# Security update for rekor

Announcement ID: SUSE-SU-2025:1332-1  
Release Date: 2025-04-17T01:37:48Z  
Rating: important  
References:

  * bsc#1227053
  * bsc#1236519
  * bsc#1237638
  * bsc#1239191
  * bsc#1239327
  * bsc#1240468
  * jsc#SLE-23476

  
Cross-References:

  * CVE-2023-45288
  * CVE-2024-6104
  * CVE-2025-22868
  * CVE-2025-22869
  * CVE-2025-27144
  * CVE-2025-30204

  
CVSS scores:

  * CVE-2023-45288 ( SUSE ):  6.9
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
  * CVE-2023-45288 ( SUSE ):  5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
  * CVE-2024-6104 ( SUSE ):  6.0 CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
  * CVE-2024-6104 ( NVD ):  5.5 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
  * CVE-2025-22868 ( SUSE ):  8.7
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
  * CVE-2025-22868 ( SUSE ):  7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  * CVE-2025-22869 ( SUSE ):  8.2
    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
  * CVE-2025-22869 ( SUSE ):  7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  * CVE-2025-22869 ( NVD ):  7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  * CVE-2025-27144 ( SUSE ):  8.7
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
  * CVE-2025-27144 ( SUSE ):  7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  * CVE-2025-27144 ( NVD ):  6.6
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
  * CVE-2025-30204 ( SUSE ):  8.7
    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
  * CVE-2025-30204 ( SUSE ):  7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
  * CVE-2025-30204 ( NVD ):  7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

  
Affected Products:

  * Basesystem Module 15-SP6
  * openSUSE Leap 15.4
  * openSUSE Leap 15.6
  * SUSE Linux Enterprise Desktop 15 SP6
  * SUSE Linux Enterprise High Performance Computing 15 SP4
  * SUSE Linux Enterprise High Performance Computing 15 SP5
  * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4
  * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5
  * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4
  * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5
  * SUSE Linux Enterprise Real Time 15 SP6
  * SUSE Linux Enterprise Server 15 SP4
  * SUSE Linux Enterprise Server 15 SP4 LTSS
  * SUSE Linux Enterprise Server 15 SP5
  * SUSE Linux Enterprise Server 15 SP5 LTSS
  * SUSE Linux Enterprise Server 15 SP6
  * SUSE Linux Enterprise Server for SAP Applications 15 SP4
  * SUSE Linux Enterprise Server for SAP Applications 15 SP5
  * SUSE Linux Enterprise Server for SAP Applications 15 SP6
  * SUSE Manager Proxy 4.3
  * SUSE Manager Retail Branch Server 4.3
  * SUSE Manager Server 4.3

  
  
An update that solves six vulnerabilities and contains one feature can now be
installed.

## Description:

This update for rekor fixes the following issues:

  * CVE-2023-45288: rekor: golang.org/x/net/http2: Fixed close connections when
    receiving too many headers (bsc#1236519)
  * CVE-2024-6104: rekor: hashicorp/go-retryablehttp: Fixed sensitive
    information disclosure inside log file (bsc#1227053)
  * CVE-2025-22868: rekor: golang.org/x/oauth2/jws: Fixed unexpected memory
    consumption during token parsing (bsc#1239191)
  * CVE-2025-22869: rekor: golang.org/x/crypto/ssh: Fixed denial of service in
    the Key Exchange (bsc#1239327)
  * CVE-2025-27144: rekor: gopkg.in/go-jose/go-jose.v2,github.com/go-jose/go-
    jose/v4,github.com/go-jose/go-jose/v3: Fixed denial of service in Go JOSE's
    parsing (bsc#1237638)
  * CVE-2025-30204: rekor: github.com/golang-jwt/jwt/v5: Fixed jwt-go allowing
    excessive memory allocation during header parsing (bsc#1240468)

Other fixes:

  * Update to version 1.3.10:
  * Features
    * Added --client-signing-algorithms flag (#1974)
  * Fixes / Misc

    * emit unpopulated values when marshalling (#2438)
    * pkg/api: better logs when algorithm registry rejects a key (#2429)
    * chore: improve mysql readiness checks (#2397)
    * Added --client-signing-algorithms flag (#1974)
  * Update to version 1.3.9 (jsc#SLE-23476):

  * Cache checkpoint for inactive shards (#2332)
  * Support per-shard signing keys (#2330)

  * Update to version 1.3.8:

  * Bug Fixes
    * fix zizmor issues (#2298)
    * remove unneeded value in log message (#2282)
  * Quality Enhancements

    * chore: relax go directive to permit 1.22.x
    * fetch minisign from homebrew instead of custom ppa (#2329)
    * fix(ci): simplify GOVERSION extraction
    * chore(deps): bump actions pins to latest
    * Updates go and golangci-lint (#2302)
    * update builder to use go1.23.4 (#2301)
    * clean up spaces
    * log request body on 500 error to aid debugging (#2283)
  * Update to version 1.3.7:

