189 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade golang' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list --
Get the latest Linux and open source security news straight to your inbox.