{"id":"openSUSE-SU-2026:22224-1","summary":"Security update for rqlite","details":"This update for rqlite fixes the following issues:\n\nChanges in rqlite:\n\n- Update to version 10.6.6:\n  * Keep the local auto-backup file if the metadata rename fails\n  * Reject local auto-backup filenames reserved for internal use\n  * POST /demote and POST /promote return a JSON error body, and\n    404 when the target node is not in the cluster.\n  * DELETE /remove returns a JSON error body.\n- Includes changes from  version 10.6.5:\n  * Guard the inter-node backup stream handler directly against a\n    missing backup request\n  * POST /leader returns a JSON error body, and 404 when the target\n    node is not in the cluster\n\n- Update to version 10.6.4:\n  * BACKUP_STREAM authorization failures can disclose the database\n    and crash rqlited (boo#1286934)\n  * GET /leader returns a JSON error body when there is no leader\n  * Close the connection after rejecting an unauthorized inter-node\n    backup stream request, instead of streaming the database anyway\n  * Decide inter-node command authorization once, before dispatch,\n    and close the connection after rejecting any unauthorized\n    command\n\n- Update to version 10.6.3:\n  * Node probes honor request context and commit exactly one\n    result\n  * Make DB connections a first-class object\n  * Prevent ATTACH on the query database connection\n\n- Update to version 10.6.2:\n  * Check for trailing junk in request bodies\n  * Console schema view handles table names that collide with\n    JavaScript object properties\n  * Set CommitTimestamps in CDC Events Group\n  * Upgrade dependencies\n\n- Update to version 10.6.1:\n  * Use constant-time comparison when comparing passwords\n  * Conditionally rewrite SQL during queued writes and fix\n    rewriting of CURRENT_TIMESTAMP and related tokens\n  * More robust Leader stepdown node ID detection, reap checks,\n    and SQL analyze start-time recording\n  * CDC fixes: encode non-finite floats, always release flush\n    waiters, and make the HTTP sink follow redirects\n  * Converted _service from mode=disabled to mode=manual (legacy\n    leftover; services are run by hand via osc service manualrun)\n  * Package is not affected by CVE-2026-84445 (boo#1278793),\n    CVE-2026-84304 (boo#1279102), CVE-2026-84303 (boo#1279253):\n    vendored grpc is v1.84.0, above the v1.83.1/v1.83.2 fixes\n  * Package is not affected by CVE-2026-89090 (boo#1280657):\n    vendored eventstream is v1.7.20, above the v1.7.8 fix\n  * Package is not affected by CVE-2026-63209 (boo#1283555):\n    vendored klauspost/compress is v1.20.1, above the v1.18.7\n    fix\n  * Package is not affected by CVE-2026-39821 (boo#1266544):\n    vendored golang.org/x/net is v0.59.0, above the v0.55.0\n    fix\n\n- Update to version 10.6.0:\n  * API addition: error_v2 may contain numeric SQLite error codes.\n  * addresses a security issue related to Authentication files. A\n    user with no explicit permissions could be grant elevated\n    permissions. Correctly configured users do not suffer from this\n    issue.\n  * multiple implementation changes and bug fixes\n  * Display interactive cluster topology on web console.\n  * Support configurable queued-writes retries\n  * release addresses a gap in the role-based access permissions\n    related to change-data-capture (CDC) handling\n\n- Update to version 10.3.6:\n  * Add query logging to database layer\n  * Snapshot IDs now contain (optional) generation\n  * Bump generation ID if snapshot IDs collide\n  * Snapshots can be filtered by term and index\n  * Add support for File Renaming and Removing with retries\n  * Replace standard library with fsutil\n  * Keep snapshot ordering correct regardless of clock\n  * Remove snapshot name generation ID\n\n- Update to version 10.3.5:\n  * Reject alternate form of unsupported PRAGMA commands\n  * Handle negative trailing logs\n  * Sync access to last backup time at http layer\n  * Set the \"Served by\" header before first backup byte\n  * Set DB load response time for all formats\n  * Fix HTTP logic error for queued statements\n  * Minor web console fixes\n- includes changes from 10.0.4:\n  * Do not emit rolled-back events over CDC\n- includes changes from 10.0.3:\n  * Refactor busy timeout methods\n  * Fix edge-case bugs detected by GPT-6 Astra\n  * Switch