Summary
This update for hauler fixes the following issues:
Changes in hauler:
- Update to version 1.4.1 (bsc#1256546, CVE-2026-22772):
* fixed typos for containerd imports (#493)
* fix and support containerd imports of `hauls` (#492)
* bump github.com/sigstore/fulcio (#489)
- Update to version 1.4.0:
* added/updated logging for `serve` and `remove` (#487)
* added/fixed helm chart images/dependencies features (#485)
* more experimental feature updates (#486)
* add experimental notes (#483)
* updated tempdir flag to store persistent flags (#484)
* delete artifacts from store (#473)
* path rewrites (#475)
* updated/fixed workflow dependency versions (#478)
- Update to version 1.3.2:
* bump to latest cosign fork release (#481)
* Bump golang.org/x/crypto in the go_modules group across 1 directory (#476)
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| openSUSE · Leap 16.0 | hauler | 1.4.1-bp160.1.1 |
Vulnerabilities 1
-
Medium 5.8
Fulcio vulnerable to Server-Side Request Forgery (SSRF) via MetaIssuer Regex Bypass
Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Prior to 1.8.5, Fulcio's metaRegex() function uses unanchored regex, allowing attackers to bypass MetaIssuer URL validation and trigger SSRF to arbi…