An update that solves two vulnerabilities can now be installed.. # Security update for terraform-provider-local, terraform-provider-random, terraform-provider-tls Announcement ID: SUSE-SU-2026:1411-1 Release Date: 2026-04-16T12:57:18Z Rating: important References: * bsc#1258097 * bsc#1260218 Cross-References: * CVE-2026-25934 * CVE-2026-33186 CVSS scores: * CVE-2026-25934 ( SUSE ): 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N * CVE-2026-25934 ( SUSE ): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N * CVE-2026-25934 ( NVD ): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N * CVE-2026-25934 ( NVD ): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N * CVE-2026-33186 ( SUSE ): 8.6 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N * CVE-2026-33186 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N * CVE-2026-33186 ( NVD ): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Affected Products: * openSUSE Leap 15.6 * Public Cloud Module 15-SP4 * Public Cloud Module 15-SP5 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.3 An update that solves two vulnerabilities can now be installed. ## Description: This update for terraform-provider-local, terraform-provider-random, terraform- provider-tls fixes the following issue: * CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for `.pack` and `.idx` files can lead to the consumption of corrupted files (bsc#1258097). * CVE-2026-33186: google.golang.org/grpc: improper validation of the HTTP/2 `:path` pseudo-header can lead to authorizationbypass (bsc#1260218). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.6 zypper in -t patch openSUSE-SLE-15.6-2026-1411=1 * Public Cloud Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Public-Cloud-15-SP4-2026-1411=1 * Public Cloud Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Public-Cloud-15-SP5-2026-1411=1 ## Package List: * openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64) * terraform-provider-local-2.0.0-150200.6.8.1 * terraform-provider-null-3.0.0-150200.6.12.1 * terraform-provider-random-3.0.0-150200.6.6.2 * terraform-provider-tls-3.0.0-150200.5.6.2 * Public Cloud Module 15-SP4 (aarch64 ppc64le s390x x86_64) * terraform-provider-local-2.0.0-150200.6.8.1 * terraform-provider-null-3.0.0-150200.6.12.1 * terraform-provider-random-3.0.0-150200.6.6.2 * terraform-provider-tls-3.0.0-150200.5.6.2 * Public Cloud Module 15-SP5 (aarch64 ppc64le s390x x86_64) * terraform-provider-local-2.0.0-150200.6.8.1 * terraform-provider-null-3.0.0-150200.6.12.1 * terraform-provider-random-3.0.0-150200.6.6.2 * terraform-provider-tls-3.0.0-150200.5.6.2 ## References: * https://www.suse.com/security/cve/CVE-2026-25934.html * https://www.suse.com/security/cve/CVE-2026-33186.html * https://bugzilla.suse.com/show_bug.cgi?id=1258097 * https://bugzilla.suse.com/show_bug.cgi?id=1260218 . Important update for openSUSE fixes two CVEs affecting Terraform providers, addressing data integrity and authorization issues.. openSUSE Terraform security update, terraform provider vulnerabilities, important openSUSE advisory, security patch for terraform. . Severity: Important. LinuxSecurity.com Team
An update that solves two vulnerabilities can now be installed.. # Security update for terraform-provider-local, terraform-provider-random, terraform-provider-tls Announcement ID: SUSE-SU-2026:1411-1 Release Date: 2026-04-16T12:57:18Z Rating: important References: * bsc#1258097 * bsc#1260218 Cross-References: * CVE-2026-25934 * CVE-2026-33186 CVSS scores: * CVE-2026-25934 ( SUSE ): 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N * CVE-2026-25934 ( SUSE ): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N * CVE-2026-25934 ( NVD ): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N * CVE-2026-25934 ( NVD ): 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N * CVE-2026-33186 ( SUSE ): 8.6 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N * CVE-2026-33186 ( SUSE ): 8.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N * CVE-2026-33186 ( NVD ): 9.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Affected Products: * openSUSE Leap 15.6 * Public Cloud Module 15-SP4 * Public Cloud Module 15-SP5 * SUSE Linux Enterprise High Performance Computing 15 SP4 * SUSE Linux Enterprise High Performance Computing 15 SP5 * SUSE Linux Enterprise Server 15 SP4 * SUSE Linux Enterprise Server 15 SP5 * SUSE Linux Enterprise Server for SAP Applications 15 SP4 * SUSE Linux Enterprise Server for SAP Applications 15 SP5 * SUSE Manager Proxy 4.3 * SUSE Manager Retail Branch Server 4.3 * SUSE Manager Server 4.3 An update that solves two vulnerabilities can now be installed. ## Description: This update for terraform-provider-local, terraform-provider-random, terraform- provider-tls fixes the following issue: * CVE-2026-25934: github.com/go-git/go-git/v5: improper verification of data integrity values for `.pack` and `.idx` files can lead to the consumption of corrupted files (bsc#1258097). * CVE-2026-33186: google.golang.org/grpc: improper validation of the HTTP/2 `:path` pseudo-header can lead to authorizationbypass (bsc#1260218). ## Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: * openSUSE Leap 15.6 zypper in -t patch openSUSE-SLE-15.6-2026-1411=1 * Public Cloud Module 15-SP4 zypper in -t patch SUSE-SLE-Module-Public-Cloud-15-SP4-2026-1411=1 * Public Cloud Module 15-SP5 zypper in -t patch SUSE-SLE-Module-Public-Cloud-15-SP5-2026-1411=1 ## Package List: * openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64) * terraform-provider-local-2.0.0-150200.6.8.1 * terraform-provider-null-3.0.0-150200.6.12.1 * terraform-provider-random-3.0.0-150200.6.6.2 * terraform-provider-tls-3.0.0-150200.5.6.2 * Public Cloud Module 15-SP4 (aarch64 ppc64le s390x x86_64) * terraform-provider-local-2.0.0-150200.6.8.1 * terraform-provider-null-3.0.0-150200.6.12.1 * terraform-provider-random-3.0.0-150200.6.6.2 * terraform-provider-tls-3.0.0-150200.5.6.2 * Public Cloud Module 15-SP5 (aarch64 ppc64le s390x x86_64) * terraform-provider-local-2.0.0-150200.6.8.1 * terraform-provider-null-3.0.0-150200.6.12.1 * terraform-provider-random-3.0.0-150200.6.6.2 * terraform-provider-tls-3.0.0-150200.5.6.2 ## References: * https://www.suse.com/security/cve/CVE-2026-25934.html * https://www.suse.com/security/cve/CVE-2026-33186.html * https://bugzilla.suse.com/show_bug.cgi?id=1258097 * https://bugzilla.suse.com/show_bug.cgi?id=1260218 . SUSE update for terraform providers resolves important issues including data integrity and authorization bypass risks.. SUSE Terraform Provider Security, openSUSE Update, Authorization Bypass Fix. . Severity: Important. LinuxSecurity.com Team
Get the latest Linux and open source security news straight to your inbox.