to quay.io/minio/minio:latest for testing purposes\n  * Fix removing a node with different ID, but same Raft address\n  * Use correct Foreign Key setting when recovering node\n  * Only dump the indexes and triggers of the selected tables\n  * Detect DB changes during Request(RETURNING)\n  * Snapshot Open() first checks for failed reap\n  * Sync snapshot plan directory\n  * Propagate WAL stat errors\n  * Clean up cancelled snapshots\n  * Reject incomplete snapshot headers\n  * Validate restore database header\n  * Only reap a sole fullsnapshot if it has zero WALs\n  * Keep database dumps consistent during writes to the database\n  * Roll back DB Requests on statement-prepare errors\n- includes changes from 10.0.2:\n  * Upgrade SQLite driver\n  * Unit test reaping an installed Snapshot and streamed Snapshot combo\n  * Use distinct Snapshot Namer type\n  * Replace breaking-pragma regexes with ASCII prefix scanning\n  * Consolidate pragma and txStatus reads onto a single connection per pool\n  * Fix some magic strings in db package\n\n- Update to version 10.3.1:\n  * Consolidate SQLite driver construction\n  * Plumb Term and Index through during Snapshot Restore\n  * Hard exit if FSM Restore fails post database-swap\n\n- Update to version 10.3.0:\n  * Console app supports quickly querying for first 100 rows of a\n    table\n  * Rename read-only nodes to read replicas. Command-line flags\n    unchanged\n  * Bundles dependencies updated\n  * Add infra for pushing OTLP metrics to an OpenTelemetry\n    Collector\n  * Add query logging at database level\n  * Add CopyDir functionality to file utils.\n  * Add ability to clone Snapshots, primarily for testing purposes\n  * Store Index and Term in Fingerprint file and check during\n    start-up\n\n- Update to version 10.2.7:\n  * Remove explicit database-level read-only check from the pure\n    Query path\n  * Miscellaneous Store-level fixes related to resource management\n    and shutdown sequence\n  * Don't run CRC checks twice on Snapshot when fast-restart is\n    explicitly disabled\n  * Fixes to the http package including SQL rewriting control.\n  * Address potential dropped CDC event on restart\n  * Various minor fixes\n - includes changes from 10.2.6:\n  * Handle a fully-executed Reap plan, but Plan file itself not\n    removed\n  * Close Snapshot streamer on error.\n- includes changes from 10.2.5:\n  * Perform a Quick Integrity check after reaping snapshots, not\n    Full\n\n- Update to version 10.2.4:\n  * Fix some non-AWS S3-compatible stores\n- includes changes from 10.2.3\n  * Check snapshot store integrity before first actual use\n  * Disable HTTP timeout for boot and restore operations via the shell\n  * HTTP layer ignores ErrNoWALToSnapshot when snapshotting\n  * Close Snapshot Streamer ASAP when restoring to local node\n","modified":"2026-11-04T17:23:48.458239871Z","published":"2026-11-03T18:20:11Z","related":["CVE-2026-39821","CVE-2026-63209","CVE-2026-84303","CVE-2026-84304","CVE-2026-84445","CVE-2026-89090"],"upstream":["CVE-2026-39821","CVE-2026-63209","CVE-2026-84303","CVE-2026-84304","CVE-2026-84445","CVE-2026-89090"],"references":[{"type":"ADVISORY"},{"type":"REPORT","url":"https://bugzilla.suse.com/1266544"},{"type":"REPORT","url":"https://bugzilla.suse.com/1278793"},{"type":"REPORT","url":"https://bugzilla.suse.com/1279102"},{"type":"REPORT","url":"https://bugzilla.suse.com/1279253"},{"type":"REPORT","url":"https://bugzilla.suse.com/1280657"},{"type":"REPORT","url":"https://bugzilla.suse.com/1283555"},{"type":"REPORT","url":"https://bugzilla.suse.com/1286934"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-39821"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-63209"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-84303"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-84304"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-84445"},{"type":"WEB","url":"https://www.suse.com/security/cve/CVE-2026-89090"}],"affected":[{"package":{"name":"rqlite","ecosystem":"openSUSE:Leap 16.0","purl":"pkg:rpm/opensuse/rqlite&distro=openSUSE%20Leap%2016.0"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.6.6-bp160.1.1"}]}],"ecosystem_specific":{"binaries":[{"rqlite":"10.6.6-bp160.1.1"}]},"database_specific":{"source":"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:22224-1.json"}}],"schema_version":"1.9.2"}