{"schema_version":"1.7.3","id":"SUSE-SU-2025:03448-1","published":"2025-10-02T07:14:58Z","modified":"2026-02-04T03:50:14.735924Z","related":["CVE-2025-58058"],"upstream":["CVE-2025-58058"],"summary":"Security update for warewulf4","details":"This update for warewulf4 fixes the following issues:\n\nUpdate to version 4.6.4.\n\nSecurity issues fixed:\n\n- CVE-2025-58058: xz: excessive memory consuption when unpacking a large number of corrupted LZMA archives\n  (bsc#1248906).\n\nOther issues fixed:\n\n- Convert disk booleans from `wwbool` to `*bool` which allows bools in disk to be set to false via command\n  line (bsc#1248768).\n- Fix `wwctl` upgrade nodes to handle kernel argument lists (bsc#1227686, bsc#1227465).\n- Mark `slurm` as recommeneded in the `warewulf4-overlay-slurm` package (bsc#1246082).\n- Switch to `dnsmasq` as default DHCP and TFTP provider.\n\n- v4.6.4 release updates:\n  * Update NetworkManager Overlay\n    * Disable IPv4 in NetworkManager if no address or route is specified\n  * Fix(`wwctl`): create overlay edit `tempfile` in `tmpdir`\n  * Add default for systemd name for warewulf in `warewulf.conf`\n  * Atomic overlay file application in `wwclient`\n  * Simpler names for overlay methods\n  * Fix `warewulfd` API behavior when deleting distribution overlay\n\n- v4.6.3 release updates:\n  * IPv6 iPXE support\n  * Fix a race condition in `wwctl` overlay edit\n  * Fixed handling of comma-separated mount options in `fstab` and `ignition` overlays\n  * Move `reexec.Init()` to beginning of `wwctl`\n  * Added `warewuld` configure option\n  * Address copilot review from #1945\n  * Bugfix: cloning a site overlay when parent dir does not exist\n  * Clone to a site overlay when adding files in `wwapi`\n  * Consolidated `createOverlayFile` and `updateOverlayFile` to `addOverlayFile`\n  * Support for creating and updating overlay file in `wwapi`\n  * Only return overlay files that refer to a path within the overlay\n  * Add overlay file deletion support\n  * `DELETE /api/overlays/{id}?force=true` can delete overlays in use\n  * Restore idempotency of `PUT /api/nodes/{id}`\n  * Simplify overlay mtime API and add tests\n  * Add node overlay buildtime\n  * Improved `netplan` support\n  * Rebuild overlays for discovered nodes\n\n- v4.6.2 release updates:\n  * (preview) support for provisioning to local disk\n  \n- incoperated from v4.6.1:\n  * REST API, which is disabled in the default configuration\n","affected":[{"package":{"name":"warewulf4","ecosystem":"SUSE:Linux Enterprise Module for HPC 15 SP6","purl":"pkg:rpm/suse/warewulf4&distro=SUSE%20Linux%20Enterprise%20Module%20for%20HPC%2015%20SP6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.4-150500.6.37.1"}]}],"ecosystem_specific":{"binaries":[{"warewulf4":"4.6.4-150500.6.37.1","warewulf4-dracut":"4.6.4-150500.6.37.1","warewulf4-man":"4.6.4-150500.6.37.1","warewulf4-overlay":"4.6.4-150500.6.37.1","warewulf4-overlay-slurm":"4.6.4-150500.6.37.1","warewulf4-reference-doc":"4.6.4-150500.6.37.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2025:03448-1.json"}},{"package":{"name":"warewulf4","ecosystem":"SUSE:Linux Enterprise Module for HPC 15 SP7","purl":"pkg:rpm/suse/warewulf4&distro=SUSE%20Linux%20Enterprise%20Module%20for%20HPC%2015%20SP7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.4-150500.6.37.1"}]}],"ecosystem_specific":{"binaries":[{"warewulf4":"4.6.4-150500.6.37.1","warewulf4-dracut":"4.6.4-150500.6.37.1","warewulf4-man":"4.6.4-150500.6.37.1","warewulf4-overlay":"4.6.4-150500.6.37.1","warewulf4-overlay-slurm":"4.6.4-150500.6.37.1","warewulf4-reference-doc":"4.6.4-150500.6.37.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2025:03448-1.json"}},{"package":{"name":"warewulf4","ecosystem":"openSUSE:Leap 15.6","purl":"pkg:rpm/opensuse/warewulf4&distro=openSUSE%20Leap%2015.6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.4-150500.6.37.1"}]}],"ecosystem_specific":{"binaries":[{"warewulf4":"4.6.4-150500.6.37.1","warewulf4-dracut":"4.6.4-150500.6.37.1","warewulf4-man":"4.6.4-150500.6.37.1","warewulf4-overlay":"4.6.4-150500.6.37.1","warewulf4-overlay-slurm":"4.6.4-150500.6.37.1","warewulf4-reference-doc":"4.6.4-150500.6.37.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2025:03448-1.json"}}],"references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2025/suse-su-202503448-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1227465"},{"type":"REPORT","url":"https://bugzilla.suse.com/1227686"},{"type":"REPORT","url":"https://bugzilla.suse.com/1246082"},{"type":"REPORT","url":"https://bugzilla.suse.com/1248768"},{"type":"REPORT","url":"https://bugzilla.suse.com/1248906"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2025-58058"}]}