{"id":"openSUSE-SU-2026:20658-1","summary":"Security update for himmelblau","details":"This update for himmelblau fixes the following issues:\n\nUpdate to version 2.3.9+git0.a9fd29b.\n\nSecurity issues fixed:\n\n- CVE-2026-34397: Fixed naming collision that can lead to local privilege escalation (bsc#1261324).\n\nOther updates and bugfixes:\n\n- update aws-lc-sys to 0.39.0 for security fixes\n- update rustls-webpki to 0.103.10 for CRL revocation fix\n- Version 2.3.9:\n  * packaging: fix if/else block for debian's postrm\n  * Update apparmor.unix-chkpwd.local (Issue #1252)\n  * When Hello user encounters SSPR demand, be permissive\n  * add tests for sudo_groups functionality\n  * Fix config tests to ignore local host config\n  * Do not clear $NOTIFY_SOCKET when calling sd_ready\n  * Fix token cache 24h purge\n  * broker: use SSO server nonce for PRT only when provided\n  * Fix pam_himmelblau blocking local user password changes (#1199)\n  * Remove unused File import\n  * Use is_ascii_alphanumeric() for account_id validation\n  * Fix path traversal in LoadProfilePhoto AccountsService writes\n  * Drop initialization tracing span\n  * himmelblau-hsm-pin-init: drop RemainAfterExit=yes\n  * Add fallback behavior when consent is required\n  * qr-greeter: enable extension without socket noise\n  * debian: make install/remove noninteractive; reduce QR postinst noise; soften missing hello prt\n  * Never respond with BadRequest without error detail\n  * deps(rust): bump the all-cargo-updates group across 1 directory with 7 updates\n","modified":"2026-05-05T18:25:27.359647Z","published":"2026-04-30T17:08:24Z","related":["CVE-2026-34397"],"upstream":["CVE-2026-34397"],"references":[{"type":"ADVISORY"},{"type":"REPORT","url":"https://bugzilla.suse.com/1261324"},{"type":"REPORT","url":"https://bugzilla.suse.com/1261613"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-34397"}],"schema_version":"1.7.5"}