{"schema_version":"1.7.5","id":"openSUSE-SU-2026:21262-1","published":"2026-07-06T09:02:35Z","modified":"2026-07-09T18:24:13.951698752Z","related":["CVE-2026-25680","CVE-2026-25681","CVE-2026-27136","CVE-2026-42502","CVE-2026-42506","CVE-2026-48702"],"upstream":["CVE-2026-25680","CVE-2026-25681","CVE-2026-27136","CVE-2026-42502","CVE-2026-42506","CVE-2026-48702"],"summary":"Security update for hauler","details":"This update for hauler fixes the following issues:\n\nChanges in hauler:\n\n- update to 2.0.1 (bsc#1269433, CVE-2026-48702):\n  * bump go to 1.26.4 to squash CVE noise\n  * Full v2 Release notes: https://github.com/hauler-\n    dev/hauler/releases/tag/v2.0.0\n\n- update to 2.0.0:\n  * `v2.0.0` is a **major** release. It replaces Hauler's entire\n    OCI plumbing... the ORAS v1 dependency and the in-house\n    cosign fork with a native containerd based implementation,\n    drops the deprecated `v1alpha1` API, and layers on a\n    meaningful set of new capabilities and reliability fixes on\n    top of that new foundation.\n  * **Removed the ORAS v1 dependency** - push/pull is now driven\n    directly by containerd's docker resolver and `google/go-\n    containerregistry`, new `pkg/content/registry.go`\n    (`RegistryTarget`) and `pkg/content/types.go` (`Target`\n    interface, `IoContentWriter`) replaces what ORAS used to own.\n  * **Removed the hauler-maintained cosign fork** - `pkg/cosign`\n    is now a thin verify only wrapper around upstream\n    `sigstore/cosign/v3`. Images are added through a native\n    `s.AddImage()` path in `pkg/store`\n  * **Added OCI 1.1 Referrers support** - signatures,\n    attestations, and SBOMs are discovered both via the classic\n    cosign tag convention (`sha256-.sig` / `.att` / `.sbom`) and\n    the modern Referrers API, then correctly through the OCI\n    layout\n\n- update x/net to v0.55.0 (bsc#1266602, CVE-2026-39821,\n     bsc#1267150, CVE-2026-25680, CVE-2026-42502, CVE-2026-27136,\n     CVE-2026-25681, CVE-2026-42506)\n","affected":[{"package":{"name":"hauler","ecosystem":"openSUSE:Leap 16.0","purl":"pkg:rpm/opensuse/hauler&distro=openSUSE%20Leap%2016.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.1-bp160.1.1"}]}],"ecosystem_specific":{"binaries":[{"hauler":"2.0.1-bp160.1.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:21262-1.json"}}],"references":[{"type":"ADVISORY"},{"type":"REPORT","url":"https://bugzilla.suse.com/1267150"},{"type":"REPORT","url":"https://bugzilla.suse.com/1269433"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-25680"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-25681"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-27136"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-42502"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-42506"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-48702"}]}