SUSE Package Hub - SUSE-PackageHub-16.0-packagehub-63

Update Info

SUSE-PackageHub-16.0-packagehub-63

Recommended update for trivy

Type: recommended

Severity: moderate

Issued: 2026-01-08

Description:

This update for trivy fixes the following issues:

- Update to version 0.68.2:
  * release: v0.68.2 [release/v0.68] (#9950)
  * fix(deps): bump alpine from `3.22.1` to `3.23.0` [backport: release/v0.68] (#9949)
  * ci: enable `check-latest` for `setup-go` [backport: release/v0.68] (#9946)

References

CVE: CVE-2025-58190
CVE: CVE-2025-58181
CVE: CVE-2025-47914
CVE: CVE-2025-47913
CVE: CVE-2025-47911
Bugzilla: 1253977 VUL-0: CVE-2025-47914: trivy: golang.org/x/crypto/ssh/agent: non validated message size can cause a panic due to an out of bounds read
Bugzilla: 1253786 VUL-0: CVE-2025-58181: trivy: golang.org/x/crypto/ssh: invalidated number of mechanisms can cause unbounded memory consumption
Bugzilla: 1253512 VUL-0: CVE-2025-47913: trivy: golang.org/x/crypto/ssh/agent: client process termination when receiving an unexpected message type in response to a key listing or signing request
Bugzilla: 1251547 VUL-0: CVE-2025-58190: trivy: golang.org/x/net/html: excessive memory consumption by `html.ParseFragment` when processing specially crafted input
Bugzilla: 1251363 VUL-0: CVE-2025-47911: trivy: golang.org/x/net/html: various algorithms with quadratic complexity when parsing HTML documents

Packages

trivy-0.68.2-bp160.1.1