{"schema_version":"1.7.5","id":"SUSE-SU-2026:2466-1","published":"2026-06-19T11:02:48Z","modified":"2026-06-20T08:45:07.101355597Z","related":["CVE-2025-47907","CVE-2026-33186","CVE-2026-33814","CVE-2026-34986","CVE-2026-39821"],"upstream":["CVE-2025-47907","CVE-2026-33186","CVE-2026-33814","CVE-2026-34986","CVE-2026-39821"],"summary":"Security update for azure-storage-azcopy","details":"This update for azure-storage-azcopy fixes the following issues\n\nUpdate to 10.32.4:\n\n- CVE-2025-47907: database/sql: incorrect results returned from Rows.Scan (bsc#1247720).\n- CVE-2026-33186: google.golang.org/grpc: authorization bypass due to improper validation of the HTTP/2: path pseudo-\n  header (bsc#1260307).\n- CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGS_MAX_FRAME_SIZE\n  (bsc#1265841).\n- CVE-2026-34986: github.com/go-jose/go-jose/v4: crafted JWE input with a missing encrypted key can lead to a denial of\n  service (bsc#1262962).\n- CVE-2026-39821: golang.org/x/net/idna: failure to reject ASCII-only Punycode-encoded labels allows for validation\n  bypass and privilege escalation (bsc#1266657).\n\nChanges:\n\n * Remove 32-bit Windows ARM7 build\n * Cover other open CVEs (bsc#1266657, CVE-2026-39821)\n * Update otel sdk\n * Update packages and add patch version\n * Update version.go\n * Error formatting\n * Add test to validate changes\n * Update Changelog\n * Alter intentional panics to return errors\n * Correct issues re: MSRC case #110341\n * Update offending packages\n * cloud.google.com/go/storage v1.45.0 -> v1.50.0\n * Golang 1.24.13 -> 1.25.8\n * Golangci-lint v1.64.8 -> v2.11.3\n * Fixed a regression where the folder tracker would panic with\n   pre-existing folders and --overwrite=ifSourceNewer. (#3403)\n * Fixed a regression where cancellation was not working via stdin (#3373)\n * Fixed a regression where we hit segfaults from logging\n   to a nil logger in the process checker. (#3384)\n * Fixed a race condition panic from concurrent access to a\n   shared metadata resource by introducing thread safety. (#3341)\n * Fixed a bug where --posix-properties-style was not being chained\n   through the copy flow correctly. (#3401)\n * Fixed a regression where in tandem use of --list-of-files\n   and --include-pattern no longer worked. (#3389)\n * Golang 1.24.11 -> 1.24.13\n * Added support for AMLFS style posix metadata. (#3317)\n * Fixed a bug where hdi_isfolder metadata key would sometimes\n   not be sent in all lowercase, resulting in unexpected behavior\n   on the service side when fetching properties. (#3312)\n * Fixed a typo in the benchmark command, to allow the --put-md5 flag to work. (#3324)\n * Fixed a bug where network errors would not be retried on. (#3338)\n * Fixed a bug where unexpected requests would be logged in syslog. (#3339)\n * Fixed a bug where pre-existing folders would be recreated. (#3295)\n * Updated README to clarify supported source-destination pairs and\n   authorization mechanisms. (#3213)\n * Updated format of wiki generated docs to improve readability. (#3311)\n * AzCopy download URLs starting with https://azcopyvnext-awgzd8g7aagqhzhe.b02.azurefd.net/\n   are no longer supported.\n * Fixed a bug where throughput was not being displayed for copy and resume. (#3271)\n * Fixed a bug where S3 and GCP transfers would panic. (#3273)\n * Refactored copy, sync, resume, login, logout, login status\n   business logic into the azcopy package.\n * Golang 1.24.4 -> 1.24.11\n * golang.org/x/crypto 0.40.0 -> 0.45.0\n * Azure Files SMB -> Azure Files NFS transfers.\n * Symlink support for Azure Files NFS shares.\n * Introduced support for symbolic links in Azure Files NFS shares.\n * Symlinks can be preserved, skipped, or followed based on command-line flags.\n * Added a --check-version flag to make version checking an opt in feature. (#3173)\n * --include-root flag now allows customers to preserve root properties\n   when used in conjunction with --preserve-XXXX flags. (#3163)\n * Golang 1.24.4 -> 1.24.6 (#3154)\n * Fixed a bug to retry on various network errors. (#3237) (#3252) (bsc#1266311)\n * Fixed a bug where remove would not work on paths with encoded characters. (#2977)\n * Fixed a bug where jobs resume would not produce any output for\n   previously failed jobs. (#3103)\n * Fixed a bug where FileBlob transfers with EntraID on the source\n   would pass the wrong service version. (#3242)\n * Fixed a bug to retry on WSAETIMEDOUT on Windows. (#3195)\n * Fixed a bug with the folder creation tracker which caused folder\n   creation calls to happen more often than necessary. (#3151)\n * Fixed a bug to redact x-ams-credential from logs. (#3206)\n * Fixed a bug where powershell login would fail with older versions\n   of Az.Accounts. (#3191)\n * Fixed a bug where symlink direct targets would be handled as a file\n   instead of a symlink. (#3222)\n * Refactored traverser related code into its own package. (#3251)\n * Refactored OAuth token manager access to use a client-based pattern\n   instead of global singleton access. (#3260)\n * Removed unused code related to credential management. (#3260)\n * Refactored Lifecycle UI code into the cmd package (#3262).