  * New Features
    * log request body on 500 error to aid debugging (#2283)
    * Add support for signing with Tink keyset (#2228)
    * Add public key hash check in Signed Note verification (#2214)
    * update Trillian TLS configuration (#2202)
    * Add TLS support for Trillian server (#2164)
    * Replace docker-compose with plugin if available (#2153)
    * Add flags to backfill script (#2146)
    * Unset DisableKeepalive for backfill HTTP client (#2137)
    * Add script to delete indexes from Redis (#2120)
    * Run CREATE statement in backfill script (#2109)
    * Add MySQL support to backfill script (#2081)
    * Run e2e tests on mysql and redis index backends (#2079)
  * Bug Fixes
    * remove unneeded value in log message (#2282)
    * Add error message when computing consistency proof (#2278)
    * fix validation error handling on API (#2217)
    * fix error in pretty-printed inclusion proof from verify subcommand (#2210)
    * Fix index scripts (#2203)
    * fix failing sharding test
    * Better error handling in backfill script (#2148)
    * Batch entries in cleanup script (#2158)
    * Add missing workflow for index cleanup test (#2121)
    * hashedrekord: fix schema $id (#2092)

## Patch Instructions:

To install this SUSE update use the SUSE recommended installation methods like
YaST online_update or "zypper patch".  
Alternatively you can run the command listed for your product:

  * openSUSE Leap 15.4  
    zypper in -t patch SUSE-2025-1332=1

  * openSUSE Leap 15.6  
    zypper in -t patch openSUSE-SLE-15.6-2025-1332=1

  * Basesystem Module 15-SP6  
    zypper in -t patch SUSE-SLE-Module-Basesystem-15-SP6-2025-1332=1

  * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4  
    zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2025-1332=1

  * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4  
    zypper in -t patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2025-1332=1

  * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5  
    zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-ESPOS-2025-1332=1

  * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5  
    zypper in -t patch SUSE-SLE-Product-HPC-15-SP5-LTSS-2025-1332=1

  * SUSE Linux Enterprise Server 15 SP4 LTSS  
    zypper in -t patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2025-1332=1

  * SUSE Linux Enterprise Server 15 SP5 LTSS  
    zypper in -t patch SUSE-SLE-Product-SLES-15-SP5-LTSS-2025-1332=1

  * SUSE Linux Enterprise Server for SAP Applications 15 SP4  
    zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP4-2025-1332=1

  * SUSE Linux Enterprise Server for SAP Applications 15 SP5  
    zypper in -t patch SUSE-SLE-Product-SLES_SAP-15-SP5-2025-1332=1

  * SUSE Manager Proxy 4.3  
    zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.3-2025-1332=1

  * SUSE Manager Retail Branch Server 4.3  
    zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch-
Server-4.3-2025-1332=1

  * SUSE Manager Server 4.3  
    zypper in -t patch SUSE-SLE-Product-SUSE-Manager-Server-4.3-2025-1332=1

## Package List:

  * openSUSE Leap 15.4 (aarch64 ppc64le s390x x86_64 i586)
    * rekor-debuginfo-1.3.10-150400.4.25.1
    * rekor-1.3.10-150400.4.25.1
  * openSUSE Leap 15.6 (aarch64 ppc64le s390x x86_64)
    * rekor-debuginfo-1.3.10-150400.4.25.1
    * rekor-1.3.10-150400.4.25.1
  * Basesystem Module 15-SP6 (aarch64 ppc64le s390x x86_64)
    * rekor-debuginfo-1.3.10-150400.4.25.1
    * rekor-1.3.10-150400.4.25.1
  * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (aarch64
    x86_64)
    * rekor-1.3.10-150400.4.25.1
  * SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (aarch64
    x86_64)
    * rekor-1.3.10-150400.4.25.1
  * SUSE Linux Enterprise High Performance Computing ESPOS 15 SP5 (aarch64
    x86_64)
    * rekor-1.3.10-150400.4.25.1
  * SUSE Linux Enterprise High Performance Computing LTSS 15 SP5 (aarch64
    x86_64)
    * rekor-1.3.10-150400.4.25.1
  * SUSE Linux Enterprise Server 15 SP4 LTSS (aarch64 ppc64le s390x x86_64)
    * rekor-1.3.10-150400.4.25.1
  * SUSE Linux Enterprise Server 15 SP5 LTSS (aarch64 ppc64le s390x x86_64)
    * rekor-1.3.10-150400.4.25.1
  * SUSE Linux Enterprise Server for SAP Applications 15 SP4 (ppc64le x86_64)
    * rekor-1.3.10-150400.4.25.1
  * SUSE Linux Enterprise Server for SAP Applications 15 SP5 (ppc64le x86_64)
    * rekor-1.3.10-150400.4.25.1
  * SUSE Manager Proxy 4.3 (x86_64)
    * rekor-1.3.10-150400.4.25.1
  * SUSE Manager Retail Branch Server 4.3 (x86_64)
    * rekor-1.3.10-150400.4.25.1
  * SUSE Manager Server 4.3 (ppc64le s390x x86_64)
    * rekor-1.3.10-150400.4.25.1

## References:

  * https://www.suse.com/security/cve/CVE-2023-45288.html
  * https://www.suse.com/security/cve/CVE-2024-6104.html
  * https://www.suse.com/security/cve/CVE-2025-22868.html
  * https://www.suse.com/security/cve/CVE-2025-22869.html
  * https://www.suse.com/security/cve/CVE-2025-27144.html
  * https://www.suse.com/security/cve/CVE-2025-30204.html
  * https://bugzilla.suse.com/show_bug.cgi?id=1227053
  * https://bugzilla.suse.com/show_bug.cgi?id=1236519
  * https://bugzilla.suse.com/show_bug.cgi?id=1237638
  * https://bugzilla.suse.com/show_bug.cgi?id=1239191
  * https://bugzilla.suse.com/show_bug.cgi?id=1239327
  * https://bugzilla.suse.com/show_bug.cgi?id=1240468
  * https://jira.suse.com/browse/SLE-23476