\n * Error handling code is now injected into JobMgr, or appropriately\n   bubbled upwards instead of using global LCM error handling. (#3262)\n * AzCopy no longer checks version by default. (#3173)\n * Fixed --exclude-path flag not available in remove operations. (#3165) (#3159)\n * Fixed regression where AzCopy was not honoring concurrency value\n   in copy operations (#3192)\n * Fixed the incorrect JSON output format of the warning message when\n   there are multiple AzCopy processes running. (#3188) (#3182)\n * Fixed latest_version.txt from being wrongly created in users\n   current directory. (#3179)(#3176)\n * Fixed AzCopy crashing during sync operation from a nil pointer deref\n   in the destination authentication policy. (#3186) (#3109) (#3156) (#3175)\n * Golang 1.24.2 -> 1.24.6 (CVE-2025-47907) (#3154)\n * For transfers involving Azure Files (NFS or SMB), AzCopy will not auto\n   create file shares.\n * AzCopy binaries and latest version information will now be distributed\n   from Github releases instead of the static website. (#3014)\n * Azure Files NFS Support via REST.\n * Added support to retry on copy source error code and status code for service\n   to service copies. (#3105)\n * Added support for service to service copies from Azure Files to Blob Storage\n   using EntraID. (#3053)\n * Fixed a bug where when copying a file that has already been deleted with\n   --trailing-dot=Disable resulted in the wrong error instead of a 404. (#3092)\n * Removed the warning message when failing to create a container. This message\n   can be misleading when there is insufficient permissions to create a container\n   and the container already exists. (#3045)\n * Improved the error message returned when block size is larger than bandwidth\n   limit. (#3051)\n * Warn user if transfer is going to exceed 10M objects. (#3111)\n * Warn user if multiple AzCopy processes are running. (#3128)\n * Golang 1.24.2 -> 1.24.4 (#3085)\n * Azure Files NFS Support via REST API\n","affected":[{"package":{"name":"azure-storage-azcopy","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","purl":"pkg:rpm/suse/azure-storage-azcopy&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Public%20Cloud%2015%20SP4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.32.4-150400.9.11.1"}]}],"ecosystem_specific":{"binaries":[{"azure-storage-azcopy":"10.32.4-150400.9.11.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:2466-1.json"}},{"package":{"name":"azure-storage-azcopy","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","purl":"pkg:rpm/suse/azure-storage-azcopy&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Public%20Cloud%2015%20SP5"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.32.4-150400.9.11.1"}]}],"ecosystem_specific":{"binaries":[{"azure-storage-azcopy":"10.32.4-150400.9.11.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:2466-1.json"}},{"package":{"name":"azure-storage-azcopy","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP6","purl":"pkg:rpm/suse/azure-storage-azcopy&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Public%20Cloud%2015%20SP6"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.32.4-150400.9.11.1"}]}],"ecosystem_specific":{"binaries":[{"azure-storage-azcopy":"10.32.4-150400.9.11.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:2466-1.json"}},{"package":{"name":"azure-storage-azcopy","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP7","purl":"pkg:rpm/suse/azure-storage-azcopy&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Public%20Cloud%2015%20SP7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.32.4-150400.9.11.1"}]}],"ecosystem_specific":{"binaries":[{"azure-storage-azcopy":"10.32.4-150400.9.11.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2026:2466-1.json"}}],"references":[{"type":"ADVISORY","url":"https://www.suse.com/support/update/announcement/2026/suse-su-20262466-1/"},{"type":"REPORT","url":"https://bugzilla.suse.com/1247720"},{"type":"REPORT","url":"https://bugzilla.suse.com/1260307"},{"type":"REPORT","url":"https://bugzilla.suse.com/1262962"},{"type":"REPORT","url":"https://bugzilla.suse.com/1265841"},{"type":"REPORT","url":"https://bugzilla.suse.com/1266311"},{"type":"REPORT","url":"https://bugzilla.suse.com/1266657"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2025-47907"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-33186"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-33814"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-34986"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-39821"}]}